Yeah phil nothing to sweat. Besides my solution was once the relay had been closed. Anyway I am not the huge exchange guy but I believe the reason they stick around for a bit is to handle connections to that same domain if more mail is sent. Then the "queue" on the virtual SMTP server doesn't have to be recreated. Not sure of the algorithms used but I would assume they are smart enough to look at how many mails are sent to a domain name and change the length of time the queue remains dependent upon that, etc, etc. If this was an exchange group we could start a discussion on Quanta with regards to Virtual server queues !!!!! Ron Oglesby Senior Technical Architect Microsoft MVP - Windows Server RapidApp, Chicago Mobile 815 325-7618 Office 312 372-7188 e-mail roglesby@xxxxxxxxxxxx -----Original Message----- From: thin-bounce@xxxxxxxxxxxxx [mailto:thin-bounce@xxxxxxxxxxxxx] On Behalf Of Philip Walley Sent: Thursday, March 04, 2004 10:16 AM To: thin@xxxxxxxxxxxxx Subject: [THIN] Re: Exchange question I have relay set so no one can relay unless the authenticate. I set all = users to be forced to change their passwords. I think the box is ok, I = just wasn't expecting to see domain names show up like that. I figured = it would all be under the SMTP queue. There aren't any msgs in the = queue, ok, 1 had 2 emails in it, but now I see that they are deleting = themselves after some time. I guess I just got overly concerned too = quick thanks to the recent issues with viruses.=20 -----Original Message----- From: thin-bounce@xxxxxxxxxxxxx [mailto:thin-bounce@xxxxxxxxxxxxx]On Behalf Of Ron Oglesby Sent: Thursday, March 04, 2004 8:53 AM To: thin@xxxxxxxxxxxxx Subject: [THIN] Re: Exchange question First off make sure you change the SMTP Virtual server's relay settings = to only allow your IP to relay. =20 Also once that is done look at the queues. Are they Chocked FULL or do = you just have a ton of empty ones? If they are a bunch with 0 messages they = will go away the ones with TONS of messages are awaiting delivery etc. Those = you can right click on the queue slect find messages, then hit the find = button. Delete them with no NDR.=20 NOW. If you have thousands of messages (I had a customer yesterday = killing a quad box with like 45,000 messages waiting to go outbound) you may need = to get a little more creative. We change the Virtual server and all connectors to route to a smart = host. This smart host was a really a Windows 2000 box with IIS and SMTP on it. = Now we let all the messages dump right to it over several hours). Once the queues were emptied we rest the connectors and virtual server. Then we = just stopped the SMTP service on the smart host and killed all the messages. Microsoft would have you send it to a bogus smart host, then try to = delete everything in the queue. This would take more than several hours so our little "method" was faster. Ron Oglesby Senior Technical Architect Microsoft MVP - Windows Server =20 RapidApp, Chicago Mobile 815 325-7618 Office 312 372-7188 e-mail roglesby@xxxxxxxxxxxx =20 -----Original Message----- From: thin-bounce@xxxxxxxxxxxxx [mailto:thin-bounce@xxxxxxxxxxxxx] On = Behalf Of Philip Walley Sent: Thursday, March 04, 2004 8:30 AM To: Thin (E-mail) Subject: [THIN] Exchange question I have an exchange 2003 server that someone has obviously compromised. I noticed in the msg queues that there were entries for domains that I = didn't know anything about. My questions are how do I delete the msg queues and what can I do to prevent this from happening again?=20 Philip Walley=20 Sr. Network Engineer=20 Consultrix Technologies=20 Memphis, TN.=20 (901) 383-1300=20 =20 ******************************************************** This weeks sponsor triCerat Inc. triCerat makes your job easier by offering essential applications to eliminate your printing, policy and profile, and your application management problems. http://www.triCerat.com=20 ********************************************************** Useful Thin Client Computing Links are available at: http://thin.net/links.cfm *********************************************************** For Archives, to Unsubscribe, Subscribe or=20 set Digest or Vacation mode use the below link: http://thin.net/citrixlist.cfm ******************************************************** This weeks sponsor triCerat Inc. triCerat makes your job easier by offering essential applications to eliminate your printing, policy and profile, and your application management problems. http://www.triCerat.com=20 ********************************************************** Useful Thin Client Computing Links are available at: http://thin.net/links.cfm *********************************************************** For Archives, to Unsubscribe, Subscribe or=20 set Digest or Vacation mode use the below link: http://thin.net/citrixlist.cfm ******************************************************** This weeks sponsor triCerat Inc. triCerat makes your job easier by offering essential applications to eliminate your printing, policy and profile, and your application management problems. http://www.triCerat.com ********************************************************** Useful Thin Client Computing Links are available at: http://thin.net/links.cfm *********************************************************** For Archives, to Unsubscribe, Subscribe or set Digest or Vacation mode use the below link: http://thin.net/citrixlist.cfm ******************************************************** This weeks sponsor triCerat Inc. triCerat makes your job easier by offering essential applications to eliminate your printing, policy and profile, and your application management problems. http://www.triCerat.com ********************************************************** Useful Thin Client Computing Links are available at: http://thin.net/links.cfm *********************************************************** For Archives, to Unsubscribe, Subscribe or set Digest or Vacation mode use the below link: http://thin.net/citrixlist.cfm