Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people, just like you, are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
Solved

How do I tell which users are depositing spam in the exchange outbound queues?

Posted on 2011-03-01
9
187 Views
Last Modified: 2012-05-11
Queues getting filled up with spam. Someone obviously has a virus. How do I tell how they got here?
0
Comment
Question by:leesobo
  • 6
  • 3
9 Comments
 
LVL 76

Expert Comment

by:Alan Hardisty
ID: 35013157
Please have a read of my article to see if you have an NDR issue or an authenticated relay issue:

http://www.experts-exchange.com/Software/Server_Software/Email_Servers/A_2427-Problems-sending-mail-to-one-or-more-external-domains.html
0
 

Author Comment

by:leesobo
ID: 35013341
I've checked. This is not an open relay. I do believe it's coming from inside. Endpoint protection is showing all clients good.
0
 
LVL 76

Expert Comment

by:Alan Hardisty
ID: 35013363
I'm not talking about an open relay - I'm talking about an authenticated relay.

Looking at the queues on your server - who are the senders of the emails?
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 
LVL 76

Expert Comment

by:Alan Hardisty
ID: 35013370
Wireshark should be able to tell you if the spam is coming from a local computer on the network:

http://www.wireshark.org/
0
 

Author Comment

by:leesobo
ID: 35013390
I've installed wireshark and have scanned. For some reason, I"m only getting packets from 1 pc sending to the server. What should I be looking at between the workstation and the Exchange server. Tried port 25. That didn't work.

The address is pcsolutions@television.com. No such address exists internally.
0
 
LVL 76

Expert Comment

by:Alan Hardisty
ID: 35013408
So the sender is pcsolutions@television.com?  If that is the case - please read my article again and ramp up the logging.
0
 
LVL 76

Expert Comment

by:Alan Hardisty
ID: 35013430
A quick way to be sure the problem isn't external (authenticated relay) is to remove Basic & Integrated Windows Authentication from your SMTP Virtual Server and restart the SMTP Service as per my blog article:

http://alanhardisty.wordpress.com/2010/12/01/increase-in-hacker-attempts-on-windows-exchange-servers-one-way-to-slow-them-down/

hat should only allow anonymous users (mail servers) to send you mail but will cut off spammers / your external users if you have any sending your server mail via SMTP / POP3.  If you don't have any users sending you mail this way then removing those authentication methods won't cause you any issues.
0
 

Author Comment

by:leesobo
ID: 35013491
I read your article and did as suggested. How does this impact internal users trying to send mail via outlook?
0
 
LVL 76

Accepted Solution

by:
Alan Hardisty earned 500 total points
ID: 35013631
Internal users won't be affected.  Only External users trying to send via SMTP direct to your server (if you have any such users) will be affected, plus of you have an authenticated relay, it will stop it dead in it's tracks.

If you have lots of queues on your server, you can download aqadmcli.exe to empty the queues very quickly:

ftp://ftp.microsoft.com/pss/Tools/Exchange%20Support%20Tools/Aqadmcli/aqadmcli.exe

For usage instructions - please visit this link:

http://community.spiceworks.com/how_to/show/267
0

Featured Post

Free learning courses: Active Directory Deep Dive

Get a firm grasp on your IT environment when you learn Active Directory best practices with Veeam! Watch all, or choose any amount, of this three-part webinar series to improve your skills. From the basics to virtualization and backup, we got you covered.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Is your Office 365 signature not working the way you want it to? Are signature updates taking up too much of your time? Let's run through the most common problems that an IT administrator can encounter when dealing with Office 365 email signatures.
Are you unable to connect or configure Hotmail email account in Microsoft Outlook 2010, 2007? Or Outlook.com emails are not downloading to Outlook? Lets’ see the problem and resolve Outlook Connector error syncing folder hierarchy (0x8004102A).
In this video we show how to create a Resource Mailbox in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: Navigate to the Recipients >> Resources tab.: "Recipients" is our default selection …
In this video we show how to create an Address List in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Organization >> Ad…

791 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question