Receiving spam email from spoofed internal sender on Exchange 2010 SP3 with Symantec Mail Gateway

People,

I'm confused and need your help here with the issue of receiving internally spoofed spam address but the IP address is kept on changing from country to country.

The Email is filtered first by Symantec Email Gateway appliance and then forwarded to the Exchange Server. But I'm not sure if this is Exchange Server issue or Symantec problem ?

When I read this blog, it suggest the below powershell script:

Get-ReceiveConnector “My Internet ReceiveConnector” | Get-ADPermission -user “NT AUTHORITY\Anonymous Logon” | where {$_.ExtendedRights -like “ms-exch-smtp-accept-authoritative-domain-sender”} | Remove-ADPermission

Select all Open in new window

but there are multiple Receive connector here in my Exchange Server 2010 SP3:

[PS] C:\>Get-ReceiveConnector | Get-ADPermission -user “NT AUTHORITY\Anonymous Logon” | where {$_.ExtendedRights -like “ms-exch-smtp-accept-authoritative-domain-sender”} | ft -AutoSize

Identity                      User                           Deny  Inherited
---------------------------   ----------------------------   ----- ---------
MAIL01-VM\Default MAIL01-VM   NT AUTHORITY\ANONYMOUS LOGON 	 False False
MAIL02-VM\Default MAIL02-VM   NT AUTHORITY\ANONYMOUS LOGON 	 False False
MAIL01-VM\Inbound SMTP Relay  NT AUTHORITY\ANONYMOUS LOGON 	 False False
MAIL02-VM\Inbound SMTP Relay  NT AUTHORITY\ANONYMOUS LOGON 	 False False
MAIL01-VM\External Relay      NT AUTHORITY\ANONYMOUS LOGON 	 False False
MAIL02-VM\External Relay      NT AUTHORITY\ANONYMOUS LOGON 	 False False
MAIL01-VM\UCCX MAIL01-VM      NT AUTHORITY\ANONYMOUS LOGON 	 False False
MAIL02-VM\UCCX MAIL02-VM      NT AUTHORITY\ANONYMOUS LOGON 	 False False


[PS] C:\>Get-ReceiveConnector | ft -AutoSize

Identity                      Bindings              Enabled
---------------------------   --------------------- -------
MAIL01-VM\Default MAIL01-VM   {:::25, 0.0.0.0:25}   True
MAIL01-VM\Client MAIL01-VM    {:::587, 0.0.0.0:587} True
MAIL02-VM\Default MAIL02-VM   {:::25, 0.0.0.0:25}   True
MAIL02-VM\Client MAIL02-VM    {:::587, 0.0.0.0:587} True
MAIL01-VM\Inbound SMTP Relay  {10.1.2.89:25}        True
MAIL02-VM\Inbound SMTP Relay  {10.1.2.89:25}        True
MAIL01-VM\External Relay      {10.1.2.90:25}        True
MAIL02-VM\External Relay      {10.1.2.91:25}        True
MAIL01-VM\UCCX MAIL01-VM      {0.0.0.0:25}          True
MAIL02-VM\UCCX MAIL02-VM      {0.0.0.0:25}          True

Select all Open in new window

So I'm confused which Receive connector should I be running the powershell script against ?

What's the roll back plan if email flow is affected when executing the wrong powershell against incorrect Receive connector ?

Thanks,