Many NDR's not showing as coming from/to domain

  • From: "KEN MORRIS" <KMORRIS@xxxxxxx>
  • To: "[ExchangeList]" <exchangelist@xxxxxxxxxxxxx>
  • Date: Thu, 4 Sep 2003 08:47:32 -0400

Hi Guys,

This morning I walked into check my NDR's and found many (about 100 or so
since 1am today) reports being sent to me, When I take a look at my logs, I
am finding many event ID 1208 & 1209 messages about the IS maintenance. All
of the messages "appear" to be originating from a different domain than ours.

The server is W2K sp4 latest patches as of Tuesday morning, with E2K SP3. 

Any suggestions on what else I should be looking for, why I am receiving
these and has my server been compromised? Any suggestions/help is greatly



Other related posts: