[THIN] Re: Exchange question
- From: "Philip Walley" <philip.walley@xxxxxxxxxxxxxx>
- To: <thin@xxxxxxxxxxxxx>
- Date: Thu, 4 Mar 2004 10:16:11 -0600
I have relay set so no one can relay unless the authenticate. I set all =
users to be forced to change their passwords. I think the box is ok, I =
just wasn't expecting to see domain names show up like that. I figured =
it would all be under the SMTP queue. There aren't any msgs in the =
queue, ok, 1 had 2 emails in it, but now I see that they are deleting =
themselves after some time. I guess I just got overly concerned too =
quick thanks to the recent issues with viruses.=20
-----Original Message-----
From: thin-bounce@xxxxxxxxxxxxx [mailto:thin-bounce@xxxxxxxxxxxxx]On
Behalf Of Ron Oglesby
Sent: Thursday, March 04, 2004 8:53 AM
To: thin@xxxxxxxxxxxxx
Subject: [THIN] Re: Exchange question
First off make sure you change the SMTP Virtual server's relay settings =
to
only allow your IP to relay. =20
Also once that is done look at the queues. Are they Chocked FULL or do =
you
just have a ton of empty ones? If they are a bunch with 0 messages they =
will
go away the ones with TONS of messages are awaiting delivery etc. Those =
you
can right click on the queue slect find messages, then hit the find =
button.
Delete them with no NDR.=20
NOW. If you have thousands of messages (I had a customer yesterday =
killing a
quad box with like 45,000 messages waiting to go outbound) you may need =
to
get a little more creative.
We change the Virtual server and all connectors to route to a smart =
host.
This smart host was a really a Windows 2000 box with IIS and SMTP on it. =
Now
we let all the messages dump right to it over several hours). Once the
queues were emptied we rest the connectors and virtual server. Then we =
just
stopped the SMTP service on the smart host and killed all the messages.
Microsoft would have you send it to a bogus smart host, then try to =
delete
everything in the queue. This would take more than several hours so our
little "method" was faster.
Ron Oglesby
Senior Technical Architect
Microsoft MVP - Windows Server
=20
RapidApp, Chicago
Mobile 815 325-7618
Office 312 372-7188
e-mail roglesby@xxxxxxxxxxxx
=20
-----Original Message-----
From: thin-bounce@xxxxxxxxxxxxx [mailto:thin-bounce@xxxxxxxxxxxxx] On =
Behalf
Of Philip Walley
Sent: Thursday, March 04, 2004 8:30 AM
To: Thin (E-mail)
Subject: [THIN] Exchange question
I have an exchange 2003 server that someone has obviously compromised. I
noticed in the msg queues that there were entries for domains that I =
didn't
know anything about. My questions are how do I delete the msg queues and
what can I do to prevent this from happening again?=20
Philip Walley=20
Sr. Network Engineer=20
Consultrix Technologies=20
Memphis, TN.=20
(901) 383-1300=20
=20
********************************************************
This weeks sponsor triCerat Inc.
triCerat makes your job easier by offering essential
applications to eliminate your printing, policy and profile,
and your application management problems.
http://www.triCerat.com=20
**********************************************************
Useful Thin Client Computing Links are available at:
http://thin.net/links.cfm
***********************************************************
For Archives, to Unsubscribe, Subscribe or=20
set Digest or Vacation mode use the below link:
http://thin.net/citrixlist.cfm
********************************************************
This weeks sponsor triCerat Inc.
triCerat makes your job easier by offering essential
applications to eliminate your printing, policy and profile,
and your application management problems.
http://www.triCerat.com=20
**********************************************************
Useful Thin Client Computing Links are available at:
http://thin.net/links.cfm
***********************************************************
For Archives, to Unsubscribe, Subscribe or=20
set Digest or Vacation mode use the below link:
http://thin.net/citrixlist.cfm
********************************************************
This weeks sponsor triCerat Inc.
triCerat makes your job easier by offering essential
applications to eliminate your printing, policy and profile,
and your application management problems.
http://www.triCerat.com
**********************************************************
Useful Thin Client Computing Links are available at:
http://thin.net/links.cfm
***********************************************************
For Archives, to Unsubscribe, Subscribe or
set Digest or Vacation mode use the below link:
http://thin.net/citrixlist.cfm
Other related posts:
