Microsoft Archives - Page 9 of 10

The User Profile Service Service failed the logon. User profile cannot be loaded, when logging on to Windows 7 or Windows Vista

Ever get this when logging in to a Vista or Windows 7 system? I seem to get it all the time, here is how to quickly fix it. By the way that is not a typo in my subjectline but how the error shows up when you try logging in. Not sure why but I am guessing that “User Profile Service is a Service and thus the “User Profile Service Service” as the title of this post.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

You will find a key or maybe several keys that have “.bak” extenion on them. You will also find the same key with out the “.bak“, Rename the key without the “.bak” to same name + “.new” then rename the Key with “.bak” removing the “.bak“. Basically we are making the .bak key the original key and so forth.

Now that you have that done we need to edit 2 keys inside of the newly renamed key. Choose the folder without .bak, in the right pane, double click RefCount and type 0 and then click OK, next choose the folder without .bak, in the right pane, double click State and type 0 and then click OK.

Close the regedit and logout and back in as the user profile that was failing. It should allow you in now.

I hope this helps someone out there

Cubert

Weird Network Issues, Can’t surf the web or web applications are failing but ping and DNS works?

There are many symptoms that may arise when you are installing a new firewall on a network that is using a DSL circuit and the MTU is not set correctly. That’s right the MTU, Max transmission Unit as it is know is a happy 1500 bytes on any Ethernet, that medium makes up most endpoint networks on the Internet. Most admins never think about what the MTU is set at the gateway device, when they forget to realize that the circuit to the Internet is a DSL circuit they may see things on the network that can’t seem to explain.

MTU is the maximum packet size (in bytes) that can be transported reliably across any particular network; IP Ethernet in this case. The maximum size of an IP Ethernet packet is 1500, but overhead like IP, TCP, and PPPoE must also be taken into account. The wrong MTU will actually prevent you from accessing some web sites or FTP sites. It may even cause you to not authenticate properly on mail servers or secure web sites. There are too many variables to be able to estimate what your optimum MTU should be but my rule of thumb is -32bytes which makes the MTU 1468.

If your running a VPN to a remote domain and you are having domain failures that don’t seem to make since? Some people have no issues and others fail with different errors when the should work?

Only some websites working correctly?

DNS and ping work but other services may fail like mail or ftp?

What maybe taking place is a conflict in the MTU available on a DSL circuit. The Ethernet is placing packets on the wire at up to 1500 bytes each but the DSL has only 14XX bytes available to it so a fragment has to take place that ends up breaking the request being made.

It is simple to overcome such a issue by setting the MTU of your firewalls DSL facing Ethernet device. This will then cause the firewall to regulate the MTU and control the MTU going out to the DSL circuit.

You can also change the MTU in a Windows workstation so it will not send out a packet bigger than what the DSL circuit can handle.

To do this edit the registry with REGEDIT and change the following key.

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\
Interfaces\[Adapter ID]]

Value Name: MTU
Data Type: REG_DWORD (DWORD Value)
Value Data: Default = 0xffffffff (1500)

This will fix the Windows system but I prefer to do it at the firewall so one edit changes all systems. Do what you need to do.

Hope this helps someone out there

Cubert

Monitor a WD ShareSpace using XYMon on any remote network

Do you happen to be a systems support guy who needs a method of getting the basic stats of a WD ShareSpace into your XYmon or MAG monitor? If you are like me then you are a systems admin responsible for many different networks spread across the Internet. You then may have deployed a few NAS systems including the WD ShareSpace that runs a version of BusyBox Linux. This is good news because WD provides access to the shell over SSH if you enable it via the web admin (advanced section). So now go enable SSH access and then puttythe system using the username “root” and a password of “welc0me” where the 0 in welc0me is a zero.

With shell access we can do many things, one of which is getting the stats from the system. Currently we have only 1 method to get the stats to XYmon but we are exploring some custom XYmon client binaries we can distribute in future versions of this article. That may make this article a mute point so check back every so often for updates.

Today we have to do monitoring in 2 parts,

#1 Have a script on WD ShareSpace running on a regular intervals, that executes the basic commands to produce the files we need to stat the system in XYmon.

#2 Have a Windows system grab the stat files from WD ShareSpace and process them before sending them on to the XYMon server.

First script is the WD Sharespace script which is a very simple shell script that does nothing more then cat to several text files ( meminfo, df, du, uptime and load) and saves them to a share on the WD ShareSpace called Public. You can modify the script to place files on any share you want. The script should then be executed with the following command while SSHed in to the WD ShareSpace

The first time you run the script you will need to make it executible. To do so type:

chmod 0755 ./Report.sh

The to run the shell script type:

Report.sh &

This will place the script in the background as a process and release your shell so you can logout without stopping the script. The script will run then sleep for 5 minutes then run again replacing files with updated files every 5 minutes until you stop it(which should be never). You will need to change the permissions on the files the first time you run script so that the report files are world readable. To do this use the following command.

chmod 0777 ./*report.txt

We now have stat files on a share that we want to “FTP” off. The key word here is FTP so we will want to allow anonymous FTP to the WD ShareSpace. Login to the web admin of the WD ShareSpace and enable FTP on the device. This allows the Perl script we use next to grab the stat files, process them and then send them on to the XYmon sever via a proxy connection.

WDShareSpace Scripts

The next step is to setup the Windows system to proxy the stats to the remote XYMon server. I normally use one of the Windows server we monitor via XYMon but if this is the only thing you monitor then a windows desktop can be used as well. Either way you will need a Active State Perl set up on a Windows box to be the proxy.

Today the script is Perl, tomorrow it could be a Powershell or some other language suitable for Windows but for today it’s Perl. Perl is not native to Windows so you will need to add it’s language to Windows by the way of Active State Perl for Windows. To install ASP go to Active State Perl. Install Perl and make sure you select to place Perl in the PATH variables with in Windows during install process. Now download our Perl script and place it in a directory on your Windows server.

You should edit the script variables so that it reflects your setups, (Share to look for files in, the name of the WDShareSpace as seen on XYMon server ). The run the Windows Scheduler and create a new daily schedule to run the perl script “WdShareSpace.pl”. After creating the daily schedule go back in and edit the schedule and select the advanced section. Find the “run every” and set it to 5 minutes and the in the “run for” place in 24 for 24 hours a day. This will get the script running every 5 minutes which is the same schedule as the shell script running on the NAS so you will get updates every 5 minutes.

So to summarize:

We have 2 scripts (Report.sh and WDSharespace.pl) Report.sh runs on the NAS and after permissions are changed it is executed with the (&) symbol after it so it drops to the background and keeps running when you close the ssh window. This script creates a set of report text files in the same directory as the script. The WDShareSpace.pl runs on Windows with Active State Perl installed and it has several varibles in script that need to be edited to point it to the NAS and XYMon servers and it is scheduled to run inside of Windows Scheduler(AT) on a 5 minute interval.

If all is successful you should get some thing like the following in your XYmon server if you configured the BBHOST for the WDShareSpace HOST.

Disk view:

Kaseya Agent Procedure – FTP Remote Client Backup Script

Backup Windows Systems to a FTP Server

Download: -> Kaseya FTP Backups

So you have Kaseya clients out on the wire that need some level of backup but are not near a NAS or USB Drive. Have thoes clients backup to a FTP server by using WinSCP and a Kaseya Script to do the job for you.

This script has several peices and can be customized for what ever need you have. I currently have the script setup in 3 files.

File #1 (WinSCP_Backup.bat) This is executed by the Kaseya script and passed 2 variables. The variables are the name of the local folder and the name of the remote folder you want to sync.

Example:

c\temp\WinSCP_backup.bat userA FTPdirA >> c\temp\backup.log

We call the BAT file passing “userA” and “FTPDira” this could be the users name for their home directory and the remote directory which could be any folder on your ftp minus the first “/”

File #2 (WinSCP_backup.txt) This file tells WinSCP how to connect to your FTP server and what root directories to start looking in for the folder names provided above. You need to edit this file adding your FTP server information, username and password for FTP if needed.

File #3 is WinSCP.exe, This is a freely available FTP and SCP client for windows that is very configurable and has CLI functions.

This set of scripts in it’s current form will allow you to sync the local systems users home directories to a remote FTP server.

Sync is currently one direction as shown below. But you can sync any way you want.
c:\Documents and Settings\username -> ftp://ftp.domainname.com/foldername

Enjoy

Cubert 😎

Scripts to be used at your own descression, no warranty is implied.

How-to Emulate the TOP command in Windows

Top is a Linux process that shows a list of processes running on the system and what levels of resources are being used. This application provides all processes running, the CPU and Memory consumed and with several switches available you can see things like the location of the executable that is running.

Unfortunately, they don’t make a TOP executable ported for Microsoft Windows but don’t despair. You can

Unfortunately, they don’t make a TOP executable ported for Microsoft Windows but don’t despair. You can use Power Shell to script a simple TOP style display that operates just like TOP on a Linux system.

Here is the one liner you need to get a top style process viewer running on windows.

while (1) { ps | sort -desc cpu | select -first 30; sleep -seconds 2; cls }

Copy the above line and paste it in to your Power Shell console. You should see something similar to the following image.

Exchange 2007-> Adding and/or Deleting Holidays to and from All User Calendars

You can customize the Outlook holiday file to include your own holiday information. You might choose to do this if a particular local holiday is not included in the Outlook file and you want to deploy new holiday information to a large group of people (if you just want to do this for yourself, it’s probably easier to just add events directly to your calendar).

You can open the

You can open the holiday file, usually located in C:\Program Files\Microsoft Office\Office<Ver>\<LCID>\Outlook.hol, to edit which holidays are added to your calendar when you import holidays. For example, if you are using a US English version of Outlook 2007, you would usually find your holiday file at C:\Program files\Microsoft Office\Office12\1033\Outlook.hol. If you don’t know the LCID of your language, look for a folder under the Office12 folder that only has a numerical name, that’s probably the right one.

Note: You need to be a local administrator on the computer to edit the holiday file.

After you have the file open, you’ll find a listing of holidays for several different locations. Each location’s holidays start with a header, that includes the location name inside square brackets, and the number of holidays listed for that location. For example, for the United States you might see a header like this:

[United States] 168

If you add additional holidays to the file, make sure to increment the number or some holidays will be missed.

Each line inside a section represents a specific instance of a holiday. For example, the section for holidays in the United States contains a line like this:

Groundhog Day,2008/2/2

This line includes the holiday name (Groundhog Day), then a comma, and then the date the holiday occurs in the format year/month/day. To add your own holidays to the calendar, just add new lines to the bottom of the file in the same format, save the file, and then import your location’s holidays.

If you decide to edit the holiday file to add your own holidays, consider adding them as a brand new location instead of adding them to an existing location. This way you can choose to import only the new holidays without creating duplicates of the existing holidays you have previously added. For example, if you wanted to create a listing of all your associates birthdays, you could add a listing like this to the end of the file:

[Birthdays] 3
Ryan’s Birthday,2008/1/1
Ryan’s Birthday,2009/1/1
Ryan’s Birthday,2010/1/1

After you have finished editing the holidays file, remember to keep a back up. Because the file is installed with Outlook, it can be modified or replaced with the original if you install an update or upgrade to a newer version.

Outlook Command line switches:

Switch	Description	Works in
/a path:\<filename>	Creates an item with the specified file as an attachment. Example: `"C:\Program Files\Microsoft Office\Office12\Outlook.exe" /a "C:\My Documents\labels.doc"`If no item type is specified, IPM.Note is assumed. Cannot be used with message classes that aren’t based on Outlook.	2000, 2002/XP, 2003, 2007, 2010
/altvba <otmfilename>	Opens the VBA program specified in otmfilename, rather than %appdata%\Microsoft\Outlook\VbaProject.OTM.	2003, 2007, 2010
/autorun macroname	Opens Outlook and immediately runs the macro specified in macroname. (no longer supported after Outlook 2003 SP2)	2003
/c <messageclass>	Creates a new item of the specified message class (Outlook forms or any other valid MAPI form).Examples: /c ipm.activity creates a Journal entry /c ipm.appointment creates an appointment /c ipm.contact creates a contact /c ipm.note creates an e-mail message /c ipm.stickynote creates a note /c ipm.task creates a task	2002/XP, 2003, 2007, 2010
/checkclient	Prompts for the default manager of e-mail, news, and contacts.	2000, 2002/XP, 2003, 2007, 2010
/cleanautocompletecache	Removes all names and e-mail addresses from the AutoComplete list.	2010
/cleancategories	Deletes any custom category names that you have created. Restores categories to the default names.	2007, 2010
/cleanclientrules	Starts Outlook and deletes client-based rules.	2003, 2007, 2010
/cleanconvongoingactions	Deletes the Conversations Actions Table (CAT). CAT entries for a conversation thread usually expire 30 days after no activity. The command-line switch clears all conversation tagging, ignore, and moving rules immediately stopping any additional actions.	2010
/cleandmrecords	Deletes the logging records saved when a manager or a delegate declines a meeting.	2003, 2007, 2010
/cleanfinders	Removes Search Folders from the Microsoft Exchange server store.	2000, 2002/XP, 2003, 2007, 2010
/cleanfreebusy	Clears and regenerates free/busy information. This switch can only be used when you are able to connect to your Microsoft Exchange server.	2000, 2002/XP, 2003, 2007, 2010
/cleanfromaddress	Removes all manually added From entries from the profile.	2010
/cleanips	Restores receival of new messages in Exchange Cached mode (KB968773)	2007, 2010
/cleanprofile	Removes invalid profile keys and recreates default registry keys where applicable.	2003, 2007
/cleanpst	Launches Outlook with a clean Personal Folders file (.pst)	2003
/cleanreminders	Clears and regenerates reminders.	2000, 2002/XP, 2003, 2007, 2010
/cleanroamedprefs	All previous roamed preferences are deleted and copied again from the local settings on the computer where this switch is used. This includes the roaming settings for reminders, free/busy grid, working hours, calendar publishing, and RSS rules.	2007, 2010
/cleanrules	Starts Outlook and deletes client- and server-based rules.	2003, 2007, 2010
/cleanschedplus	Deletes all Schedule+ data (free/busy, permissions, and .cal file) from the server and enables the free/busy information from the Outlook Calendar to be used and viewed by all Schedule+ 1.0 users.	2000, 2002/XP, 2003
/cleanserverrules	Starts Outlook and deletes server-based rules.	2003, 2007, 2010
/cleansharing	Removes all RSS, Internet Calendar, and SharePoint subscriptions from Account Settings, but leaves all the previously downloaded content on your computer. This is useful if you cannot delete one of these subscriptions within Outlook 2010.	2010
/cleansniff	Deletes duplicate reminder messages.	2003, 2007, 2010
/cleansubscriptions	Deletes the subscription messages and properties for subscription features.	2003, 2007, 2010
/cleanviews	Restores default views. All custom views you created are lost.	2000, 2002/XP, 2003, 2007, 2010
/designer	Starts Outlook without figuring out if Outlook should be the default client in the first run.	2003
/embedding <msgfilename>	Opens the specified message file (.msg) as an OLE embedding. Also used without command-line parameters for standard OLE co-create.	2002/XP, 2003, 2007, 2010
/explorer	Opens the new window in “explorer” mode (link bar on).	2000, 2002/XP, 2003, 2007, 2010
/f <msgfilename>	Opens the specified message file (.msg) or Microsoft Office saved search (.oss). (Support for oss-files has been dropped since Outlook 2003 SP2 due to security restrictions)	2002/XP, 2003, 2007, 2010
/finder	Opens the Advanced Find dialog box.	2007, 2010
/firstrun	Starts Outlook as if it were run for the first time.	2003, 2007
/folder	Opens a new window in “folder” mode (Navigation Pane off).	2000, 2002/XP, 2003, 2007, 2010
/hol <holfilename.hol>	Opens the specified .hol file.	2003, 2007, 2010
/ical <icsfilename>	Opens the specified .ics file.	2003, 2007, 2010
/importprf path:\<filename.prf>	Launches Outlook and opens/imports the defined MAPI profile (*.prf). If Outlook is already open, queues the profile to be imported on the next clean launch.	2002/XP, 2003, 2007, 2010
/l <olkfilename>	Opens the specified .olk file.	2003
/launchtraininghelp assetid	Opens a Help window with the Help topic specified in assetid.	2003, 2007, 2010
/m emailname	Provides a way for the user to add an e-mail name to the item. Only works in conjunction with the `/c` command-line parameter. Example: `Outlook.exe /c ipm.note /m emailname`	2003, 2007, 2010
/nocustomize	Starts Outlook without loading outcmd.dat (customized toolbars) and *.fav file.	2003, 2007
/noextensions	Starts Outlook with extensions turned off, but listed in the Add-In Manager.	2003, 2007
/nopollmail	Starts Outlook without checking mail at startup.	2003
/nopreview	Starts Outlook with the Reading Pane off and removes the option from the View menu.	2000, 2002/XP, 2003, 2007, 2010
/p <msgfilename>	Prints the specified message (.msg). Prior to Outlook 2007, this does not work with HTML messages.	2002/XP, 2003, 2007, 2010
/profile <profilename>	Loads the specified profile. If your profile name contains a space, enclose the profile name in quotation marks (“).	2002/XP, 2003, 2007, 2010
/profiles	Opens the Choose Profile dialog box regardless of the Options setting on the Tools menu.	2002/XP, 2003, 2007, 2010
/recycle	Starts Outlook using an existing Outlook window, if one exists. Used in combination with /explorer or /folder.	2000, 2002/XP, 2003, 2007, 2010
/regserver	Rewrites all Outlook specific registry keys and re-associates file extensions without having to reinstall Outlook or run setup with the /y switch. The settings are stored in the Outlook.srg file located in the same folder as the Outlook program.	2000, 2002/XP
/remigratecategories	Starts Outlook and and initiates the following commands on the default mailbox: Upgrades colored For Follow Up flags to Office Outlook 2007 color categories. Upgrades calendar labels to Office Outlook 2007 color categories. Adds all categories used on non-mail items into the Master Category List. Note: This is the same command as Upgrade to Color Categories in each Outlook mailbox properties dialog box.	2007, 2010
/remigrateconversations		2010
/resetfoldernames	Resets default folder names (such as Inbox or Sent Items) to default names in the current Office user interface language.For example, if you first connect to your mailbox Outlook using a Russian user interface, the Russian default folder names cannot be renamed. To change the default folder names to another language such as Japanese or English, you can use this switch to reset the default folder names after changing the user interface language or installing a different language version of Outlook.	2002/XP, 2003, 2007, 2010
/resetfolders	Restores missing folders for the default delivery location.	2000, 2002/XP, 2003, 2007, 2010
/resetformregions	Empties the form regions cache and reloads the form region definitions from the Windows registry.	2007, 2010
/resetoutlookbar	Rebuilds the Outlook Bar.	2000, 2002/XP
/resetnavpane	Clears and regenerates the Navigation Pane for the current profile.	2003, 2007, 2010
/resetquicksteps	Restores the default Quick Steps. All user-created Quick Steps are deleted.	2010
/resetsearchcriteria	Resets all Instant Search criteria so that the default set of criteria is shown in each module.	2007, 2010
/resetsharedfolders	Removes all shared folders from the Navigation Pane.	2007, 2010
/resettodobar	Clears and regenerates the To-Do Bar task list for the current profile. The To-Do Bar search folder is deleted and re-created.	2007, 2010
/restore	Attempts to open the same profile and folders that were open prior to an abnormal Outlook shutdown.	2010
/rpcdiag	Opens Outlook and displays the remote procedure call (RPC) connection status dialog.	2003, 2007, 2010
/s <filename>	Loads the specified shortcuts file (.fav).	2002/XP, 2003
/safe	Starts Outlook without extensions, Reading Pane, or toolbar customization.	2000, 2002/XP, 2003, 2007, 2010
/safe:1	Starts Outlook with the Reading Pane off.	2003, 2007, 2010
/safe:2	Starts Outlook without checking mail at startup.	2003
/safe:3	Starts Outlook with extensions turned off, but listed in the Add-In Manager.	2003, 2007, 2010
/safe:4	Starts Outlook without loading Outcmd.dat (customized toolbars) and *.fav file.	2003, 2007
/select foldername	Starts Outlook and opens the specified folder in a new window. For example, to open Outlook and display the default calendar use: `"C:\Program Files\Microsoft Office\Office12\Outlook.exe" /select outlook:calendar`	2002/XP, 2003, 2007, 2010
/share feed://URL/filename /share stssync://URL /share web://URL/filename	Specifies a sharing URL to connect to Outlook. For example, use stssync://URL to connect a Microsoft Windows SharePoint Services 3.0 list to Outlook.	2007, 2010
/sniff	Starts Outlook and forces a detection of new meeting requests in the Inbox, and then adds them to the calendar.	2003, 2007, 2010
/t <oftfilename>	Opens the specified .oft file.	2003, 2007, 2010
/unregserver	Deletes all registry keys and file associations for Outlook. Its actions are based on the Outlook.srg file located in the same folder as the Outlook application. Use the /regserver switch to rewrite the registry keys and file associations after using this switch.	2000, 2002/XP
/v <vcffilename>	Opens the specified .vcf file.	2003, 2007, 2010
/vcal <vcsfilename>	Opens the specified .vcs file.	2003, 2007, 2010
/x <xnkfilename>	Opens the specified .xnk file.	2003, 2007

“Terminal Server Has Exceeded the Maximum Number of Allowed Connections” fix via Command line (CLI)

The terminal server has exceeded the maximum number of allowed connections. The system can not log you on. The system has reached its licensed logon limit. Please try again later.”

This problem happens because Windows only allows two remote terminal services connections when you are in administrative mode, and you’ve either got two people already on that server, or more likely, you’ve got a disconnected session that still thinks it

The terminal server has exceeded the maximum number of allowed connections. The system can not log you on. The system has reached its licensed logon limit. Please try again later.”

The problem with this error is that you have to actually get on the server console to fix the problem if the server isn’t in a domain. (If you are in a domain, then just open Terminal Services Manager and log off or disconnect the sessions)

Here’s a command line arguments that you can use to figure out what sessions are connected to the server. Note that you could substitute the IP address for the server name.

query session /server:servername

Output:

Now we know that the session ID of the offending session is 2. We can use that in the next step, which is using the reset command to log off that user.

reset session [ID] /server:servername

This command won’t display any output, but when we run the query command again, we should see that the session has now been disconnected:

Output:

I hope this helps to get you back in to your terminal sessions!

Enjoy…

There was a problem starting oobefldr.dll The specified module could not be found

After installing Windows 2008 R2 and then running the updates you start getting “There was a problem starting oobefldr.dll The specified module could not be found” being displayed as a error pop up when logging in to the desktop?

Just remove…
/HKCU/Software/Microsoft/Windows/Currentversion/Run/WindowsWelcomeCenter
Log off and back on and and messages are now gone!

Enjoy

After installing Windows 2008 R2 and then running the updates you start getting “There was a problem starting oobefldr.dll The specified module could not be found” being displayed as a error pop up when logging in to the desktop?

Just remove…

/HKCU/Software/Microsoft/Windows/Currentversion/Run/WindowsWelcomeCenter

Log off and back on and and messages are now gone!

Enjoy

Outlook Express “Compact Messages” pop-up

I have a user who every time they log in they get a pop up notice that Outlook Express needs to be compacted. They don’t use Outlook Express so why would it need to be compacted?

The short answer is that it does not. There is a issues with Windows Search indexing.

So here is the fix!

If you’re using Windows Search, right click the System Tray

I have a user who every time they log in they get a pop up notice that Outlook Express needs to be compacted. They don’t use Outlook Express so why would it need to be compacted?

The short answer is that it does not. There is a issues with Windows Search indexing.

So here is the fix!

If you’re using Windows Search, right click the System Tray icon, select Windows Search Options. When the Indexing Options dialog box appears, click the Modify button at the bottom. Find Microsoft Outlook Express in the list, clear the check box, click OK. Microsoft Outlook Express should no longer appear in the “Index these locations:” list. Close the dialog box.

After changing Windows Search Options, you may still have to reset the OE count.

Edit the registry manually to reset the counter manually:

1. Close Outlook Express and all message windows.
2. Click Start, click Run and type without quotes “regedit”.
3. Navigate to this key

HKEY_CURRENT_USER\Identities\{GUID}\Software\Microsoft\Outlook Express\5.0

where GUID is the long number used for your Identity.
4. In the right-hand pane, double-click “Compact Check Count”, then change the value to zero.
5. Close regedit and restart your computer.

Enjoy!!

Cleaning Up the Exchange 2003 Server’s SMTP Queues after NDR attacks

Warning: This process will delete all email that is due to go to external recipients. Internal messages are not affected, neither are new inbound messages from the Internet unless they are from the spammer continuing to try and abuse your server.

Capturing the Messages Into a Single Queue

This process requires an SMTP connector for all addresses. If you don’t already have one (with a * on the

Capturing the Messages Into a Single Queue

This process requires an SMTP connector for all addresses. If you don’t already have one (with a * on the namespace tab) then you need to create one using the instructions below.
If you already have an SMTP Connector with a * on the namespace tab, then you can use it for this process. You will need to adjust the settings as appropriate. You may wish to just make a note of the settings, delete the connector and create a new one for this process. When complete recreate your live connector.

In ESM, Connectors.
Find default SMTP connector, select properties and then select “Address Space” Edit the SMTP entry and make it a cost of 2.
Right click on connectors and choose New, SMTP Connector.
On the “General Tab” type a name for the connector. “Spam Cleanup” or similar.
Click the “Add” button under “Local Bridgeheads” and choose your Exchange server.
Click on the “Address Space” tab.
Click “Add” and choose SMTP. Leave each setting (* and cost of 1) and press ok.
If all the spam is to one domain, then you could remove the * and enter the domain that the messages are being sent to. This should leave legitimate messages in the queue.
Click on the General tab again. Change the option in the centre from DNS to “Forward all mail through this connector to the following smart hosts”.
Enter an invalid IP address in square brackets: [99.99.99.99].
Click on the “Delivery Options” tab and ensure that “Specify when messages are sent through this connector” is selected.
Change the option to 11pm. (If it is close to 11pm when you are doing this, use a much earlier time – 6am or similar. The time doesn’t matter as long as it is not close).
Press Apply/OK to close the SMTP Connector dialogue.
Restart SMTP Virtual Server.
1. Expand Servers, <your server>, Protocols, SMTP.
2. Right click on the “Default SMTP Virtual Server”
3. Choose “Stop”. This may take a few minutes.
4. Once it has stopped, right click again and choose “Start”.

The Exchange SMTP virtual server is now processing all the messages and placing them in to a single queue for your SMTP connector. This can take some time. You may want to wait until the number of messages in the queue stays constant before attempting the next stage.

Exchange 2000: The queues can be found in Servers, <your server>, Protocols, SMTP.

Exchange 2003: The queues can be found in Servers, <your server>, Queues.

Deleting the Messages

Now that the messages are in one queue, it is quite easy to delete them

Exchange 2003

Right click on this connector and choose “Find Messages”.
In the drop down box select the number of messages to be listed in the search.
Click “Find Now”.
Once the search is complete, select all of the messages (use the shift-page down key combination)
Then click “Delete all Messages (No NDR).

Exchange 2000

Right click on this connector and choose “Delete All Message (No NDR)”
Select Yes when asked if you want to delete all the messages in the queue.

Once the messages have been deleted, which could take some time, refresh the queues to ensure that they don’t continue to build. If they do then Exchange is still processing the messages. You will need to repeat the procedure to delete more messages until the queues are completely clear and stay at zero.

Once you have flushed out the messages, undo the changes that you have made.

If it was a new SMTP connector, delete it.
If you adjusted an existing connector, put the settings back how they were. Don’t forget the time on the “Delivery Options” tab. it should be “Always Run”.

Finally restart SMTP virtual server to get Exchange to start using the new settings.