Solved

Exchange 2010 0 5.7.1 - Can't Relay and Client does not have permissions to send as this sender

Posted on 2014-04-18
9
1,881 Views
Last Modified: 2014-04-21
Hello,
I am having some issues getting my Exchange server to allow me to relay.  I am running a single stand-alone exchange 2010 server.

The way this works - I have my voice mail server (Windows server 2012).  When a VM is left, an email is generated and sent to a defined address in my PBX.  As long as the user is in my email domain, no problem.  The problem arises when I attempt to send to an external domain (testing with gmail).

So, the VM server utilizes IIS 6.0 and the SMTP virtual server.  The basic setup for the PBX is to set a SmartHost in the outbound delivery.   Here I define my Exchange server.

For relay, I decided NOT to just open up the relay, but to authenticate.  Easy enough. I've created a whole new AD account and created a mailbox for it.  In IIS 6 on the VM server, I created new remote domain "gmail.com" and edited ti's properties.  I entered my Exchange server as the smart host.  I went ahead and setup integrated Windows authentication and put in the username and password of the newly created user.

Runing my tests result in a 5.7.1 user does not have permissions to send to this mailbox, and I can confirm that we are authenticating (by running wireshark on both the VM server and the exchange server).
0
Comment
Question by:JamesonJendreas
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 4
9 Comments
 
LVL 27

Expert Comment

by:☠MAS☠
ID: 40008839
Try ticking anonymous users in the defaut receive connector properties
0
 
LVL 1

Author Comment

by:JamesonJendreas
ID: 40008858
I'll give it a go, but I would perfer to authenticate.  Note, I am getting pass authentication

Here is the TCP stream via wireshark (note I have scrubbed out my domain and other sensitive information)


220 cas.DOMAIN.SCRUBBED Microsoft ESMTP MAIL Service ready at Fri, 18 Apr 2014 07:53:50 -0700
EHLO HQ.DOMAIN.SCRUBBED
250-cas.DOMAIN.SCRUBBED Hello [<VM Server IP>]
250-SIZE 10485760
250-PIPELINING
250-DSN
250-ENHANCEDSTATUSCODES
250-STARTTLS
250-AUTH NTLM LOGIN
250-8BITMIME
250-BINARYMIME
250 CHUNKING
AUTH NTLM [SCRUBBED]==
334 [AUTH SCRUBBED]==
235 2.7.0 Authentication successful
MAIL FROM:<USER.SCRUBBED@DOMAIN.SCRUBBED> SIZE=1138
250 2.1.0 Sender OK
RCPT TO:<MYTEST@gmail.com>
250 2.1.5 Recipient OK
BDAT 1138 LAST
Received: from mail pickup service by HQ.DOMAIN.SCRUBBED with Microsoft SMTPSVC;
. Fri, 18 Apr 2014 07:53:51 -0700
thread-index: Ac9bFgKvUbmIVIogSfi6ttO7Hn8TLg==
Thread-Topic: ShoreTel voice message from Jameson Jendreas, 6062 for mailbox 6094
From: "ShoreWare Voice Mail" <USER.SCRUBBED@DOMAIN.SCRUBBED>
To: <MYTEST@gmail.com>
Subject: ShoreTel voice message from Jameson Jendreas, 6062 for mailbox 6094
Date: Fri, 18 Apr 2014 07:53:50 -0700
Keywords: {"SHORETEL_INFO":"VMSync","DN":"6094","ID":"7WCES8C66","WAV":false,"GUID":"1367ea77-c79d-4e05-ad2c-128276c59f74"}
Message-ID: <B9B52EA3D2D04B229DC5F6A3342E9EDD@DOMAIN.SCRUBBED>
MIME-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
X-Mailer: Microsoft CDO for Windows 2000
Content-Class: urn:content-classes:message
Importance: normal
Priority: normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.2.9200.16384
X-OriginalArrivalTime: 18 Apr 2014 14:53:51.0155 (UTC) FILETIME=[02CED030:01CF5B16]
You have received a voice mail message from Jameson Jendreas, 6062 for mailbox 6094.
Message length is 00:00:02. Message size is 19 KB.
550 5.7.1 Client does not have permissions to send as this sender
QUIT
221 2.0.0 Service closing transmission channel
0
 
LVL 1

Author Comment

by:JamesonJendreas
ID: 40008871
Actually, Anonymous Users is already checked.
0
Get 15 Days FREE Full-Featured Trial

Benefit from a mission critical IT monitoring with Monitis Premium or get it FREE for your entry level monitoring needs.
-Over 200,000 users
-More than 300,000 websites monitored
-Used in 197 countries
-Recommended by 98% of users

 
LVL 27

Expert Comment

by:☠MAS☠
ID: 40008882
0
 
LVL 1

Author Comment

by:JamesonJendreas
ID: 40008896
So that was my next thought actually, essentially I need to add another NIC to my exchange server.  It's a virtual server, so while that isn't hard, it'll require going through extra change control so I can't do it right now.  Once approved, then that'l likely be the solution.
0
 
LVL 27

Expert Comment

by:☠MAS☠
ID: 40008933
But you dont need to wait for the second NIC.
You can configure the current IP and try without user work interruption. if its successful then do as you wish.

Furthermore you are allowing the IP of the other server not the exchange server.
So it doesn't make difference if you do it now or later as you are allowing a non-mail server to relay through your mail server
0
 
LVL 3

Accepted Solution

by:
bmurray-vb earned 250 total points
ID: 40009423
If you already have anon checked on that connector, make sure you run this EMS command to seal the deal.

Get-ReceiveConnector "Name Of The Connector" | Add-ADPermission -User "NT AUTHORITY\ANONYMOUS LOGON" -ExtendedRights "Ms-Exch-SMTP-Accept-Any-Recipient"
0
 
LVL 27

Assisted Solution

by:☠MAS☠
☠MAS☠ earned 250 total points
ID: 40010014
@bmurray-vb
The above command is there in the URL provided.

Anyway thanks for highlighting the command as that is part which does the main job.
0
 
LVL 1

Author Comment

by:JamesonJendreas
ID: 40012624
OK - I ended up going about this a little different (and still not too sure why this works this way and not using self sending).

I ended up creating a new account (NOT the account with the mailbox).  I gave that account send-as rights for the email box.  I then setup my SMTP virtual server on the voice mail server to authenticate using the newly created account that had send-as rights for the mailbox,

It makes little sense to me as why if I attempt to authenticate using the actual user account tied to the mailbox, especially since I checked to ensure it had self-send permissions.
0

Featured Post

Are your AD admin tools letting you down?

Managing Active Directory can get complicated.  Often, the native tools for managing AD are just not up to the task.  The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Uncontrolled local administrators groups within any organization pose a huge security risk. Because these groups are locally managed it becomes difficult to audit and maintain them.
Group policies can be applied selectively to specific devices with the help of groups. Utilising this, it is possible to phase-in group policies, over a period of time, by randomly adding non-members user or computers at a set interval, to a group f…
Exchange organizations may use the Journaling Agent of the Transport Service to archive messages going through Exchange. However, if the Transport Service is integrated with some email content management application (such as an antispam), the admini…
Are you ready to implement Active Directory best practices without reading 300+ pages? You're in luck. In this webinar hosted by Skyport Systems, you gain insight into Microsoft's latest comprehensive guide, with tips on the best and easiest way…
Suggested Courses

630 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question