We help IT Professionals succeed at work.

We've partnered with Certified Experts, Carl Webster and Richard Faulkner, to bring you two Citrix podcasts. Learn about 2020 trends and get answers to your biggest Citrix questions!Listen Now


Exchange Server 2003 rejecting emails containing VBA macros

perrytcpa asked
Medium Priority
Last Modified: 2008-01-09
Another user asked a question about the error "552 ms-office file containing VBA macros" back on the 7th of March, but the answer was not sufficient.

My server is rejecting incoming messages that contain Excel files and the sender gets the same message you see above, but I can't find out where that is configured or enabled on my server.

I have Exchange 2003, Symantec Enterprise with the Exchange add-on, and a Sonicwall firewall.

The Sonicwall is configured to reject VBS ant EXE attachments, but the message generated would be something else.

The Symantec scans for viruses, but should quarantine the attachment and still let the message through to the recipient with a warning message.

I see nothing in Exchange 2003 that would reject messages because of VBA scripts inside an attachment.

I need to get this fixed immediately. Tax season is a lousy time for users to scream at an accounting firm.
Watch Question

Irwin SantosComputer Integration Specialist

double check your Symantec configuration.


Did that already, as described.
Irwin SantosComputer Integration Specialist

would it be feasible for you to turn off the Symantec service for testing so that you can send an Excel attachment from an outside email.. such as your client or maybe even create a homail account to do so?  If you get the same results with Symantec off. .then we look elsewhere.. if on, then it is in the configuration preventing the transport of the XLS file.


If I can get a copy of the XLS file, then I can try disabling the auto-protect. I don't think it will help, because Symantec doesn't BLOCK messages from being received by the mail server - it only quarantines the message then warns the recipient that a message had an attachment that wasn't allowed. It does the same thing with content filtering as it scans for messages about viagra and penis enlargers.

But I'm willing to give it a shot just to rule out the Symantec being the cause. It was the first thing I checked, but I know I have to try to rule it out.

In the meantime, what could cause a bounce message that says,  "552 ms-office file containing VBA macros" ? It seems like an Exchange generated message, like the familiar "550 Relay not allowed" message.

I'll get back after I find the offending file and try it.
I did a quick search ... it looks like this is your firewall doing this ... check out this ...

queue, thus preventing it from being resent, via 552 SMTP response and the ... Restrict Transfer of MS-Office type files containing macros (VBA 5 and above) ...
www.sonicwall.com/support/ pdfs/SonicWALL_GAV_AdminGuide.pdf - Similar pages

Not the solution you were looking for? Getting a personalized solution is easy.

Ask the Experts



Concerning the sonicwall Admin Guide - I downloaded it and searched for 552 SMTP and only got one refernce. It didn't seem to apply.

Your response seemed a little disjointed, as if your cut and paste didn't work as you expected. Were you trying to point me to a specific page or solution?
I think cj_1969 was pointing you to the manual for SonicWall which relates to the restrict transfer settings listed under the Configure Gateway AV Settings button in the Gateway Anti-Virus Global Settings section. If enabled, prevent files with specific attributes from being transferred to SMTP. This includes VBA for Macros in Office 97 and above.

Uncheck this box and see if that helps. The message certainly looks like a SonicWall error. You should see this in the SonicWall logs (assuming you are trapping to informational status).

Hope this helps
IPKON Networks Ltd

Sorry for the disjointed reply ... the second part was the search results summary, this indicated, as pointed out by IPKON, that the firewall has the settings for blocking exactly what you claimed was happening, and it showed the exact error number that you were seeing ... put the two together and it was apparent that there is an option in the firewall that is causing the problem, especially since none of the other pieces are known to have this specific functionality and produce this exact result.  

And then IPKON pointed out the specific settings that should be causing the problem.
Access more of Experts Exchange with a free account
Thanks for using Experts Exchange.

Create a free account to continue.

Limited access with a free account allows you to:

  • View three pieces of content (articles, solutions, posts, and videos)
  • Ask the experts questions (counted toward content limit)
  • Customize your dashboard and profile

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.


Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.