RE: Interesting Observation

  • From: "Michael B. Smith" <michael@xxxxxxxxxx>
  • To: "[ExchangeList]" <exchangelist@xxxxxxxxxxxxx>
  • Date: Thu, 10 Jun 2004 15:48:24 -0400

I think the behavior is appropriate. As you know, Exchange maintains a
log-file-number, and if that file is already there -- there is a
problem. The database and transactional system is fubar'ed.

I think it's a good thing that on Ex2003/Win2003 that Everyone doesn't
have permission to the MDBDATA folders by default. :-)

But if a worm/virus has admin access, I'm already SOL.... 

-----Original Message-----
From: Mark Fugatt [mailto:mark@xxxxxxxxx] 
Sent: Thursday, June 10, 2004 3:42 PM
To: [ExchangeList]
Subject: [exchangelist] Interesting Observation

I was teaching an Exchange 2003 support class for Symantec this week, so
that their gold and platinum support guys had a good understanding of
how Exchange really works :-), he talked about log files, and one of the
guys asked what would happen if you created a new log file, for example,
the last log file is E0000001.LOG and you create E0000002.log manually.

We tried it to see, and the effect was that the Outlook clients would
hang when trying to send mail, until you deleted the manually created
log file, the other effect was when you performed an online backup the
backup would fail, and then dismount all the Stores in the Storage Group
that you were trying to backup, this then led them to ask what type of
security risk this would be, if someone managed to create a worm that
created a log file manually it would bring down all the Stores when you
perform a backup.

What are your thoughts?


List Archives:
Exchange Newsletters:
Exchange FAQ:
Other Internet Software Marketing Sites:
World of Windows Networking: Leading
Network Software Directory:
No.1 ISA Server Resource Site: Windows Security
Resource Site: Network Security Library: Windows 2000/NT Fax Solutions:
You are currently subscribed to this Discussion List as:
michael@xxxxxxxxxx To unsubscribe visit

Other related posts: