Re: Event Log Errors

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

From: Burl Carr (bcarr_at_silverlink.net)
Date: 02/16/04 

Date: Mon, 16 Feb 2004 15:21:50 -0800

Greg,

What adverse effects, if any, can result from either of your two suggested
methods?

Also, I still would like to know what is the root cause of these entries.
Sure seems like someone is trying to probe the Exchange server for holes or
othewise look for a way to relay.

FWIW, one interesting note related to these errors is that in my experience
monitoring several SBS 2003 servers, they are only showing up on the those
Premium version installations with both ISA and SQL installed and not on the
Standard versions.

TIA,
Burl

"Gregory L. Winn (MSFT)" <gregwinn@online.microsoft.com> wrote in message
news:haJfP9%237DHA.3852@cpmsftngxa07.phx.gbl...
> Burl,
>
> We have seen cases were the following steps have resolved this but that
> does not mean that it will definitely work in this case. You can however
> try it and it may work for you.
>
> To work around this issue, use one of the following methods.
>
> Method 1: Configure the XEXCH50 Registry Subkey
> -----------------------------------------------
>
> In Exchange Server 2003 and Exchange Server 2000 Service Pack 3
> (SP3), you can suppress the sending of the XEXCH50 command to external
> domains. To do so, follow these steps.
>
>
> WARNING: If you use Registry Editor incorrectly, you may cause serious
> problems that may require you to reinstall your operating system.
> Microsoft
> cannot guarantee that you can solve problems that result from using
> Registry
> Editor incorrectly. Use Registry Editor at your own risk.
>
>
> 1. Click "Start", click "Run", type "regedit" (without the quotation
> marks) in the "Open" box, and then click "OK".
>
> 2. Locate the following registry subkey:
>
> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SMTPSVC\XEXCH50Note
> If the XEXCH50 registry subkey is not present, create it. To do this,
point
> to
> "New" on the "Edit" menu, and then click
> "Key". In the "New Key #1" box, type
> "XEXCH50" (without the quotation marks), and then press ENTER.
>
> 3. Right-click "XEXCH50", point to "New", and then click "DWORD Value".
>
> 4. In the "New Value #1" box, type "SuppressExternal" (without the
> quotation marks), and then press ENTER.
>
> 5. Right-click "SuppressExternal", and then click "Modify".
>
> 6. In the "Value data" box, type "1" (without the quotation marks), and
> then click "OK".
>
> 7. Quit Registry Editor.
>
>
> Method 2: Configure the SMTP Connector
> --------------------------------------
>
> Configure the SMTP connector properties to use the HELO command instead of
> the EHLO command. When Exchange Server sends the HELO command, it does not
> receive the list of commands that the remote
> server supports, and reverts to simple SMTP commands. None of the
> extended SMTP
> command verbs are used.
>
> To configure the SMTP connector, follow these
> steps:
>
>
> 1. Start the Exchange System Manager utility.
>
> 2. If Administrative Groups are turned on, expand "Administrative
> Groups", and then expand "First Administrative Group".
>
> 3. Expand "Connectors", right-click the SMTP connector that you use to
> connect to the remote domain, and then click "Properties".
>
> 4. Click the "Advanced" tab, click to select the "Send HELO instead of
> EHLO" check box, click "Apply", and then click "OK".
>
> Best Regards,
>
>
> Greg Winn, MSCE
>
> SBS Online Support Professional
>
> Get Secure! - www.microsoft.com/security
>
> =====================================================
>
> When responding to posts, please "Reply to Group" via your newsreader so
>
> that others may learn and benefit from your issue.
>
> =====================================================
>
> This posting is provided "AS IS" with no warranties, and confers no
rights.
>

Relevant Pages

  • Re: Event Log Errors
    ... Burl ... Use Registry Editor at your own risk. ... > the EHLO command. ... > To configure the SMTP connector, ...
    (microsoft.public.windows.server.sbs)
  • RE: Event 9646 - exceeded the maximum of 32 objects of type "session"
    ... A program that is running on a client computer opens many MAPI sessions ... to the Exchange Server computer. ... account that the program runs under. ... Warning If you use Registry Editor incorrectly, ...
    (microsoft.public.exchange.admin)
  • Re: view mailbox sizes and message counts
    ... No, you're not missing anything. ... a large environment in Exchange Server 2003/2000. ... The command can be constrained by using -server and -database switches to ... I can see exchange system management console is extremely different from ...
    (microsoft.public.exchange.admin)
  • RE: 7010 Events
    ... XEXCH50 is an Exchange specific extended command that should only be issued ... If you use Registry Editor incorrectly, ...
    (microsoft.public.windows.server.sbs)
  • RE: Rules error !!
    ... When that happens it simply deactivates the rules all together for me. ... If you think that they are corrupted then start Oulook 2003 from the command line with /cleanclientsrules and start it again with /cleanserverrules. ... > "one or more rules could not be uploaded to exchange server and have been ... > even if I make rules client side ...
    (microsoft.public.exchange.admin)