Link to home
Start Free TrialLog in
Avatar of RAMTEK
RAMTEKFlag for United States of America

asked on

Exchange 2003 - Limit email to within Domain only - no internet email

We have a single Exchange 2003 box, configured to pop from our email host, and to SMTP out. I have a handful of users that I need to restrict from sending email to the net, but these employees need to receive emails internally (within domain).

I have read the article http://www.msexchange.org/tutorials/MF009.html. It discusses creating an SMTP Connector. My Exchange setup does not have "Connector" at that root level as shown in the example, so I cannot follow that instruction set. I do have SMTP Virtual, but the article specifically states *not* to use that.

I then found the article http://www.msexchange.org/tutorials/MF025.html. This article speaks on restricting what email the user can GET. Not what I need...

Then the article http://support.microsoft.com/default.aspx?scid=kb;en-us;Q277872 however I am not comfortable in modifying the reg just yet - nit until I am certain of a complete solution.

I cannot restrict at the firewall level. We also do not proxy.

I opened dsa.msc, went to the user, Exchange General>Delivery Restrictions>Maximum KB set it to "0", yet mail still went out.

In a single Exchange environment, with no bridgehead server, how can one stop emails from going to the net in this situation?
Exchg2003SysMgr.jpg
Avatar of Paul-B
Paul-B
Flag of United States of America image

You can follow that Tutorial you mention there first, the MF009.html link but see this picture here where to find it in Exchange 2003.

User generated image
Avatar of RAMTEK

ASKER

Unfortunately that didnt work..

In reference to Article: http://www.msexchange.org/tutorials/MF009.html

1) Created group in AD - called it "No Internet Email"
     -) verified it was mail enabled
     -) checked "Hide group from Exchange address lists" to keep it off the GAL
2)  Added a user to the group
3) Added the D-WORD reg key
     -) stopped MS Exchange services
     -) rebooted server (yes I know it said to simply restart smtp services, but I rebooted the server anyway because of reg changes, and thats how I was trained eons ago...)
4) Created the SMTP connector and followed the instructions exactly (will attach screen shots if wanted)
5) Logged in to a workstation as user. Opened Outlook. Sent email to my gmail account. Email was received in GMail without error.

The process did not work for me. We are a non-pofit and our IT Budget is non-existant, so thoughts of acquiring a 3rd party software is not feasible.

What else to try?
what happens if you go the the default Virtual SMTP Server (not connector) and then bring up the properties, go to "Access" tab, then near the bottom click the Relay.. button in the relay restrictions, Check the upper radio tick for grant access to only those in the lost box. In the list box delete everything (RIGHT IT ALL DOWN FIRST OF COURSE) and uncheck the box at the bottom for "Allow relaying for those that authorize regardless blah blah blah" and then click OK. After all its not relaying if it's for someone there on the domain.  Just make sure you write down your settings prior :)
Avatar of RAMTEK

ASKER

Modifying the Relay Restrictions under the Access tab in the Default SMTP Virtual Server  Properties also did not work. I left everything I had done prior intact, and followed your direction. In the Relay Restrictions, there was only one entry which was the ipa of the DNS server. I removed that entry and unchecked the "Allow all computers..." checkbox. I did *not* stop and restart any services. I logged on as the user we are trying to block, opened Outlook and sent a message to my gmail account. The message was successfully received. I also went back through all of the individual steps above and verified all actions were according to the article, and that I did not overlook or typo anything. I still am unable to block this user from sending email out into the world. NOTE> After the modification of the Relay Restrictions did not work, I put *back* the ipa of the DNS server, and rechecked the "Allow all computers..." checkbox so everything on the virtual server is as it was.

What do we try next? (Yes - I'd LOVE to be able to upgrade to Exchange 2010 but as I said before, that isn't an option at this time)
ASKER CERTIFIED SOLUTION
Avatar of RAMTEK
RAMTEK
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of RAMTEK

ASKER

no technical solution was found, so modification of the employees duties away from a computer was necessary. Since no solution was identified, and since all research had been done prior and no successful steps were identified, and due to a questionable suggestion to modify the virtual smtp server, no points are being awarded.