locked
The delivery of a message sent by public folder x has failed. To: bogus Cc: The non-delivery report has been deleted. RRS feed

  • Question

  • Hi,

    Our monitoring system has begun sending us a lot of events like The delivery of a message sent by public folder x has failed. To: bogus Cc: The non-delivery report has been deleted. I believe what is happening is that a spammer is using the address of one of our mail-enabled public folders in the From: address, then when the NDR is generated by their target host it is sent back to our public folder. Since Exchange doesn't accept NDRs to mail enabled public folders this message is generated.

    How can I prevent these messages from being logged in Exchange 2007 or send the NDRs to a dummy mailbox, etc.

    Anything to keep them from being sent into our monitoring system =)

    thank you.

    Saturday, September 10, 2011 3:47 PM

Answers

  • Process:

    1.      Get dummy mailbox’s DistinguishedName with the cmdlet below

    Get-User “User A” | Fl DistinguishedName

    2.      Launch ADSI Editor, go to “CN=Microsoft Exchange System Objects”, right-click the mail-enabled PF1 object, and then go to “Properties”

    3.      In the “Attribute Editor” tab, locate “publicDelegates” attribute, and then copy dummy mailbox’s DistinguishedName into it

    • Marked as answer by Alan.Gim Tuesday, September 27, 2011 1:17 AM
    Monday, September 19, 2011 2:24 AM

All replies

  • On Sat, 10 Sep 2011 15:47:09 +0000, aweaver6142 wrote:
     
    >
    >
    >Hi,
    >
    >Our monitoring system has begun sending us a lot of events like The delivery of a message sent by public folder x has failed. To: bogus Cc: The non-delivery report has been deleted. I believe what is happening is that a spammer is using the address of one of our mail-enabled public folders in the From: address, then when the NDR is generated by their target host it is sent back to our public folder. Since Exchange doesn't accept NDRs to mail enabled public folders this message is generated.
    >
    >How can I prevent these messages from being logged in Exchange 2007 or send the NDRs to a dummy mailbox, etc.
    >
    >Anything to keep them from being sent into our monitoring system =)
     
    Rather than ask how to prevent Exchange from recording a legitimate
    event, why not ask your monitoring system to ignore the event?
     
    ---
    Rich Matheisen
    MCSE+I, Exchange MVP
     

    --- Rich Matheisen MCSE+I, Exchange MVP
    Saturday, September 10, 2011 4:30 PM
  • On Sat, 10 Sep 2011 15:47:09 +0000, aweaver6142 wrote:
     
    >
    >
    >Hi,
    >
    >Our monitoring system has begun sending us a lot of events like The delivery of a message sent by public folder x has failed. To: bogus Cc: The non-delivery report has been deleted. I believe what is happening is that a spammer is using the address of one of our mail-enabled public folders in the From: address, then when the NDR is generated by their target host it is sent back to our public folder. Since Exchange doesn't accept NDRs to mail enabled public folders this message is generated.
    >
    >How can I prevent these messages from being logged in Exchange 2007 or send the NDRs to a dummy mailbox, etc.
    >
    >Anything to keep them from being sent into our monitoring system =)
     
    Rather than ask how to prevent Exchange from recording a legitimate
    event, why not ask your monitoring system to ignore the event?
     
    ---
    Rich Matheisen
    MCSE+I, Exchange MVP
     

    --- Rich Matheisen MCSE+I, Exchange MVP


    I don't see the point in an event being created for something which has no operational value especially considering there is no way to change the behaviour.

     

    Saturday, September 10, 2011 4:32 PM
  • On Sat, 10 Sep 2011 16:32:37 +0000, aweaver6142 wrote:
     
    >On Sat, 10 Sep 2011 15:47:09 +0000, aweaver6142 wrote: > > >Hi, > >Our monitoring system has begun sending us a lot of events like The delivery of a message sent by public folder x has failed. To: bogus Cc: The non-delivery report has been deleted. I believe what is happening is that a spammer is using the address of one of our mail-enabled public folders in the From: address, then when the NDR is generated by their target host it is sent back to our public folder. Since Exchange doesn't accept NDRs to mail enabled public folders this message is generated. > >How can I prevent these messages from being logged in Exchange 2007 or send the NDRs to a dummy mailbox, etc. > >Anything to keep them from being sent into our monitoring system =) Rather than ask how to prevent Exchange from recording a legitimate event, why not ask your monitoring system to ignore the event? --- Rich Matheisen MCSE+I, Exchange MVP
    >--- Rich Matheisen MCSE+I, Exchange MVP
    >
    >I don't see the point in an event being created for something which has no operational value especially considering there is no way to change the behaviour.
     
    Nor do I see the point in alerting on unnecessary events.
     
    ---
    Rich Matheisen
    MCSE+I, Exchange MVP
     

    --- Rich Matheisen MCSE+I, Exchange MVP
    Saturday, September 10, 2011 5:08 PM
  • The only workaround I know is to use the “publicDelegates” attribute. For example:

    There’re a dummy mailbox and a public folder called PF1, we can put dummy mailbox’s distinguishedName into the “publicDelegates” attribute of PF1 so that dummy mailbox will receive the NDR

    James Luo

    Forum Support

    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    • Proposed as answer by Alan.Gim Wednesday, September 14, 2011 1:40 AM
    Monday, September 12, 2011 7:01 AM
  • James, how do you do this and what are the drawbacks?

     

    Wednesday, September 14, 2011 11:58 AM
  • Process:

    1.      Get dummy mailbox’s DistinguishedName with the cmdlet below

    Get-User “User A” | Fl DistinguishedName

    2.      Launch ADSI Editor, go to “CN=Microsoft Exchange System Objects”, right-click the mail-enabled PF1 object, and then go to “Properties”

    3.      In the “Attribute Editor” tab, locate “publicDelegates” attribute, and then copy dummy mailbox’s DistinguishedName into it

    • Marked as answer by Alan.Gim Tuesday, September 27, 2011 1:17 AM
    Monday, September 19, 2011 2:24 AM
  • We are seeing the exact same issue on Exchange 2010. 

    Get-User “User A” | Fl DistinguishedName is returning the result stating the user wasnot found.

    Please help...


    Thursday, November 29, 2012 1:10 PM