Hi, One of my customer's server is sending out emails which appears to be spam. Their server is NOT an open relay (multiple tests have been done) and I suppose one of the computer connected to the Exchange server could be infected by something. Is there anyway to: - restrict the outgoing emails to be sent from an existing email address in the Active Directory? - check from which computer / IP address are sent some messages in the queues that are obvious spams? Thanks for any help, Ambroise NEVE

You should be able to view the queues to see what mail is in them. Also have you tried to use Exmon to see what account is using lots of activity. http://almostdailytech.com/2009/05/25/exchange-messaging-statistics/Mark Morowczynski|MCT| MCSE 2003:Messaging, Security|MCITP:EMA 2K7,EDA Win 7,ES,SA,EA|MCTS:Windows Mobile Admin|Security+|http://almostdailytech.com

Hi Mark, First of all, thank you for your answer. I am getting quite mad here :-( I did use ExMon to see different things: - I have a blank user in the list - Some users use a lot, but those vary each 15 minutes (interval I set), so I suppose that this is "normal" current usage The thing that is making me go crazy is that when I look into the queues, I see messages coming FROM <some-spammer@some-domain.com>. I do not know where those come from. There aren't a lot (2 to 20 / hour), but that is still too much for me and my Internet provider. My POP and IMAP services are disabled so this can only happen via Exchange / MAPI I guess... Is there now way to figure out which computer or which IP actually send these emails to Exchange? Any help greatly appreciated. Ambroise