If I look at the queues and do find messages/find now/ in search results it comes up as [EMAIL PROTECTED] as the sender. The site doesn't even have a postmaster account setup in ADUC from what the admin said. How would one tell for sure if they were just NDR's. Can I just set the NDR's off then see if the queues stop filling up ???
Thanks Ronk -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Chris Scharff Sent: Monday, April 18, 2005 11:15 AM To: Exchange Discussions Subject: RE: [BULK] RE: Postmaster Account Have you determined these are anything more than simply NDRs being attempted to deliver to the (possibly forged) sender? > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of > Knox, Ron G. > Posted At: Monday, April 18, 2005 10:29 AM Posted To: swynk > Conversation: Postmaster Account > Subject: [BULK] RE: Postmaster Account > > > I have tried the SMTP logging but I must be doing something > wrong because I can't capture this culprit. Can anyone give > me a few leads on what I should set or another app that I can > locate this with ?? > Thanks in Advance > > Ronk > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On > Behalf Of User, IS (PHES) > Sent: Wednesday, April 13, 2005 2:32 PM > To: Exchange Discussions > Subject: RE: Postmaster Account > > Sounds like it may be a client on your network that is > infected with a SPAM Trojan or some such and attempting to > use your Exchange as the SMTP server. > > Maybe you can kick up the SMTP logging and see which IP > address is "Sending" > the messages and verify that it isn't a PC, then clean it up > if it is. > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On > Behalf Of Knox, Ron G. > Sent: Wednesday, April 13, 2005 3:20 PM > To: Exchange Discussions > Subject: RE: Postmaster Account > > After getting the clear picture from the site admin the > postmaster account is the one sending the spam, HELP !!! > > I have looked and there are no postmaster accounts set up on > this server. > But the messages are coming from [EMAIL PROTECTED] > they are getting no farther than the queues but causing a > bunch of work clearing out the queues of these messages. > > Can anyone point me in the right direction ?? What to use to > find this phantom.... > > Thanks > Ronk > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On > Behalf Of Knox, Ron G. > Sent: Tuesday, April 12, 2005 9:00 AM > To: Exchange Discussions > Subject: RE: Postmaster Account > > Thanks Charlie that was what I was thinking but wasn't sure > how to address the user account. > Thanks Again > Ronk > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On > Behalf Of Charlie Kaiser > Sent: Tuesday, April 12, 2005 8:03 AM > To: Exchange Discussions > Subject: RE: Postmaster Account > > In ADUC, create a new DL with an appropriate name. Don't add > any members. > Add the email addresses you want the list to accept mail for. > That way, once you send to that email address, it will be > delivered to the DL, but since there are no members, the mail > will just go away. > > ********************** > Charlie Kaiser > MCSE, CCNA > Systems Engineer > Essex Credit / Brickwalk > 510 595 5083 > ********************** > > > > -----Original Message----- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] On Behalf Of > > Knox, Ron G. > > Sent: Tuesday, April 12, 2005 6:57 AM > > To: Exchange Discussions > > Subject: RE: Postmaster Account > > > > How would one go about adding the null distribution list?? I guess > > I'm not following you for sure. > > Ronk > > > > -----Original Message----- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] On Behalf Of > > Chris Scharff > > Sent: Monday, April 11, 2005 8:54 AM > > To: Exchange Discussions > > Subject: RE: Postmaster Account > > > > ESM | Org | Administrative Groups | $admin_group | Servers > | $server | > > > Protocols | SMTP | $virtual_server | Properties | Messages > | Send copy > > > of Non-Delivery Report to: > > > > > > Course if it's just a single account being bombarded with spam I'd > > have added that SMTP address to a null distribution list so > that the > > messages are dropped into the ether. > > > > -- > > Chris Scharff > > Messaging Services Architect > > MessageOne > > [o] 512.652.4500 x244 > > [m] 512.560.2984 > > [f] 512.652.4504 > > > > > > > -----Original Message----- > > > From: [EMAIL PROTECTED] > > > [mailto:[EMAIL PROTECTED] On > Behalf Of > > > Ron G. Knox Posted At: Sunday, April 10, 2005 8:50 PM Posted To: > > > swynk > > > Conversation: Postmaster Account > > > Subject: Postmaster Account > > > > > > > > > All I have the postmaster account being bombarded by spam so I > > > deleted the account and still have my mail queues loaded up with > > > mail to this account. > > > > > > I go in and delete the mail queues but still am getting loaded up > > > even with the account deleted. I have Exchange 2003 SP1, Win2k3 > > > server. > > > > > > One I am wondering is there a way to block all mail > coming to this > > > post master account?? > > > > > > Two is there a easy way to dump these queues other than using the > > > exchange admin and deleting the messages individually?? > > > > > > Thanks in Advance > > > Ronk > > > > > > > _________________________________________________________________ > > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > > Web Interface: http://intm-dl.sparklist.com/read/?forum=exchange > > To subscribe: > http://e-newsletters.internet.com/discussionlists.html/ > > To unsubscribe send a blank email to > > [EMAIL PROTECTED] > > Exchange List admin: [EMAIL PROTECTED] > > To unsubscribe via postal mail, please contact us at: > > Jupitermedia Corp. > > Attn: Discussion List Management > > 475 Park Avenue South > > New York, NY 10016 > > > > Please include the email address which you have been contacted with. > > > > > > > > > > _________________________________________________________________ > > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > > Web Interface: http://intm-dl.sparklist.com/read/?forum=exchange > > To subscribe: > http://e-newsletters.internet.com/discussionlists.html/ > > To unsubscribe send a blank email to > > [EMAIL PROTECTED] > > Exchange List admin: [EMAIL PROTECTED] > > To unsubscribe via postal mail, please contact us at: > > Jupitermedia Corp. > > Attn: Discussion List Management > > 475 Park Avenue South > > New York, NY 10016 > > > > Please include the email address which you have been contacted with. > > > > > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Web Interface: http://intm-dl.sparklist.com/read/?forum=exchange > To subscribe: http://e-newsletters.internet.com/discussionlists.html/ > To unsubscribe send a blank email to > [EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > To unsubscribe via postal mail, please contact us at: > Jupitermedia Corp. > Attn: Discussion List Management > 475 Park Avenue South > New York, NY 10016 > > Please include the email address which you have been contacted with. > > > > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Web Interface: http://intm-dl.sparklist.com/read/?forum=exchange > To subscribe: http://e-newsletters.internet.com/discussionlists.html/ > To unsubscribe send a blank email to > [EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > To unsubscribe via postal mail, please contact us at: > Jupitermedia Corp. > Attn: Discussion List Management > 475 Park Avenue South > New York, NY 10016 > > Please include the email address which you have been contacted with. > > > > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Web Interface: http://intm-dl.sparklist.com/read/?forum=exchange > To subscribe: http://e-newsletters.internet.com/discussionlists.html/ > To unsubscribe send a blank email to > [EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > To unsubscribe via postal mail, please contact us at: > Jupitermedia Corp. > Attn: Discussion List Management > 475 Park Avenue South > New York, NY 10016 > > Please include the email address which you have been contacted with. > > > > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Web Interface: http://intm-dl.sparklist.com/read/?forum=exchange > To subscribe: http://e-newsletters.internet.com/discussionlists.html/ > To unsubscribe send a blank email to > [EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > To unsubscribe via postal mail, please contact us at: > Jupitermedia Corp. > Attn: Discussion List Management > 475 Park Avenue South > New York, NY 10016 > > Please include the email address which you have been contacted with. > > > > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Web Interface: http://intm-dl.sparklist.com/read/?forum=exchange > To subscribe: http://e-newsletters.internet.com/discussionlists.html/ > To unsubscribe send a blank email to > [EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > To unsubscribe via postal mail, please contact us at: > Jupitermedia Corp. > Attn: Discussion List Management > 475 Park Avenue South > New York, NY 10016 > > Please include the email address which you have been contacted with. > > > _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/read/?forum=exchange To subscribe: http://e-newsletters.internet.com/discussionlists.html/ To unsubscribe send a blank email to [EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/read/?forum=exchange To subscribe: http://e-newsletters.internet.com/discussionlists.html/ To unsubscribe send a blank email to [EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with.
