What's using my Exchange server to send email via SMTP?Messages stuck in SMTP queue - Exchange 2003Best way to throttle smtp email on Windows Server 2008Exchange 2003 - how to route ALL mail (including internal) via an external SMTP gateway? (Or, domain/mail server migration for the masses.)Emails sent from Coldfusion using the same SMTP/Exchange server works from one machine but fails for anotherEmail sent via SMTP server - working except to our Exchange account?postfix loopback email and exchange issuesSuggestion required for Mailbox migration from Mailenable 7.5 POP/SMTP to Exchange ServerExchange 2016 Receive ConnectorsExchange 2016 is ignoring a single host for SMTP/EWSDoes email from IIS SMTP get rejected?
Why is std::ssize() introduced in C++20?
Testing using real data of the customer
Why was this character made Grand Maester?
Papers on ArXiv as main references
Is "vegetable base" a common term in English?
Merge pdfs sequentially
Why'd a rational buyer offer to buy with no conditions precedent?
Complications of displaced core material?
Have any humans orbited the Earth in anything other than a prograde orbit?
How would a developer who mostly fixed bugs for years at a company call out their contributions in their CV?
Why did it take so long for Germany to allow electric scooters / e-rollers on the roads?
Why did OJ Simpson's trial take 9 months?
How can I minimize the damage of an unstable nuclear reactor to the surrounding area?
Possibility of faking someone's public key
Was this scene in S8E06 added because of fan reactions to S8E04?
Cisco 3750X Power Cable
What could be my risk mitigation strategies if my client wants to contract UAT?
To exponential digit growth and beyond!
Unary Enumeration
Why did other houses not demand this?
Quantum corrections to geometry
Why do testers need root cause analysis?
Why is unzipped directory exactly 4.0K (much smaller than zipped file)?
Why did Drogon spare this character?
What's using my Exchange server to send email via SMTP?
Messages stuck in SMTP queue - Exchange 2003Best way to throttle smtp email on Windows Server 2008Exchange 2003 - how to route ALL mail (including internal) via an external SMTP gateway? (Or, domain/mail server migration for the masses.)Emails sent from Coldfusion using the same SMTP/Exchange server works from one machine but fails for anotherEmail sent via SMTP server - working except to our Exchange account?postfix loopback email and exchange issuesSuggestion required for Mailbox migration from Mailenable 7.5 POP/SMTP to Exchange ServerExchange 2016 Receive ConnectorsExchange 2016 is ignoring a single host for SMTP/EWSDoes email from IIS SMTP get rejected?
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;
We have two Exchange Servers (2016 CU9), EX-OLD and EX-NEW. There are various systems, processes, scheduled tasks and scripts in the business that send emails through our Exchange servers by connecting through SMTP.
We've tracked down a large number of these and updated their configuration to use EX-NEW but are quietly confident that there will still be processes lurking that are using EX-OLD.
Is there a way to determine what's still using EX-OLD for SMTP via Exchange?
exchange smtp exchange-2016
asked May 9 at 8:06
RobRob
585625
add a comment |
We have two Exchange Servers (2016 CU9), EX-OLD and EX-NEW. There are various systems, processes, scheduled tasks and scripts in the business that send emails through our Exchange servers by connecting through SMTP.
We've tracked down a large number of these and updated their configuration to use EX-NEW but are quietly confident that there will still be processes lurking that are using EX-OLD.
Is there a way to determine what's still using EX-OLD for SMTP via Exchange?
exchange smtp exchange-2016
asked May 9 at 8:06
RobRob
585625
1
Look at the Exchange transport logs, run a network capture on the server for a few hours and see what inbound SMTP traffic is hitting it, etc., etc.
– joeqwerty
May 9 at 11:45
What's the configuration of your virtual directories and DNS records? You can check the IIS log as well.
– joyceshen
May 10 at 3:15
@joeqwerty - that sounds like the start of an answer to me! :) Regarding Exchange transport logs, that sounds like the most promising as some of these processes are periodic and may run only once a week - having wireshark or similar running for that long doesn't seem ideal, assuming that the logs will give me sufficient info (message id, source server?) to track things down
– Rob
May 10 at 6:31
@joyceshen I'm not sure how either of those will help, AFAIK IIS isn't responsible for receiving SMTP email in Exchange and the IP addresses behind EX-OLD and EX-NEW won't have any bearing on the discovery process?
– Rob
May 10 at 6:32
add a comment |
We have two Exchange Servers (2016 CU9), EX-OLD and EX-NEW. There are various systems, processes, scheduled tasks and scripts in the business that send emails through our Exchange servers by connecting through SMTP.
We've tracked down a large number of these and updated their configuration to use EX-NEW but are quietly confident that there will still be processes lurking that are using EX-OLD.
Is there a way to determine what's still using EX-OLD for SMTP via Exchange?
exchange smtp exchange-2016
asked May 9 at 8:06
RobRob
585625
We have two Exchange Servers (2016 CU9), EX-OLD and EX-NEW. There are various systems, processes, scheduled tasks and scripts in the business that send emails through our Exchange servers by connecting through SMTP.
We've tracked down a large number of these and updated their configuration to use EX-NEW but are quietly confident that there will still be processes lurking that are using EX-OLD.
Is there a way to determine what's still using EX-OLD for SMTP via Exchange?
exchange smtp exchange-2016
exchange smtp exchange-2016
asked May 9 at 8:06
RobRob
585625
asked May 9 at 8:06
RobRob
585625
asked May 9 at 8:06
RobRob
585625
asked May 9 at 8:06
RobRob
585625
asked May 9 at 8:06
RobRob
585625
585625
1
Look at the Exchange transport logs, run a network capture on the server for a few hours and see what inbound SMTP traffic is hitting it, etc., etc.
– joeqwerty
May 9 at 11:45
What's the configuration of your virtual directories and DNS records? You can check the IIS log as well.
– joyceshen
May 10 at 3:15
@joeqwerty - that sounds like the start of an answer to me! :) Regarding Exchange transport logs, that sounds like the most promising as some of these processes are periodic and may run only once a week - having wireshark or similar running for that long doesn't seem ideal, assuming that the logs will give me sufficient info (message id, source server?) to track things down
– Rob
May 10 at 6:31
@joyceshen I'm not sure how either of those will help, AFAIK IIS isn't responsible for receiving SMTP email in Exchange and the IP addresses behind EX-OLD and EX-NEW won't have any bearing on the discovery process?
– Rob
May 10 at 6:32
add a comment |
1
Look at the Exchange transport logs, run a network capture on the server for a few hours and see what inbound SMTP traffic is hitting it, etc., etc.
– joeqwerty
May 9 at 11:45
What's the configuration of your virtual directories and DNS records? You can check the IIS log as well.
– joyceshen
May 10 at 3:15
@joeqwerty - that sounds like the start of an answer to me! :) Regarding Exchange transport logs, that sounds like the most promising as some of these processes are periodic and may run only once a week - having wireshark or similar running for that long doesn't seem ideal, assuming that the logs will give me sufficient info (message id, source server?) to track things down
– Rob
May 10 at 6:31
@joyceshen I'm not sure how either of those will help, AFAIK IIS isn't responsible for receiving SMTP email in Exchange and the IP addresses behind EX-OLD and EX-NEW won't have any bearing on the discovery process?
– Rob
May 10 at 6:32
1
1
Look at the Exchange transport logs, run a network capture on the server for a few hours and see what inbound SMTP traffic is hitting it, etc., etc.
– joeqwerty
May 9 at 11:45
Look at the Exchange transport logs, run a network capture on the server for a few hours and see what inbound SMTP traffic is hitting it, etc., etc.
– joeqwerty
May 9 at 11:45
What's the configuration of your virtual directories and DNS records? You can check the IIS log as well.
– joyceshen
May 10 at 3:15
What's the configuration of your virtual directories and DNS records? You can check the IIS log as well.
– joyceshen
May 10 at 3:15
@joeqwerty - that sounds like the start of an answer to me! :) Regarding Exchange transport logs, that sounds like the most promising as some of these processes are periodic and may run only once a week - having wireshark or similar running for that long doesn't seem ideal, assuming that the logs will give me sufficient info (message id, source server?) to track things down
– Rob
May 10 at 6:31
@joeqwerty - that sounds like the start of an answer to me! :) Regarding Exchange transport logs, that sounds like the most promising as some of these processes are periodic and may run only once a week - having wireshark or similar running for that long doesn't seem ideal, assuming that the logs will give me sufficient info (message id, source server?) to track things down
– Rob
May 10 at 6:31
@joyceshen I'm not sure how either of those will help, AFAIK IIS isn't responsible for receiving SMTP email in Exchange and the IP addresses behind EX-OLD and EX-NEW won't have any bearing on the discovery process?
– Rob
May 10 at 6:32
@joyceshen I'm not sure how either of those will help, AFAIK IIS isn't responsible for receiving SMTP email in Exchange and the IP addresses behind EX-OLD and EX-NEW won't have any bearing on the discovery process?
– Rob
May 10 at 6:32
add a comment |
0
active
oldest
votes
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f966521%2fwhats-using-my-exchange-server-to-send-email-via-smtp%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f966521%2fwhats-using-my-exchange-server-to-send-email-via-smtp%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
1
Look at the Exchange transport logs, run a network capture on the server for a few hours and see what inbound SMTP traffic is hitting it, etc., etc.
– joeqwerty
May 9 at 11:45
What's the configuration of your virtual directories and DNS records? You can check the IIS log as well.
– joyceshen
May 10 at 3:15
@joeqwerty - that sounds like the start of an answer to me! :) Regarding Exchange transport logs, that sounds like the most promising as some of these processes are periodic and may run only once a week - having wireshark or similar running for that long doesn't seem ideal, assuming that the logs will give me sufficient info (message id, source server?) to track things down
– Rob
May 10 at 6:31
@joyceshen I'm not sure how either of those will help, AFAIK IIS isn't responsible for receiving SMTP email in Exchange and the IP addresses behind EX-OLD and EX-NEW won't have any bearing on the discovery process?
– Rob
May 10 at 6:32