Exchange 2003 sporadic non delivery mail problem

Hi,

Couple of questions to ask:

1. Is your server fully up to date, SP2 and all Exchange 2003 updates? If not run Microsoft Update.
2. Have you run Exchange Best Practise Analyser? Download from:http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=22485
3. Check server side antispam filtering, if configured. See this link: http://www.petri.co.il/block_spam_with_exchange2003_imf.htm

Let me know the replies and we'll get this sorted.

HI, - thanks for your fast response - I would love to get to the bottom of this one rather than a workaround -its been bugging me for far too long - OK -

Exchange Server is SP2 (7638.2)
Automatic updates are applied regularly and in terms of the OS etc, its up to date - but for Exchange itself - BPA says No new updates

BPA has noted a couple of things -it was not able to connect to the recipient services DC (was pointing for some reason to an old non existent DC -have pointed it back to one that exists)
The 3GB switch was not in the boot ini - it is now.
Permissions inheritance block error-  followed the kb264733 article but when I got to the location - the box that says Allow Permissions to propagate etc etc - was already ticked - so not sure what its on about there.

Currently using Symantec Brightmail AntiSpam and when I get the issue mentioned above, the senders email is never quarantined. Exchange Tracking centre would show only a few steps in the processing if had been quarantined but it says Delivered Locally to Store.

thanks

I'm not recommending a workaround or quickfix, I'm suggesting to get your system up to date and in a supported configuration.

Just for your information, Microsoft Updates is different to Windows Updates. Visit this link and opt in: http://update.microsoft.com/microsoftupdate/

Further reading: http://en.wikipedia.org/wiki/Windows_Update#Microsoft_Update

I personally would not opt for the 3GB switch, as this may affect server performance if this server holds any other roles and assuming you already have 4GB RAM in your server.

What Exchange is reporting is completely different to what a 3rd party application is doing. Exchange would not always report what a 3rd party application is doing to the email once is has been received in its eyes. This is why I asked about anti-spam settings. If you want to be sure you should ensure that the senders email is in the whitelist, and even then doublecheck that it is not subject to any further checks (as I've seen in some other 3rd party appliances).

I personally would liaise with Symantec to get some answers on this. Don't be misled by what a 3rd party application may be doing to your emails.

OK  - Taking your advice, I have removed the 3GB switch and using microsoft update, I can see some exchange server updates available. I will apply those out of hours and will liaise with Symantec re the product. Thanks for your advice.

Your welcome ;)

In most cases its always a third party application doing something it shouldn't rather than a pure MS infrastructure. Going forward I would strongly recommend Exchange 2010 as it does an exceptional job for anti-spam out of the box.

Hi Netflo,

I am currently putting together a case for moving to exchange 2010 early in the new year -2003 has done its time..... apart from the antispam feature which sounds great,  are there any features of 2010 that you like -how have they improved it - I know I could (and will ) read some articles on it but from a hands on perspective -your thoughts would be welcome - we have some iphone/android people here too..

See the following link for a similar question I answered:

http://www.experts-exchange.com/Software/Server_Software/Email_Servers/Exchange/Q_27277705.html

Iphone and Android is okay too, if anything you have the ability to nuke the handset remotely built into Exchange by default.

In my opinion it truly is the best Exchange I have managed and implemented - double thumbs up to Microsoft :)

Great Stuff  -I reckon there is a good chance I  will get funding for Exchange 2010, so my next concern will be moving everyone to it. What is the recommended moving strategy from 2003 to 2010 -can you point me in the right direction for that one please.

ps applied all necessary updates and all looks ok at the moment - will continue to monitor the situation re the recurring intermittent non delivery issue. Thanks.

Hi,

Take a look at the PDF on this site: http://msexchangegeek.com/2010/01/30/rapid-transition-guide-from-exchange-2003-to-exchange-2010/

There is a step by step illustrated guide of the migration plan. I personally wouldn't worry about the 'legacy' certificate scenario, I would first just verify with test mailbox on your current platform to (1) move that mailbox across successfully? (2) send an email from the new platform to your own mailbox on the existing? (3) reply to that email and does it arrive back in the test users mailbox. On that basis plan to move all mailboxes across on a gigabit link on the weekend and tell all users that OWA and ActiveSync will be down.

Both boxes will work harmoniously together in terms of inter-routing messages. The bit that will take the longest is public folder replication and FYI if the ExchangeV1 folder doesn't migrate across, it is safe to delete (its server specific).

Other than that it should be easy as long as you follow the guide carefully without missing steps. I've answered many questions on EE purely because steps have been missed and things don't appear to be working.

Worst comes to worst, fire me an email via my profile. Best of luck mate!

Thanks for the advice - just an aside -the original issue occurred yesterday again but this was before I had applied the updates -the interesting thing was that I had added an external forwarding address to the users email AD settings -just to see what happened if she missed another email from the same sender.I wondered if maybe it might not send to the internal account but still send to the external forwarding address - - but no - -server says delivered locally and transferred out - -but no email in OWA, Outlook client or the external forwarding address. So, I guess I just need to wait to see if the updates have had any effect and if it still occurs - look at the anti spam side of things......its weird though, how its the same sender and recipient that its happening to....no one else in the company appears to have the same problem.....if the sender copies in a few people, they will all get the email but this user in particular will sometimes not.... bizarre server behaviour..  thanks again

Can you check if the user has a server side rule in place via Outlook? Or any rules for that matter?

The user manually moves email to their respective folders and the only rule thats there is the "Clear Categories on mail (recommended)".

Let's wait and see if the updates have helped, else look more at the 3rd party software.

FYI - Pretty much just got the thumbs up for new hardware and Exchange 2010!! New Toys!!

Great news, feel free to get in touch if you need some assistance or planning!

will do - currently looking at the link you sent. Got something else to ask if thats ok - back in 2008 I did what was known as a 'Swing Migration' or at least that it was called in the online literature from Amset. This is where I bought a new server(win2k3) and put exchange 2003 on it and migrated all the mailboxes/public folders across from the old server which was also win2k3 and exchange 2003. We looked at 2007 but at the time didnt feel that the extra bells and whistles were required here. It was my first ever live Exchange server install/migration. It went ok for a first one but ever since, the old server is still listed as an exchange server in the Exchange organisation and I still see it in ESM. I tried to get rid of it but it was just throwing errors and so I left it after much frustration. The old server was named GTMAIL and the new one went in as GTMAIL2 - I would still like to remove GTMAIL as it physically broke and is no longer on the network. Should I just wait until the new server arrives and look at it then or would you advise that I clean it up now - -- and what procedure to do this? thanks

Hi mate,

Have you tried to right click the GTMAIL and scroll across to All Tasks then Remove Server?

Alternatively you can also check that your AD is not aware of it too. I do advise you take your time for this step carefully checking the paths as described in the following MS article: http://support.microsoft.com/kb/833396

I have safely removed an Exchange server this way, so it does work nicely.

Let me know how you get on.

HI - I will look at having a go to remove the old server from ESM again maybe at the weekend.

One other question -I watched a youtube video on exchange 2010 and the guy on it seemed to be saying that if you had up to 100 users you needed 2 servers? We are a sme with 50 users. is this really the case? Thanks

No, absolutely not. I've spec'd up a powerful server to handle 500 users on one server. You need a good spec of metal and don't cut corners either. Exchange 2010 does have lower IO demands to previous editions which should help.

You should be looking at a mid range server with 1 CPU, 16 or 24 GB RAM, proper SAS drives (not near line SAS which are really SATA drives), hardware RAID card and dual PSUs and good enterprise warranty should the inevitable happen.

HI -I was going to post this as a separate question but its the weirdest thing and is happening to one of our directors.

If he uses OWA, which he does often while away - email is being removed - nowhere to be seen. e.g I was looking at some of his email from today and refreshed the page and the most recent one disappeared. It was slowly working its way backwards, deleting through the email of this week. I got one of our other guys to log on as a him on a different machine -and he could only see email up to wed of this week - thursdays and fridays were gone -  the more you refreshed -the more email disappeared. I logged on to another machine again as him and saw similar - but chunks of email were missing in OWA. Logged on as myself F5 a number of times - all ok - my email was fine.  And weirder still - If I opened the full Outlook client as him - all of the email is there - bang up to date -nothing missing - as was his iphone. So I went on to another machine and set outlook up as him, from scratch - he had never logged on to this machine before - outlook updated from the server and his email was all there.

So its happening, as him,  in OWA, on three separate pc's with IE. OK on the outlook client and iphone.

Never seen this before - - any ideas?

I would check his rules first of all, esp server side rules if any. I would also check the views he has configured on OWA against your login.

I've seen this issue with OWA and iPhone sync and the issue was to do with antivirus scanning Exchange core directories.

You need to exclude the following directories explained in the following link: http://support.microsoft.com/kb/823166

You may also need to reboot your Exchange box for the AV excludes to be active.

HI  -apologies for the delay. The original issue  - email showing as being delivered on message tracker -and not being seen anywhere - happened again. So, the updates have not had the desired effect.

AV - the exchange component - is not active in terms of scanning any exchange items - I have deliberately turned it off some time ago as it was having an adverse effect on email delivery to mobile handsets.

Anti Spam - the domain from which the email is received is specifically allowed. Turning the anti spam filter off is unfortunately not an option.  

PS -the other issue where the guys email was disappearing - was 2 OWA views/filters the user had set by accident. 1 was to show only unread mail - but he had a pane to the right that auto displayed any email - which turned it into a 'read' email and would immediately hide it!!

So basically the task you mentioned in the question didn't work before but did work after a few months, very odd?

...tried a number of things including exmerging her mail data, deleting the mailbox, creating new mailbox and importing the data again.

Nothing I did that was kindly suggested by the experts had the required effect in this case. My decision to recreate the user was an idea I had but didnt want to do as she had literature with the existing email address on. So it was the last thing I wanted to do, but had no choice in the end - and it worked.