asked on

Occasionally attachments being stripped out of emails

On quite a few occasions when forwarding emails with attachments they are not being received or being stripped from the message although if saved and then attached to the message from our server they are OK to both internal & external recipients
Emaple email with excel attachment being forwarded to external recipient attachment gets stripped, to an internal recipient same message & attachment get through.

Hilal1924

Hi Do you have any Spam Filter installed in your environment ? Also Check Your transport Agents and see what is enabled?

Hilal

Hilal1924

OK Now I see that you have GFI Mail essentials, Go to the GFI Console and check if it is used to block or quarantine attachments.
Check this one out:
http://kbase.gfi.com/showarticle.asp?id=KBID003342

Also run these two commands on your exchange server and post the results here:
Get-TransportAgent |Fl *
Get-TransportPipeline |fl *

Hilal

Richard Gray

ASKER

[PS] C:\Windows\system32>Get-TransportAgent |Fl *

PSComputerName : pppmail.philippank.com
RunspaceId : b974cf44-1f20-4048-bac7-a1449a86400e
Enabled : True
Priority : 1
TransportAgentFactory : ContentSecurity.ExchangeAgents.GfiAvSmtpAgentFactory
AssemblyPath : E:\GFI\ContentSecurity\MailSecurity\ContentSecurity.ExchangeAgents.GfiAvSmtpAgent.dll
Identity : GfiAvSmtpAgent
IsValid : True

PSComputerName : pppmail.philippank.com
RunspaceId : b974cf44-1f20-4048-bac7-a1449a86400e
Enabled : True
Priority : 2
TransportAgentFactory : ContentSecurity.ExchangeAgents.GfiAvRoutingAgentFactory
AssemblyPath : E:\GFI\ContentSecurity\MailSecurity\ContentSecurity.ExchangeAgents.GfiAvRoutingAgent.dll
Identity : GfiAvRoutingAgent
IsValid : True

PSComputerName : pppmail.philippank.com
RunspaceId : b974cf44-1f20-4048-bac7-a1449a86400e
Enabled : True
Priority : 3
TransportAgentFactory : Microsoft.Exchange.MessagingPolicies.TransportRuleAgent.TransportRuleAgentFactory
AssemblyPath : E:\Exchange Server\V14\TransportRoles\agents\Rule\Microsoft.Exchange.MessagingPolicies.Transpor
tRuleAgent.dll
Identity : Transport Rule Agent
IsValid : True

PSComputerName : pppmail.philippank.com
RunspaceId : b974cf44-1f20-4048-bac7-a1449a86400e
Enabled : True
Priority : 4
TransportAgentFactory : Microsoft.Exchange.TextMessaging.MobileDriver.TextMessagingRoutingAgentFactory
AssemblyPath : E:\Exchange Server\V14\bin\Microsoft.Exchange.MobileDriver.dll
Identity : Text Messaging Routing Agent
IsValid : True

PSComputerName : pppmail.philippank.com
RunspaceId : b974cf44-1f20-4048-bac7-a1449a86400e
Enabled : True
Priority : 5
TransportAgentFactory : Microsoft.Exchange.TextMessaging.MobileDriver.TextMessagingDeliveryAgentFactory
AssemblyPath : E:\Exchange Server\V14\bin\Microsoft.Exchange.MobileDriver.dll
Identity : Text Messaging Delivery Agent
IsValid : True

PSComputerName : pppmail.philippank.com
RunspaceId : b974cf44-1f20-4048-bac7-a1449a86400e
Enabled : True
Priority : 6
TransportAgentFactory : ContentSecurity.ExchangeAgents.GfiAsRtSubmittedAgentFactory
AssemblyPath : E:\GFI\MailEssentials\ContentSecurity.ExchangeAgents.gfiasrtsubmittedagent.dll
Identity : GfiAsRtSubmittedAgent
IsValid : True

PSComputerName : pppmail.philippank.com
RunspaceId : b974cf44-1f20-4048-bac7-a1449a86400e
Enabled : True
Priority : 7
TransportAgentFactory : ContentSecurity.ExchangeAgents.GfiAsRtRoutedAgentFactory
AssemblyPath : E:\GFI\MailEssentials\ContentSecurity.ExchangeAgents.gfiasrtroutedagent.dll
Identity : GfiAsRtRoutedAgent
IsValid : True

PSComputerName : pppmail.philippank.com
RunspaceId : b974cf44-1f20-4048-bac7-a1449a86400e
Enabled : True
Priority : 8
TransportAgentFactory : ContentSecurity.ExchangeAgents.GfiAsSmtpAgentFactory
AssemblyPath : E:\GFI\MailEssentials\ContentSecurity.ExchangeAgents.gfiassmtpagent.dll
Identity : GfiAsSmtpAgent
IsValid : True

PSComputerName : pppmail.philippank.com
RunspaceId : b974cf44-1f20-4048-bac7-a1449a86400e
Enabled : True
Priority : 9
TransportAgentFactory : ContentSecurity.ExchangeAgents.GfiAsSmtp2AgentFactory
AssemblyPath : E:\GFI\MailEssentials\ContentSecurity.ExchangeAgents.gfiassmtp2agent.dll
Identity : GfiAsSmtp2Agent
IsValid : True

[PS] C:\Windows\system32>Get-TransportPipeline |fl *

PSComputerName : pppmail.philippank.com
RunspaceId : b974cf44-1f20-4048-bac7-a1449a86400e
Event : OnConnectEvent
TransportAgents : {}
Identity :
IsValid : True

PSComputerName : pppmail.philippank.com
RunspaceId : b974cf44-1f20-4048-bac7-a1449a86400e
Event : OnHeloCommand
TransportAgents : {}
Identity :
IsValid : True

PSComputerName : pppmail.philippank.com
RunspaceId : b974cf44-1f20-4048-bac7-a1449a86400e
Event : OnEhloCommand
TransportAgents : {}
Identity :
IsValid : True

PSComputerName : pppmail.philippank.com
RunspaceId : b974cf44-1f20-4048-bac7-a1449a86400e
Event : OnAuthCommand
TransportAgents : {}
Identity :
IsValid : True

PSComputerName : pppmail.philippank.com
RunspaceId : b974cf44-1f20-4048-bac7-a1449a86400e
Event : OnEndOfAuthentication
TransportAgents : {}
Identity :
IsValid : True

PSComputerName : pppmail.philippank.com
RunspaceId : b974cf44-1f20-4048-bac7-a1449a86400e
Event : OnMailCommand
TransportAgents : {}
Identity :
IsValid : True

PSComputerName : pppmail.philippank.com
RunspaceId : b974cf44-1f20-4048-bac7-a1449a86400e
Event : OnRcptCommand
TransportAgents : {}
Identity :
IsValid : True

PSComputerName : pppmail.philippank.com
RunspaceId : b974cf44-1f20-4048-bac7-a1449a86400e
Event : OnDataCommand
TransportAgents : {GfiAsSmtp2Agent}
Identity :
IsValid : True

PSComputerName : pppmail.philippank.com
RunspaceId : b974cf44-1f20-4048-bac7-a1449a86400e
Event : OnEndOfHeaders
TransportAgents : {GfiAvSmtpAgent, GfiAsSmtpAgent}
Identity :
IsValid : True

PSComputerName : pppmail.philippank.com
RunspaceId : b974cf44-1f20-4048-bac7-a1449a86400e
Event : OnEndOfData
TransportAgents : {}
Identity :
IsValid : True

PSComputerName : pppmail.philippank.com
RunspaceId : b974cf44-1f20-4048-bac7-a1449a86400e
Event : OnHelpCommand
TransportAgents : {}
Identity :
IsValid : True

PSComputerName : pppmail.philippank.com
RunspaceId : b974cf44-1f20-4048-bac7-a1449a86400e
Event : OnNoopCommand
TransportAgents : {}
Identity :
IsValid : True

PSComputerName : pppmail.philippank.com
RunspaceId : b974cf44-1f20-4048-bac7-a1449a86400e
Event : OnReject
TransportAgents : {}
Identity :
IsValid : True

PSComputerName : pppmail.philippank.com
RunspaceId : b974cf44-1f20-4048-bac7-a1449a86400e
Event : OnRsetCommand
TransportAgents : {}
Identity :
IsValid : True

PSComputerName : pppmail.philippank.com
RunspaceId : b974cf44-1f20-4048-bac7-a1449a86400e
Event : OnDisconnectEvent
TransportAgents : {}
Identity :
IsValid : True

PSComputerName : pppmail.philippank.com
RunspaceId : b974cf44-1f20-4048-bac7-a1449a86400e
Event : OnSubmittedMessage
TransportAgents : {GfiAvRoutingAgent, Text Messaging Routing Agent, GfiAsRtSubmittedAgent}
Identity :
IsValid : True

PSComputerName : pppmail.philippank.com
RunspaceId : b974cf44-1f20-4048-bac7-a1449a86400e
Event : OnResolvedMessage
TransportAgents : {}
Identity :
IsValid : True

PSComputerName : pppmail.philippank.com
RunspaceId : b974cf44-1f20-4048-bac7-a1449a86400e
Event : OnRoutedMessage
TransportAgents : {Transport Rule Agent, GfiAsRtRoutedAgent}
Identity :
IsValid : True

PSComputerName : pppmail.philippank.com
RunspaceId : b974cf44-1f20-4048-bac7-a1449a86400e
Event : OnCategorizedMessage
TransportAgents : {}
Identity :
IsValid : True

[PS] C:\Windows\system32>

I looked at Mail security which does the attachment checking & any filters there are disabled

Hilal1924

Hi Could you do a Simple Test,

Go to GFI Mail Security and Disable all the services. And then send the attachment. After disabling the services run those two commands again. You entire transport channel is plagued with GFI.

Hilal

Richard Gray

ASKER

Ok will do later this pm as I'm out of the office. But here's an update
If a user tries to forward an email with an attachment it occasionaly strips out the attachment. If they save the attachment & then send it in a new email it works.

Texas_Billy

The problem may not be GFI. Internal recipients getting messages that external can't receive is a clue: your internal users could be sending messages in Rich Text format, while some external recipients are using mail clients like Outlook Express that don't support Rich Text.

(1) Find a user that can't send to a particular recipient, check to see if they're sending with Rich Text or Plain Text.
(2) If they're sending in Rich Text, change it to Plain Text and re-send the message, see if the recipient gets the message.

Note: If you're using Outlook 2003 or later, for some contacts, it will automatically send in Rich Text, even if the mail format setting is set to Plain Text. If you suspect this, find the recipient in the contacts folder, go to properties, right-click the email address, go to properties, and uncheck the "always send to this recipient in Rich Text format."

If the problem is indeed Rich Text format and recipients using a mail client that don't support it, clients are likely getting an attachment called "WinMail.dat" instead of the original attachment. I have, however, seen recipients get nothing at all, and the problem was indeed Rich Text. --TX

Richard Gray

ASKER

Its related to both internal & external! Same user can send email with attachment internal & it will fail but can work external & vice versa in some cases. What is guarenteed is if they save the attachment locally, then create new email & send it it will work first time internally & externally

Richard Gray

ASKER

UPDATE !!!
gets even weirder! A user can send emails with attachments to external addresses, when including interal staff the attachements are lost!!! His profile setup is the same as every one elses within the organisation.

Richard Gray

ASKER

Further update !!!!!
It would appear to only happen when forwarding emails with attachments! If you save the attachments & create a new email message it works fine. GFI Mail essentials & Mail security would "appear "to be processing as they should. Even though the message was sent with attachments stripped out, Mail essentials repirted 24/05/2010 15:08:57 Full Email Gerry Gilchrist <GerryGilchrist@PhilipPank.com> nick.s.nicolaou@aib.ie RE: FW: Scanned Doc Processed successfully. In both Mail essentials & Mail Security the filters have ALL been turned off.

ASKER CERTIFIED SOLUTION

Richard Gray

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

dvanhorn

Installed Exchange 2010 recently and had the same issue. If I disabled GFI services, attachments went through. Called GFI and it is a know issue with the use of Disclaimers. Enabled GFI and disabled disclaimers and attachments go through. GFI is testing a fix.

rnapro

What was the solution for this problem?