Help with Exchange tools and configuration

I need to assist a school in hardening their Exchange 2010 server. From what I have learned, users are getting bogus email about their mailbox and are clicking on the link provided in the message. This is somehow providing a pipe for spammers to use them as a relay through the schools internal mail server. They are being put on many blacklist because of this.

I need to help them harden up the configuration to prevent this and hopefully identify the local machine that is being used as the middle man.

I am not an expert with Exchange and could use some guidance in my effort to help them.
Who is Participating?
TheBDPConnect With a Mentor Sr. Sys EngineerCommented:
First things first.

Put the domain name into something like and check for results

I'm guessing open relay to start with, but there are too many factors here to just guess at.

Do you have any error messages? Is anything in the exchange Logs? When you run best practice analyzer what are the results?

We're going to need as much information as you can provide.

Lastly Exchange is a pretty big deal. I would highly suggest engaging a 3rd party consultant.

Knowing when you're in over your head is half the battle.

*Disclaimer - I'd make sure you have a full backup of whatever you're working on and have a documented configuration of your current server before making any changes. You have no idea what they have done to get it working. So they very well might not be following any standards and nothing is like a normal install.
You need spam filter device, application or hosted service these are some of the products which offer both in house or hosted solution.

You can check with the school they might already have forefront online protection available with their license

You need to disable any open relay on the server to prevent outbound spams
tamray_techAuthor Commented:
I will need to get more concrete information, but an initial test shows the domain is not on any of the 90 blacklist and is not accessible as an open relay when tested at

The problem, as described to me, is that the internal users pc is somehow the conduit to relay through the Exchange server. I will know more tomorrow. We have firewall rules in place that only allow access to port 25 on their public IP from my mailscanner servers, and that was confirmed with the test.
Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

Mohammed KhawajaManager - Infrastructure:  Information TechnologyCommented:
My recommendation would be to outsource the anti-spam and anti-virus to a vendor such as where your MX would be pointing to their servers, they will cleanse the messages and then forward it to your Exchange.  Your Exchange will be configured to relay all messages through their servers.  And the beauty of it is that would cost $2 to $3 per month and no admin work.
Simon Butler (Sembee)ConsultantCommented:
You need to be sure the email is coming from an internal source first. I would doubt if it is. To be an internal source it would have to be highly targetted. It is much easier for a spammer to just write a script that sends to the domain and mentions through the email message (Depending on the to email address).
If tha tis the case, then a decent antispam tool should catch it. SPF records setup correctly and antispam tools inside would also catch a lot of it. No need to outsource the filtering at all.

tamray_techAuthor Commented:
School hired an exchange expert to deal with the issue.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.