Exchange Server

Johnniep

Hey All,

I work for a small company in town and know my way around a home desktop and unfortunately, I have been "volunteered" :mad: to look after the office IT including the server. I am unfamiliar with small business server 2003, and any help on this would be very much appreciated!

Basically, the email is run off exchange sever running on an SBS2003 server. Over the past few days, I have noticed a dramatic drop in the speed of our internet connection and am getting calls saying emails I have sent have not been recieved. Looking into this, I had a look at the queue in Exchange Server Manager and there is a long list of e-mails sitting there. :eek: They all seem to be generated by one user on the network. I asked this user and they claim they didn't send them and their outbox/sent items agree with this. Anyone have any idea's where these mails are coming from and how do I stop this

Many Thanks,

Johnniep

aidan_walsh

Have you swept all machines in the office (that users in particular) with an up to date anti virus?

Karoma

Does the content of the emails look legit? (i.e. It's not spam,or gibberish..?)
Check the headers on the emails against the user's machine IP address (and note time and date..)
Scan for viruses and spyware.

ressem

Might also be worth checking whether they have set any server side rules through Outlook to, for example, forward internal mails to an external webmail account (Outlook/ Tools / Rules and Alerts/ Email Rules). Those 20 MB internal memos can really feck up a 256k internet DSL connection.

As Karoma said, the content and headers of the mail should help tell you this.
Are all mails heading to a single destination? Are the entries the same as those in the users inbox.

Johnniep

Thanks for the advice! Really appreciate it.

I don't think it could be a virus as we are running Norto Corporate edition which updates all the client PC's automatically (hopefully ) We have a look for spyware etc and will also check the exchange to see where the e-mails are heading. Had a quick look at the queue this morning and everything seems to be fine (But for how long )

Regards,

Johnniep

Asok

Used to get this in my last job, One person would consitently send out about 1 to 1.5 gb's of mail shots on a 512k line. Check out whats in those mails that are waiting to be sent e.g is it a 7mb bmp or something silly like that. Also if your going to be looking after the office I.T keep the fact that users lie ...alot in the back of your head.

seamus

Asok wrote:

Also if your going to be looking after the office I.T keep the fact that users lie ...alot in the back of your head.

I'd say half of the time they lie to avoid "getting into trouble" and the other half of the time they omit the necessary information out of ignorance.

Johnniep

Asok wrote:

Used to get this in my last job, One person would consitently send out about 1 to 1.5 gb's of mail shots on a 512k line. Check out whats in those mails that are waiting to be sent e.g is it a 7mb bmp or something silly like that. Also if your going to be looking after the office I.T keep the fact that users lie ...alot in the back of your head.

Kinda figuring that one out as I go Will keep an eye on whats going out and see where the problem is.

Thanks.

Asok

No hassle, If you ever get into bother drop me a pm.

Dan