Hi,

Stopped receiving incident notification from forefront Protection for Exchange to Administrators group. Setup is Exchange 2007 SP3 HUB & Edge servers configured with Forefront Protection for exchange. Configuration is there for Notifications to go to Administrators. However the emails are not available, assuming after OS baseline hardening.

Regards,

J Antony

Hi,

do you have any information in the event log?

Greetings

Christian

Hi Christian,

could find certain FAIL logs in message tracking regarding FSE Routing Agent, here sender address and recipient address shows same.

#Fields: date-time

client-hostname

server-hostname

source-context

connector-id

source

event-id

internal-message-id

message-id

recipient-address

recipient-status

total-bytes

recipient-count

related-recipient-address

reference

message-subject

sender-address

return-path

message-info

2014-04-09T22:00:04.468Z

<ServerName>1

D:\Program Files\Microsoft\Exchange Server\TransportRoles\Pickup\mail.635326920019843750.eml

PICKUP

RECEIVE

107489

<33384a4b-b80c-4223-947e-1f8fc1a5a66d@<ServerName>1..<domainname>.com>

ForefrontServerSecurity@<ServerName>1.com

808

1

{3a7cccd0-11f3-47d5-86c0-fb8b8a346451}

ForefrontServerSecurity@<ServerName>1.com

ForefrontServerSecurity@<ServerName>1.com

08A:

2014-04-09T22:00:04.484Z

<ServerName>1

FSE Routing Agent

AGENT

FAIL

107489

<33384a4b-b80c-4223-947e-1f8fc1a5a66d@<ServerName>1..<domainname>.com>

ForefrontServerSecurity@<ServerName>1.com

808

1

{3a7cccd0-11f3-47d5-86c0-fb8b8a346451}

ForefrontServerSecurity@<ServerName>1.com

ForefrontServerSecurity@<ServerName>1.com

2014-04-10T22:00:05.593Z

<ServerName>1

D:\Program Files\Microsoft\Exchange Server\TransportRoles\Pickup\mail.635327784020312500.eml

PICKUP

RECEIVE

107507

<d80e5b03-a73c-49d9-bfa7-c62ae37fd897@<ServerName>1..<domainname>.com>

ForefrontServerSecurity@<ServerName>1.com

809

1

{3a7cccd0-11f3-47d5-86c0-fb8b8a346451}

ForefrontServerSecurity@<ServerName>1.com

ForefrontServerSecurity@<ServerName>1.com

08A:

2014-04-10T22:00:05.609Z

<ServerName>1

FSE Routing Agent

AGENT

FAIL

107507

<d80e5b03-a73c-49d9-bfa7-c62ae37fd897@<ServerName>1..<domainname>.com>

ForefrontServerSecurity@<ServerName>1.com

809

1

{3a7cccd0-11f3-47d5-86c0-fb8b8a346451}

ForefrontServerSecurity@<ServerName>1.com

ForefrontServerSecurity@<ServerName>1.com

2014-04-10T23:26:24.609Z

<ServerName>1

D:\Program Files\Microsoft\Exchange Server\TransportRoles\Pickup\mail.635327835796562500.eml

PICKUP

RECEIVE

1

<e18a5cbd-15d2-42d6-830e-eb9855b410a0@<ServerName>1..<domainname>.com>

ForefrontServerSecurity@<ServerName>1.com

767

1

{3a7cccd0-11f3-47d5-86c0-fb8b8a346451}

ForefrontServerSecurity@<ServerName>1.com

ForefrontServerSecurity@<ServerName>1.com

08A:

2014-04-10T23:26:25.625Z

<ServerName>1

FSE Routing Agent

AGENT

FAIL

1

<e18a5cbd-15d2-42d6-830e-eb9855b410a0@<ServerName>1..<domainname>.com>

ForefrontServerSecurity@<ServerName>1.com

767

1

{3a7cccd0-11f3-47d5-86c0-fb8b8a346451}

ForefrontServerSecurity@<ServerName>1.com

ForefrontServerSecurity@<ServerName>1.com

Hi,

is there something in the Windows event log?

I would suggest to backukp your configuration of FPE and reinstall it.

Greetings

Christian

The issue has been fixed after adding NETWORK SERVICE permission on %systemroot%\Temp folder and reboot of servers.. 

The issue has been fixed after adding NETWORK SERVICE permission on %systemroot%\Temp folder and reboot of servers.. 

• Marked as answer by Jomins 6 hours 5 minutes ago

The issue has been fixed after adding NETWORK SERVICE permission on %systemroot%\Temp folder and reboot of servers.. 

• Marked as answer by Jomins Monday, April 21, 2014 4:48 AM