RE: Administrator Account sending large amount of emails

Hello Rickster,

Thank you for posting to the SBS Newsgroup.

I understand that in SBS 2K3 Server Usage Report, you found that
Administrator has sent 63 emails, however, you never use this account to
send emails. If I have misunderstood your concern, please let me know.

There is a known issue that problem occurs because the View Usage Report
tool in Windows Small Business Server 2003 counts the copies of an e-mail
message incorrectly when you send an e-mail message to multiple users with
unique domain mail addresses. For example, if you copy a message to four
users in three different domains, the View Usage Report tool multiplies the
four user messages by the three domains and reports a total of twelve
messages. The actual number of messages is four. This behavior may cause
the View Usage Report tool to report that a single user is responsible for
hundreds or even thousands of e-mail messages in a day.

For more info, please refer to:
867457 The View Usage Report tool may report many e-mail messages in
Windows
http://support.microsoft.com/?id=867457

This issue also can be caused by some virus or spyware. I suggest that you
use your anti-virus application and anti-spyware application to check the
affected computer.

You can download anti-spyware application from
http://www.spychecker.com/software/antispy.html.

If you do not have anti-virus application, you may try the following
on-line free virus scanner.

http://housecall.antivirus.com/housecall/start_corp.asp#top
http://security.symantec.com/ssc/home.asp
http://www.mcafee.com/myapps/mfs/default.asp
http://www.pandasoftware.com/activescan/com/activescan_principal.htm
http://www.ravantivirus.com/scan/

<Note>: This response contains a reference to a third party World Wide Web
site. Microsoft can make no representation concerning the content of these
sites. Microsoft is providing this information only as a convenience to
you: this is to inform you that Microsoft has not tested any software or
information found on these sites and therefore cannot make any
representations regarding the quality, safety, or suitability of any
software or information found there. There are inherent dangers in the use
of any software found on the Internet, and Microsoft cautions you to make
sure that you completely understand the risk before retrieving any software
on the Internet.

If you have verified that no relaying spam or e-mail viruses exist, you can
safely ignore the number of e-mail messages that are reported by the View
Usage Report tool.

For you additional information:

1> You can use Message Tracking to check where these emails have been sent
to. To do so:

a). On the SBS Server, go to Exchange System Manager.

b). Expand to YourServer(Exchange)\Servers\Yourserver.

c). Right click Yourserver, Properties, and go to the General tab.

d). Check the box Enable Message Tracking, and click OK.

e). Go to Yourserver(Exchange)\Tools\Monitoring and Status\Message Tracking
Center.

f). On the right pane, please fill in the Sender, and Server blanks, and
then click Find Now.

g). Now the e-mail information will be displayed in the button, and you can
double click it.

h). Now it will show you the Message History.

2> I also have found following Documents to secure your SBS Network.

Securing Your Windows Small Business Server 2003 Network
http://www.microsoft.com/downloads/details.aspx?familyid=f62b2722-267c-4642-
b287-c31115ef10a4&displaylang=en

Account Passwords and Policies
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/
security/bpactlck.mspx

Hope this information helps! If you have any father questions or concern,
please feel free to let me know. I am glad to be of further assistance!

Best regards,

Brandy Nee

Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security
======================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.
======================================================
This posting is provided "AS IS" with no warranties, and confers no rights.



--------------------
>Thread-Topic: Administrator Account sending large amount of emails
>thread-index: AcXz/nOSTueq+YPvTdOYKAmfCfnqGw==
>X-WBNR-Posting-Host: 212.159.88.194
>From: "=?Utf-8?B?Umlja3N0ZXI=?=" <Rickster@xxxxxxxxxxxxxxxxxxxxxxxxx>
>Subject: Administrator Account sending large amount of emails
>Date: Mon, 28 Nov 2005 01:31:03 -0800
>Lines: 5
>Message-ID: <C0BA8C92-A4B4-4657-BFD0-6F707F9A5BE2@xxxxxxxxxxxxx>
>MIME-Version: 1.0
>Content-Type: text/plain;
> charset="Utf-8"
>Content-Transfer-Encoding: 7bit
>X-Newsreader: Microsoft CDO for Windows 2000
>Content-Class: urn:content-classes:message
>Importance: normal
>Priority: normal
>X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.0
>Newsgroups: microsoft.public.windows.server.sbs
>NNTP-Posting-Host: TK2MSFTNGXA03.phx.gbl 10.40.2.250
>Path: TK2MSFTNGXA02.phx.gbl!TK2MSFTNGXA03.phx.gbl
>Xref: TK2MSFTNGXA02.phx.gbl microsoft.public.windows.server.sbs:225991
>X-Tomcat-NG: microsoft.public.windows.server.sbs
>
>On my extended usage report the Administrator account 63 external emails
>totalling almost 90MB. This account is only used to administer the server
and
>as far as I am aware never used to send emails.
>
>Any suggestions regarding this?
>

.