[ExchangeList] Re: Event ID 7010

  • From: "Simon Whale" <simonwhale@xxxxxxxxxxxxx>
  • To: <exchangelist@xxxxxxxxxxxxx>
  • Date: Wed, 24 May 2006 22:57:08 +0100

ngeTransport&phase=1> &eventno=3923&source=MSExchangeTransport&phase=1



simon whale



From: exchangelist-bounce@xxxxxxxxxxxxx
[mailto:exchangelist-bounce@xxxxxxxxxxxxx] On Behalf Of Jensen, Douglas
Sent: 24 May 2006 22:21
To: exchangelist@xxxxxxxxxxxxx
Subject: [ExchangeList] Event ID 7010 


I get event id 7010 similar to the following 



Event Type: Error
Event Source: MSExchangeTransport
Event Category: SMTP Protocol
Event ID: 7010
Date: 1/13/2004 
Time: 5:43:49 PM
User: N/A Computer: COMPUTERNAME
Description: This is an SMTP protocol log for virtual server ID 1,
connection #30. The client at "" sent a "xexch50" command, and the
SMTP server responded with "504 Need to authenticate first ". The full
command sent was "xexch50 1092 2". This will probably cause the connection
to fail. 

I know that this was discussed about a month ago and I searched the archive
but could not find a resolution.

I have an exchange 2003 server on Windows 2003 server. I am sending mail to
another exchange server. This other exchange server is not in my domain and
we do not share a forest or anything else. There should be no authentication
that takes place.

I found on Microsoft some mention that the "xexch50 1092 2" tells the other
server the size of some file that is coming. Maybe the size of the email
being transported. The other server is supposed to respond with a BLOB
(binary large object?) but that might have failed between the servers. Could
be the ISA server firewall might have blocked it. 

I looked in my ISA server and found Event ID 15105 ISA server detected an
all port scan attack from IP .... and this IP address is the same address as
the exchange server I am trying to send the email messages to. Could ISA be
confusing the blob and a port scan attack? That doesn't make since but I am
not finding a Event ID 20031 unknown smtp command error in ISA that
Microsoft says should be there if this is the problem.

Did anyone resolve this issue already?

I did the reg hack that was supposed to turn off the xexch50 on my end and
set the SMTP server to say helo rather then ehlo so I would not advertise
the xexch50 service on my end but the email is still sitting there in the
outbound queue and not going anywhere. The message in the exchange server
manager for the Queue just says "The connection was dropped by the remote

Douglas Jensen
 <mailto:Douglas.Jensen@xxxxxxxxxxxxx> Douglas.Jensen@xxxxxxxxxxxxx
Voice (952) 402-9821
Fax (952) 402-9815
Network Administrator
Scott Carver Dakota CAP Agency, Inc.
712 Canterbury Road
Shakopee, MN 55379 
rosoft\Signatures\www.capagency.org> www.capagency.org 

These events indicate that the XEXCH50 protocol sink fired, but the exchange
of the blobs failed between the servers listed in the events.


Other related posts: