Exchange Server: How to diagnose spam problem
August 20, 2013, 8:29 amThis article is on how to get a clear status of the spam you receive on your Exchange Server
Scenario: A user call-in and told that another user from another company can’t contact him. The email got refused.
Task 1: Investigate to be sure it’s at our door we stop him.
-
Check the source email
- Check inside if the answer he got was from us.
- YES: Skip to Task 2 below
- NO:
- Does he use is ISP as a smarthost ?
- YES:
- Does it’s is smarthost that refuse to send the email ?
- That case happen when the smarthost check RBL list to be sure he does not forward from an unsecure source. Most of the time it happen when a site got infected by a malware/virus that mass spam. In that case please check the IP listed in the email. The WAN IP would be blacklisted in RBL. The other company must then ask to be delisted if he eliminated the source of the problem. At this point it’s no longer a problem we can assist with.
- NO:
- Do you use an external antispam service?
- YES:
- Check the log on your management interface.
- NO:
- The DNS from the remote site is properly configured? A bad MX record from the remote DNS server could lead to a mail send error.
Task 2: Get to know the AntiSpam filter rules.
- Check the source email
- Check the error returned.
- If it’s an error you think it was correct to flag, then advise the user that the remote company must correct something. (He’s on RBL, he relay, he got a bad SCL because of a badly wrote email, etc…)
- If you are unsure that it was flagged spam for a good reason, check more deeper. Skip to Task 3
- An example in Exchange 2010;
- 
Task 3: With the rule we check, start to investigate the issue deeper.
- Check your agent log to see the real cause of the rejection:
-
Issue the powershell command; Get-AgentLog |?{ (\$_.p1fromaddress -match "contoso.com" –or \$_.p2fromaddresses -match " contoso.com ") -and \$_.action –eq "RejectMessage"} (I suggest to redirect the output to a text file (with > log.txt))
- In the text file you will log like that in example;
-
- Timestamp : XXXX-XX-XX XX:XX:XX
SessionId : XXXXXXXXXXXXXXXX
IPAddress : X.X.X.X
MessageId :
P1FromAddress : test@contoso.com
P2FromAddresses : {test@contoso.com}
Recipients : {test@contoso.com}
Agent : Sender Id Agent
Event : OnEndOfHeaders
Action : RejectMessage
SmtpResponse : 550 5.7.1 Missing purported responsible address
Reason : MissingPRA
ReasonData : No valid PRA
Diagnostics :
- Timestamp : XXXX-XX-XX XX:XX:XX
- From there diagnose and change your antispam feature if you can.
Task 4: Reporting script.
Get-AntispamFilteringReport.ps1 : Get a general report for what agent block the most.
Get-AntispamSCLHistogram.ps1 : Retrieve a chart with SCL value for spam received.
Get-AntispamTopBlockedSenderDomains.ps1 : Retrive the Top Blocked Sender domains. Don’t forget it can be forged domain. The SenderID antispam feature help us there.
Get-AntispamTopBlockedSenderIPs.ps1 : Retrieve the top IP that send us spam. If you got big number there you can list the IP in a block rule in the antispam feature or block it in the router directly. To prevent a RBL check each time on the IP.
Get-AntispamTopBlockedSenders.ps1 : Retrieve the top sender.
Get-AntispamTopRBLProviders.ps1 : Retrieve what RBL block the most. Use that chart before remove a RBL. Some RBL are too strict sometime, but removing it can cause a lot of spam to actually enter. When a user call, it’s the dilemma to accept one email versus what the RBL block.
Get-AntispamTopRecipients.ps1 : Top users that receive spam.
Apply to
Exchange 2007
Exchange 2010
Exchange 2013
Exchange 2013 Setup Error: setupui.exe - CLR20r3
August 14, 2013, 7:54 amIssue
Error when lauching the Exchange 2013 setup. setupui.exe crash with a reference to CLR20r3
Cause
A firewall state could cause that problem. In my case a GPO setting was the problem.
Workaround
Desactivate the GPO or reactivate the firewall, and voila the setup should start.
Directory Service: NETLOGON missing after a restore
August 8, 2013, 11:11 amSymptoms
SYSVOL empty but share existant. NETLOGON share non-existant GPO's console list all old GPO, but can't display any detail on all GPO.
Scenario
First DC (DC#1) in Windows 2003
Second DC (DC#2) in Windows 2008R2
Each are Global Catalogue.
DC#1 is old, no longer in the backup schedule. DC#2 got all FSMO's role and is the primary DC.
Problem;
The datastore die. We restore the the system-state from DC#2, and we find ourselft faced with the FAQ that the SYSVOL is empty.
From the tape we found that the SYSVOL was not replicating, so it seem an issue that the SYSVOL does not replicating when you have a 2003 and you DCPROMO an 2008's DC.
How to
First step done is that;
After that test, the folder was still empty.
So the final test was simple.
I created the scripts folder in the c:windowsSYSVOLSYSVOLdomain.nameSCRIPTS and shared it to NETLOGON and runned : DCGPOFIX
That reset/recreate the default domain policy, and after you just need to erase all old GPO that are still empty in your console.
Thanks everyone !
nb; Article published in the TNWiki there too : http://social.technet.microsoft.com/wiki/contents/articles/17478.directory-service-netlogon-missing-after-a-restore.aspx
SAN Dell Equallogic firmware flaw
May 21, 2013, 11:03 pmHi everyone
For the second times in less than 4 years I saw a Equallogic dying...
The first time the SAN was running on a 4.x firmware. One disk spread the corruption to the whole unit. Following Dell advice we updated everything, as the 5.0.x firmware resolved that case.
Another similar crash, the SAN is on 5.0.x firmware and now they tell us that this bug was actually corrected on 5.2.5's firmware. How come no release note or anything. The only detail we got is that the bug happen when the array is full of seagate hdd, why seagate hdd ? I have no idea either.
So if you use a Equallogic, update it if you can to 5.2.5. I know 6.1 is out but not supported for some hypervisors, so please check your hypervisor HCL before gooing up too much.
And be sure to be subscribed to the maintenance pack, else you can't get new firmware....
So be sure to have a good backup... because the SAN actually does not boot with a fail array (no GUI) so only thing left to do in the CLI it's a "reset" wich clear the whole RAID50 directly. After the GUI work when you resetup the member configuration.
******** UPDATE *********
I now know more the truth behind the firmware 5.2.8. The rebuild was too long on some HDD model, so the SAN do a disk image of another disk to it in place of the rebuild. The disk firmware is there to allow that.
The saga of the Bad Keyboard Layout (XenDesktop 5+ + DesktopAppliance) (CTX coming for that bug)
May 17, 2013, 10:41 pmHi everyone
Today I will post about a big bug. Seem a easy's one, but it took 2 Tier 3 support technician from Citrix and 1 dev from Citrix to get a workaround :-) (Not to forget the support case with Wyse !)
I got a workaround, no fix !
WHAT WAS WORKING:
In XenDesktop 4 with a Desktop Appliance the Keyboard Layout in the Virtual Desktop is handled as (Server Default)'s always.
The setup;
- The user profile, with Citrix UPM (like a roaming profile) is configured with a French Canada's profile.
- The default's one in the Preload's section is configured with French Canada too.
- The Wyse/Desktop Appliance/Endpoint Device with a Citrix Receiver got configured with any Keyboard Layout.
So the client connect from anywhere in the world, and the keyboard layout in it's Virtual Desktop is the one from it's profile.
BUG:
If you update the Virtual Desktop to install the Citrix VDA's Agent and Core Service to version 5 and more, it now do a keyboard importation from the device.
Seem a easy's one you will told me, but what if Wyse didn't coded the right Keyboard Layout for like French Canada ?
Bug like that appear;
So you clearly see the bug, the French (Canada) got bypassed by that "Canadian Multilingual Standard". So you will tell me, wait, you did put that setting in the Wyse, but no !
WORKAROUND...
The one I did myselft before contacting the support...;
A script in the start-up menu in the All Users: (I call the .bat that way to hide the windows)
Set oWshShell = CreateObject("WScript.Shell")
oWshShell.Run "c:Import.bat", 0, True
Import.bat:
reg import c:kb.reg
rundll32.exe shell32,Control_RunDLL intl.cpl,,/f:"c:kb.txt"
-There the first line do import the correct Preload key
-Now the second line simulate a click in the control panel to change the setting
kb.reg:
Windows Registry Editor Version 5.00
[-HKEY_CURRENT_USERKeyboard LayoutIMEtoggle] [-HKEY_CURRENT_USERKeyboard LayoutPreload] [-HKEY_CURRENT_USERKeyboard LayoutSubstitutes] [-HKEY_CURRENT_USERKeyboard LayoutToggle]
[HKEY_CURRENT_USERKeyboard Layout]
[HKEY_CURRENT_USERKeyboard LayoutIMEtoggle]
[HKEY_CURRENT_USERKeyboard LayoutIMEtogglescancode]
[HKEY_CURRENT_USERKeyboard LayoutPreload] "1"="00001009"
[HKEY_CURRENT_USERKeyboard LayoutSubstitutes]
[HKEY_CURRENT_USERKeyboard LayoutToggle] "Hotkey"="3" "Language Hotkey"="3" "Layout Hotkey"="3"
[HKEY_CURRENT_USERControl PanelDesktop] "MultiUILangageId"="00001009"
kb.txt:
[RegionalSettings]
LanguageGroup=1
InputLocale = 0c0c:00001009
OK, BUG#2 after that. Because, if my workaround would had work at 100% I would had not call the support...
In the initial login the script work and that all ok, the users see nothing wrong. The bug come after a period, the VDA's agent seem to refresh it's settings.
So in the day, usually 3-4 hours after the bad keyboard come out again. The bug appear less, because some users works in TS session like from XenApp, so their keyboard is ok. Some users see the bug when they try to edit some local text or in some local app.
WORKAROUND #2
You erase the wrong keyboard layout folder from there;
HKEY_LOCAL_MACHINESYSTEMCURRENTCONTROLSETCONTROLKEYBOARD LAYOUTS
Seem to work, but WAIT, in the refresh period the bad keyboard layout come back agains ! ark.
So, in the final the correct workaround is to set the correct ACL for the folder, only domain admin read, every other including SYSTEM with DENY's flag. (so you does not erase it)
Thanks everyone, I hope it will help other.
As clearly we CAN'T stop that importation with the new VDA,s agent 5 and more and that leave the Virtual Desktop easy to break by Receiver or Appliance that does not follow the correct key to use.