Need Help - Monitor Incoming Exchange Mail

I have an issue with an incoming mailbox running off of an SBS 2003 R2
server. This mailbox is continually getting the same email message (from
the same sender) in the Inbox every 2 minutes as reported to me from them
using their Outlook client. I am thinking it is the sender that is repeat
sending the email and the SBS 2003 is just processing the mail, but I want
to make sure nothing is going wrong with the SBS that IT (Exchange) is
generating the same email. I want to monitor the incoming mail to see what
is happening. I'm also not sure how to stop this short of excluding this
sender email address which won't work in this case because this is a valid
sender and I can't shut it down completely.

Thoughts?

Are you using the POP3 Connector?

Russ

--
Russell Grover - SBITS.Biz
Microsoft Gold Certified Partner
Microsoft Small Business Specialist
World Wide 24hr Remote SBS2003 Support - http://www.SBITS.Biz


"Richard K" <rkokoski@foxdtechllc.com> wrote in message
news:uNO%23fwZGJHA.5244@TK2MSFTNGP04.phx.gbl...
>I have an issue with an incoming mailbox running off of an SBS 2003 R2
>server. This mailbox is continually getting the same email message (from
>the same sender) in the Inbox every 2 minutes as reported to me from them
>using their Outlook client. I am thinking it is the sender that is repeat
>sending the email and the SBS 2003 is just processing the mail, but I want
>to make sure nothing is going wrong with the SBS that IT (Exchange) is
>generating the same email. I want to monitor the incoming mail to see what
>is happening. I'm also not sure how to stop this short of excluding this
>sender email address which won't work in this case because this is a valid
>sender and I can't shut it down completely.
>
> Thoughts?
>
>
>

Yes as Russ indicates I hope you're using SMTP for incoming mail and not the
POP3 connector. Message tracking might help show if its actually being sent
repeatedly by the sender.

"Russ (www.SBITS.Biz)" <support@REMOVETHIS.sbits.biz> wrote in message
news:u9AvP8ZGJHA.224@TK2MSFTNGP06.phx.gbl...
> Are you using the POP3 Connector?
>
> Russ
>
> --
> Russell Grover - SBITS.Biz
> Microsoft Gold Certified Partner
> Microsoft Small Business Specialist
> World Wide 24hr Remote SBS2003 Support - http://www.SBITS.Biz
>
>
> "Richard K" <rkokoski@foxdtechllc.com> wrote in message
> news:uNO%23fwZGJHA.5244@TK2MSFTNGP04.phx.gbl...
>>I have an issue with an incoming mailbox running off of an SBS 2003 R2
>>server. This mailbox is continually getting the same email message (from
>>the same sender) in the Inbox every 2 minutes as reported to me from them
>>using their Outlook client. I am thinking it is the sender that is repeat
>>sending the email and the SBS 2003 is just processing the mail, but I want
>>to make sure nothing is going wrong with the SBS that IT (Exchange) is
>>generating the same email. I want to monitor the incoming mail to see
>>what is happening. I'm also not sure how to stop this short of excluding
>>this sender email address which won't work in this case because this is a
>>valid sender and I can't shut it down completely.
>>
>> Thoughts?
>>
>>
>>
>
>

No
"Russ (www.SBITS.Biz)" <support@REMOVETHIS.sbits.biz> wrote in message
news:u9AvP8ZGJHA.224@TK2MSFTNGP06.phx.gbl...
> Are you using the POP3 Connector?
>
> Russ
>
> --
> Russell Grover - SBITS.Biz
> Microsoft Gold Certified Partner
> Microsoft Small Business Specialist
> World Wide 24hr Remote SBS2003 Support - http://www.SBITS.Biz
>
>
> "Richard K" <rkokoski@foxdtechllc.com> wrote in message
> news:uNO%23fwZGJHA.5244@TK2MSFTNGP04.phx.gbl...
>>I have an issue with an incoming mailbox running off of an SBS 2003 R2
>>server. This mailbox is continually getting the same email message (from
>>the same sender) in the Inbox every 2 minutes as reported to me from them
>>using their Outlook client. I am thinking it is the sender that is repeat
>>sending the email and the SBS 2003 is just processing the mail, but I want
>>to make sure nothing is going wrong with the SBS that IT (Exchange) is
>>generating the same email. I want to monitor the incoming mail to see
>>what is happening. I'm also not sure how to stop this short of excluding
>>this sender email address which won't work in this case because this is a
>>valid sender and I can't shut it down completely.
>>
>> Thoughts?
>>
>>
>>
>
>

Open Exchange System Manager and go to Message Tracking Center (it's under
Tools). Put in the SBS servername and the sender's address. It should find
all the messages from that sender in the tracking log, and you can
double-click them to see some information that should tell you better what's
going on.


"Richard K" <rkokoski@foxdtechllc.com> wrote in message
news:uNO%23fwZGJHA.5244@TK2MSFTNGP04.phx.gbl...
>I have an issue with an incoming mailbox running off of an SBS 2003 R2
>server. This mailbox is continually getting the same email message (from
>the same sender) in the Inbox every 2 minutes as reported to me from them
>using their Outlook client. I am thinking it is the sender that is repeat
>sending the email and the SBS 2003 is just processing the mail, but I want
>to make sure nothing is going wrong with the SBS that IT (Exchange) is
>generating the same email. I want to monitor the incoming mail to see what
>is happening. I'm also not sure how to stop this short of excluding this
>sender email address which won't work in this case because this is a valid
>sender and I can't shut it down completely.
>
> Thoughts?
>
>
>

OK, I see all of the incoming messages from this outside person. Now short
of telling this "sender" that something is wrong with their email and they
are sending errant emails (or a spammer using that email address to send)
how do I stop them from being processed at the SBS Server? Would I have to
stop ALL emails coming from that email address?

"Dave Nickason [SBS MVP]" <gwdibble@NOSPAM.frontiernet.net> wrote in message
news:unRqFPaGJHA.4864@TK2MSFTNGP02.phx.gbl...
> Open Exchange System Manager and go to Message Tracking Center (it's under
> Tools). Put in the SBS servername and the sender's address. It should
> find all the messages from that sender in the tracking log, and you can
> double-click them to see some information that should tell you better
> what's going on.
>
>
> "Richard K" <rkokoski@foxdtechllc.com> wrote in message
> news:uNO%23fwZGJHA.5244@TK2MSFTNGP04.phx.gbl...
>>I have an issue with an incoming mailbox running off of an SBS 2003 R2
>>server. This mailbox is continually getting the same email message (from
>>the same sender) in the Inbox every 2 minutes as reported to me from them
>>using their Outlook client. I am thinking it is the sender that is repeat
>>sending the email and the SBS 2003 is just processing the mail, but I want
>>to make sure nothing is going wrong with the SBS that IT (Exchange) is
>>generating the same email. I want to monitor the incoming mail to see
>>what is happening. I'm also not sure how to stop this short of excluding
>>this sender email address which won't work in this case because this is a
>>valid sender and I can't shut it down completely.
>>
>> Thoughts?
>>
>>
>>
>

Unfortunately, I'm not aware of any way to stop the duplicates without
stopping all mail from that sender or his/her domain. What if you just ask
the recipient to mention to the sender that they're getting these every
couple of minutes, and see if they can fix it on their end. That would
really be the best result, as they may be doing the same things to a lot of
other recipients as well.



"Richard K" <rkokoski@foxdtechllc.com> wrote in message
news:%23a6ilUaGJHA.4064@TK2MSFTNGP06.phx.gbl...
> OK, I see all of the incoming messages from this outside person. Now
> short of telling this "sender" that something is wrong with their email
> and they are sending errant emails (or a spammer using that email address
> to send) how do I stop them from being processed at the SBS Server? Would
> I have to stop ALL emails coming from that email address?
>
> "Dave Nickason [SBS MVP]" <gwdibble@NOSPAM.frontiernet.net> wrote in
> message news:unRqFPaGJHA.4864@TK2MSFTNGP02.phx.gbl...
>> Open Exchange System Manager and go to Message Tracking Center (it's
>> under Tools). Put in the SBS servername and the sender's address. It
>> should find all the messages from that sender in the tracking log, and
>> you can double-click them to see some information that should tell you
>> better what's going on.
>>
>>
>> "Richard K" <rkokoski@foxdtechllc.com> wrote in message
>> news:uNO%23fwZGJHA.5244@TK2MSFTNGP04.phx.gbl...
>>>I have an issue with an incoming mailbox running off of an SBS 2003 R2
>>>server. This mailbox is continually getting the same email message (from
>>>the same sender) in the Inbox every 2 minutes as reported to me from them
>>>using their Outlook client. I am thinking it is the sender that is
>>>repeat sending the email and the SBS 2003 is just processing the mail,
>>>but I want to make sure nothing is going wrong with the SBS that IT
>>>(Exchange) is generating the same email. I want to monitor the incoming
>>>mail to see what is happening. I'm also not sure how to stop this short
>>>of excluding this sender email address which won't work in this case
>>>because this is a valid sender and I can't shut it down completely.
>>>
>>> Thoughts?
>>>
>>>
>>>
>>
>
>

Hi Richard,

Thanks for your post and others great input.

Please allow me to confirm that my understandings are correct. As I
understand it, the issue is:

One of your domain user keeps receiving the same email sent from the same
external sender although it is a valid sender. You would like to stop it
and make sure the Exchange server on your SBS server is configured
correctly and running normally.

If I have misunderstood your concerns please feel free to let me know.

Based on the symptoms and experience, since it is a valid sender, I suspect
the issue is caused by the sender side or 3rd party anti-spam software on
the SBS server. You may consider the following suggestions:

1. If the sender is valid and the email content is not spam email like
advertisement etc. if possible, please contact the sender to check why they
keeps sending the same emails to your user so that we can easily narrow
down whether it is the sender domain's issue or our Exchange server problem.


2. I also agree to enable and check more information from the Message
Tracking Center with your Exchange server to monitor inbound and outbound
emails

I suggest you enable the Message Tracking feature in Message Tracking
center to track the inbound emails. Please refer to the following articles
for details steps:

Exchange 2003 Message Tracking and Logging
http://www.msexchange.org/tutorials/...king-Logging.h
tml


3. If the users can send and receive emails to and from the outside domain,
generally, the Exchange server should be working fine. To check if the
SBS/Exchange server is running healthy, I suggest you install and run SBS
BPA tool and Exchange BPA tool.

Use Small Business Server 2003 Best Practices Analyzer tool to scan and
detect the potential errors on SBS server.

Description of the Windows Small Business Server 2003 Best Practices
Analyzer(BPA) tool
<http://support.microsoft.com/kb/940439>

Microsoft Windows Small Business Server 2003 Best Practices Analyzer(BPA)
<http://www.microsoft.com/downloads/d...527a-de19-49bb
-800f-352f3b6f2922&DisplayLang=en>

At the same time, I recommend you run the Exchange Best Practices Analyzer
v2.8 to detect and analyze you Exchange organization. Access the
functionality for Exchange Performance Troubleshooting, Database Recovery
Management, and Mail Flow Troubleshooter through single tools.

Microsoft Exchange Analyzers
<http://technet.microsoft.com/en-us/exchange/bb288481.aspx>


4. Meanwhile, I suggest you enable and adjust the "Intelligent Message
Filter" feature to efficiently control spam with your Exchange 2003 server.

Understanding Exchange Server Intelligent Message Filter
http://technet.microsoft.com/en-us/l...EXCHG.65).aspx


More Information Related:
===============
Exchange Server 2003 SP2- New Weapons In The Fight Against Spam
http://technet.microsoft.com/en-us/m.../cc161028.aspx

Configuring Sender Filtering
http://technet.microsoft.com/en-us/l...EXCHG.65).aspx

Note: By using Sender Filtering, you can block messages sent by specific
senders. This is useful if you receive unsolicited commercial e-mail from
particular domains or sender addresses. You can block these messages by
enabling sender filtering.


If the issue persists after performing the above steps, I would like to
ask some questions to clarify the current situation:

1. Does this issue only occur to a particular user in your domain?
2. If possible, please paste out or send a copy of the email that your user
keeps receiving.


Hope this helps. Also, if you have any questions or concerns, please do not
hesitate to let me know.

Thanks for your earlier feedback!



Best regards,

Robbin Meng(MSFT)

Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security

=====================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities...s/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.
=====================================================

This posting is provided "AS IS" with no warranties, and confers no rights.

Another thing is that most email servers will try to deliver an email
for 2 days. That problem email should have died off by now.

On Fri, 19 Sep 2008 09:37:31 GMT, v-robmen@online.microsoft.com
("Robbin Meng [MSFT]") wrote:

>Hi Richard,
>
>Thanks for your post and others great input.
>
>Please allow me to confirm that my understandings are correct. As I
>understand it, the issue is:
>
>One of your domain user keeps receiving the same email sent from the same
>external sender although it is a valid sender. You would like to stop it
>and make sure the Exchange server on your SBS server is configured
>correctly and running normally.
>
>If I have misunderstood your concerns please feel free to let me know.
>
>Based on the symptoms and experience, since it is a valid sender, I suspect
>the issue is caused by the sender side or 3rd party anti-spam software on
>the SBS server. You may consider the following suggestions:
>
>1. If the sender is valid and the email content is not spam email like
>advertisement etc. if possible, please contact the sender to check why they
>keeps sending the same emails to your user so that we can easily narrow
>down whether it is the sender domain's issue or our Exchange server problem.
>
>
>2. I also agree to enable and check more information from the Message
>Tracking Center with your Exchange server to monitor inbound and outbound
>emails
>
>I suggest you enable the Message Tracking feature in Message Tracking
>center to track the inbound emails. Please refer to the following articles
>for details steps:
>
>Exchange 2003 Message Tracking and Logging
>http://www.msexchange.org/tutorials/...king-Logging.h
>tml
>
>
>3. If the users can send and receive emails to and from the outside domain,
>generally, the Exchange server should be working fine. To check if the
>SBS/Exchange server is running healthy, I suggest you install and run SBS
>BPA tool and Exchange BPA tool.
>
>Use Small Business Server 2003 Best Practices Analyzer tool to scan and
>detect the potential errors on SBS server.
>
>Description of the Windows Small Business Server 2003 Best Practices
>Analyzer(BPA) tool
><http://support.microsoft.com/kb/940439>
>
>Microsoft Windows Small Business Server 2003 Best Practices Analyzer(BPA)
><http://www.microsoft.com/downloads/d...527a-de19-49bb
>-800f-352f3b6f2922&DisplayLang=en>
>
>At the same time, I recommend you run the Exchange Best Practices Analyzer
>v2.8 to detect and analyze you Exchange organization. Access the
>functionality for Exchange Performance Troubleshooting, Database Recovery
>Management, and Mail Flow Troubleshooter through single tools.
>
>Microsoft Exchange Analyzers
><http://technet.microsoft.com/en-us/exchange/bb288481.aspx>
>
>
>4. Meanwhile, I suggest you enable and adjust the "Intelligent Message
>Filter" feature to efficiently control spam with your Exchange 2003 server.
>
>Understanding Exchange Server Intelligent Message Filter
>http://technet.microsoft.com/en-us/l...EXCHG.65).aspx
>
>
>More Information Related:
>===============
>Exchange Server 2003 SP2- New Weapons In The Fight Against Spam
>http://technet.microsoft.com/en-us/m.../cc161028.aspx
>
>Configuring Sender Filtering
>http://technet.microsoft.com/en-us/l...EXCHG.65).aspx
>
>Note: By using Sender Filtering, you can block messages sent by specific
>senders. This is useful if you receive unsolicited commercial e-mail from
>particular domains or sender addresses. You can block these messages by
>enabling sender filtering.
>
>
>If the issue persists after performing the above steps, I would like to
>ask some questions to clarify the current situation:
>
>1. Does this issue only occur to a particular user in your domain?
>2. If possible, please paste out or send a copy of the email that your user
>keeps receiving.
>
>
>Hope this helps. Also, if you have any questions or concerns, please do not
>hesitate to let me know.
>
>Thanks for your earlier feedback!
>
>
>
>Best regards,
>
>Robbin Meng(MSFT)
>
>Microsoft CSS Online Newsgroup Support
>
>Get Secure! - www.microsoft.com/security
>
>=====================================================
>This newsgroup only focuses on SBS technical issues. If you have issues
>regarding other Microsoft products, you'd better post in the corresponding
>newsgroups so that they can be resolved in an efficient and timely manner.
>You can locate the newsgroup here:
>http://www.microsoft.com/communities...s/default.aspx
>
>When opening a new thread via the web interface, we recommend you check the
>"Notify me of replies" box to receive e-mail notifications when there are
>any updates in your thread. When responding to posts via your newsreader,
>please "Reply to Group" so that others may learn and benefit from your
>issue.
>
>Microsoft engineers can only focus on one issue per thread. Although we
>provide other information for your reference, we recommend you post
>different incidents in different threads to keep the thread clean. In doing
>so, it will ensure your issues are resolved in a timely manner.
>
>For urgent issues, you may want to contact Microsoft CSS directly. Please
>check http://support.microsoft.com for regional support phone numbers.
>
>Any input or comments in this thread are highly appreciated.
>=====================================================
>
>This posting is provided "AS IS" with no warranties, and confers no rights.
See what SBS support is working on
http://blogs.technet.com/sbs/default.aspx
Check your SBS with the SBS Best Practices Analyzer
http://blogs.technet.com/sbs/archive...A/default.aspx

From: Richard Kokoski
Sent: 2008Äê9ÔÂ26ÈÕ 16:57
To: Robbin Meng
Subject: RE: Follow Up For Microsoft SBS Public Newsgroup Post [Need Help -
Monitor Incoming Exchange Mail] with Robbin Meng

Robbin,

Please close this issue. I followed your advice and were able to
successfully track down the errant email.

Thanks!

-Richard

Hi Richard,

Thanks for your feedback.

I am glad to know we have finally found the root cause.

Here are some Exchange 2003 server mail flow related articles for your
reference:

How to block open SMTP relaying and clean up Exchange Server SMTP queues in
Windows Small Business Server
http://support.microsoft.com/kb/324958/en-us

Exchange queues fill with many non-delivery reports from the postmaster
account in Small Business Server 2003
http://support.microsoft.com/kb/886208/en-us

How to troubleshoot for Exchange Server 2003 transport issues
http://support.microsoft.com/kb/821910/en-us

Again, thank you for posting in the SBS newsgroups. Please feel free to
contact us again in the future.

Have a nice day!


Best regards,
Robbin Meng(MSFT)
Microsoft CSS Online Newsgroup Support
Get Secure! - www.microsoft.com/security