Exchange 2003 Log files Non Delivered Report NDR

Ok.  So I know where the Exchange log files reside.  And this question is most likely a multiple question.

The log file in the Exchsvr? folder w/the date formats....I open and can read them properly.

My NDR is set to not send out ->
I’ve been investigating into the NDR returns the users receive when they emails are rejected.  And the odd things is, although it’s an auto enabled feature it has been turned off. So, I don’t quite know how user's are receiving a bounce reply.  If users were to receive the rejected/bounced emails then the “Allow non-delivery reports” would be enabled.

I've now set myself up to be the one to receive the NDR reports and have set a role so it doesn't interfere w/anything, it'll just have to be monitored.

Also, want to add we are running GFI Essentials, and I've heard throughout this forum it's not the best, unfortunately we're stuck w/it.

When I set the NDR's to be sent to by inbox to a certain folder, it has the error code, the subject the receiver and some additional information, but it does not show me the sender.  It shows the sender as System Administrator.  Is there anyway, to add the sender of the message into the NDR file?

AnD also, even though the NDRs are turned off for the user's they still receive them.
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

The NDR's sender will be the Postmaster/sys admin...that is by's not that generates the NDR, even if the email was destined for joe originally.

Where did you turn NDR's off?  In Exchange system admin or in GFI?  Can you tell me the exact thing you turned off?
mdmcq5Author Commented:
i went into system manager, highlighted Internet Message Formats, right clicked on Default, the Properties page came up and at the bottom the "Allow non-delivery reports" is not checked.

I've looked through GFI, and it appears the only options set are the white and black lists, everything else says "not enabled" so there must not be an NDR setting in there, if there is, I can't locate it.

And do you know if there's a way to determine who the original sender is of the NDR message?  Or is my only obtion to Message Track the 'Subject' in System Manager?

The IT dept wants to monitor these, we don't want the user's receiving them.  
The original sender of the NDR message will be either your mail system (Exchange) or an external mail system.  It won't be an individual.

Are you trying to prevent NDR's your Exchange system is sending out to external users or internal users?  You WON'T be able to prevent other mail systems from sending out NDRs.
The 7 Worst Nightmares of a Sysadmin

Fear not! To defend your business’ IT systems we’re going to shine a light on the seven most sinister terrors that haunt sysadmins. That way you can be sure there’s nothing in your stack waiting to go bump in the night.

mdmcq5Author Commented:
The way it is currently setup by our Security Admin is for neither internal or external to receive the NDRs, espeically external if they're just spammers.

And since the NDR setting is turned of in System Manager, any clue why an internal user received an NDR?
Internal users will still receive an NDR from external postmasters.  Check the "from" address in the headers to see if that's the case.
mdmcq5Author Commented:
Well internal users receive the NDRs, even though the checkbox is empty? Does that mean 'External' senders will not recieve the response it is a wrong email address?

You are basically controlling what your mail server is doing with it's own NDR's, whether it is sending an internal NDR because a user tried to send something over the size restrictions, or an external user is getting an NDR from you because they are trying to send something to you over the size restrictions (or whatever).

You aren't saying "nobody in my organization should receive an NDR, ever", because you cannot control what other mail systems send out.  Now you can "filter" who receives copies of those NDRs from the outside.  MS recommends you setup a postmaster address and then if needed have NDRs go to that address, as opposed to the user.

See this KB article.;en-us;294757

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Thanks for the points!
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2003

From novice to tech pro — start learning today.