Exchange Server 2003 rejecting emails containing VBA macros

Posted on 2006-03-22
Last Modified: 2008-01-09
Another user asked a question about the error "552 ms-office file containing VBA macros" back on the 7th of March, but the answer was not sufficient.

My server is rejecting incoming messages that contain Excel files and the sender gets the same message you see above, but I can't find out where that is configured or enabled on my server.

I have Exchange 2003, Symantec Enterprise with the Exchange add-on, and a Sonicwall firewall.

The Sonicwall is configured to reject VBS ant EXE attachments, but the message generated would be something else.

The Symantec scans for viruses, but should quarantine the attachment and still let the message through to the recipient with a warning message.

I see nothing in Exchange 2003 that would reject messages because of VBA scripts inside an attachment.

I need to get this fixed immediately. Tax season is a lousy time for users to scream at an accounting firm.
Question by:perrytcpa
    LVL 30

    Expert Comment

    double check your Symantec configuration.

    Author Comment

    Did that already, as described.
    LVL 30

    Expert Comment

    would it be feasible for you to turn off the Symantec service for testing so that you can send an Excel attachment from an outside email.. such as your client or maybe even create a homail account to do so?  If you get the same results with Symantec off. .then we look elsewhere.. if on, then it is in the configuration preventing the transport of the XLS file.

    Author Comment

    If I can get a copy of the XLS file, then I can try disabling the auto-protect. I don't think it will help, because Symantec doesn't BLOCK messages from being received by the mail server - it only quarantines the message then warns the recipient that a message had an attachment that wasn't allowed. It does the same thing with content filtering as it scans for messages about viagra and penis enlargers.

    But I'm willing to give it a shot just to rule out the Symantec being the cause. It was the first thing I checked, but I know I have to try to rule it out.

    In the meantime, what could cause a bounce message that says,  "552 ms-office file containing VBA macros" ? It seems like an Exchange generated message, like the familiar "550 Relay not allowed" message.

    I'll get back after I find the offending file and try it.
    LVL 22

    Accepted Solution

    I did a quick search ... it looks like this is your firewall doing this ... check out this ...

    queue, thus preventing it from being resent, via 552 SMTP response and the ... Restrict Transfer of MS-Office type files containing macros (VBA 5 and above) ... pdfs/SonicWALL_GAV_AdminGuide.pdf - Similar pages

    Author Comment


    Concerning the sonicwall Admin Guide - I downloaded it and searched for 552 SMTP and only got one refernce. It didn't seem to apply.

    Your response seemed a little disjointed, as if your cut and paste didn't work as you expected. Were you trying to point me to a specific page or solution?
    LVL 9

    Assisted Solution

    I think cj_1969 was pointing you to the manual for SonicWall which relates to the restrict transfer settings listed under the Configure Gateway AV Settings button in the Gateway Anti-Virus Global Settings section. If enabled, prevent files with specific attributes from being transferred to SMTP. This includes VBA for Macros in Office 97 and above.

    Uncheck this box and see if that helps. The message certainly looks like a SonicWall error. You should see this in the SonicWall logs (assuming you are trapping to informational status).

    Hope this helps
    IPKON Networks Ltd
    LVL 22

    Expert Comment

    Sorry for the disjointed reply ... the second part was the search results summary, this indicated, as pointed out by IPKON, that the firewall has the settings for blocking exactly what you claimed was happening, and it showed the exact error number that you were seeing ... put the two together and it was apparent that there is an option in the firewall that is causing the problem, especially since none of the other pieces are known to have this specific functionality and produce this exact result.  

    And then IPKON pointed out the specific settings that should be causing the problem.

    Featured Post

    How to run any project with ease

    Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
    - Combine task lists, docs, spreadsheets, and chat in one
    - View and edit from mobile/offline
    - Cut down on emails

    Join & Write a Comment

    Suggested Solutions

    A list of useful business intelligence software.
    Let’s list some of the technologies that enable smooth teleworking. 
    The viewer will learn how to successfully download and install the SARDU utility on Windows 8, without downloading adware.
    An overview on how to enroll an hourly employee into the employee database and how to give them access into the clock in terminal.

    728 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    17 Experts available now in Live!

    Get 1:1 Help Now