Exhchange 2003 Queues

[SKent]

I seem to be getting a outrageous number of messages in my out queues. They just seem to build. I have over 350 presently. I can't help believing this is slowing my server down. Is there some way I can go in and delete those messages that are being retried and not going anywhere. I know I can delete them individually but that would really take a lot of time .. I would like to delete a batch of them at once .. Any help would be appreciated

 

[Smorgan11]

only can delete the queues one at a time

 

[SKent]

that is what I am finding out ... but I have adjusted the expired time out and they are started to dwindle .. I would think there is a better way. I have read on this forum where someone had over 3000 in queue .. that is a lot of single deletions

 

[Smorgan11]

sounds like the best way. I assume that the messages going out are legitimate and you dont have a virus or something!

 

[SKent]

Actually I think I have some kind of attack going on ...

 

[Smorgan11]

oh dear have you made it so only the server and designated PC's can send out via exhcnage? under protocols SMTP virtual server relay option

 

[SKent]

Yes .. I have insured that our server is not a relay for anyone ...

 

[Smorgan11]

whats the problem are the emails going to weird end points or soemthing?

 

[Zelandakh]

Only your Exchange server should be able to send emails out...

 

[SKent]

well how can I tell if it is set up right .. as far as I know only the server sends out emails .. I didn't even know individual machines could if they are attached to the exchage server

 

[SKent]

Well when I go into the queue and look at the mail, most of them are from the postmaster saying that they could not send mail to whoever.

 

[blakey2]

Only your Exchange server should be able to send emails out...

Well how can I tell if it is set up right .. as far as I know only the server sends out emails .. I didn't even know individual machines could if they are attached to the exchage server

You need to block outgoing connections to port 25 (SMTP) from all LAN addresses except the exchange server.

In my F/W it will block all traffic not explicitly allowed. This is the rule to allow the mailserver to send outgoing traffic:

Proto  	Source  	Port  	Destination  	Port  	Description
TCP/UDP    172.16.XX.XX   *  	    *  	   25 (SMTP)  	 Allow MAILSERVER -> SMTP to WAN

This will prevent any smtp traffic from the LAN.

Look at your F/W logs. If any LAN machines are trying to send out to port 25 then they probably have an infection and should be quarantined.

Cheers.