IT Guys, Exchange 2003 Question

Well we got hit by some sort of spam bot and im left cleaning up the mess. I am new on the job here and everything was setup by external IT consultants, yes its a BIG mess.

As I am cleaning up I found that authentication for SMTP is set for anonymous access. They also checked everything else as well (basic and integrated).

I want to remove the anonymous but im not sure what will break, researching online didnt give me the answer I was looking for.

Hopefully someone here can help

Thanks

Seems like the best place to ask.

Originally Posted by Carskibum

Seems like the best place to ask.

This forum has a lot of smart IT folks, they helped in the past!

Originally Posted by Nt_loader

Well we got hit by some sort of spam bot and im left cleaning up the mess. I am new on the job here and everything was setup by external IT consultants, yes its a BIG mess.

As I am cleaning up I found that authentication for SMTP is set for anonymous access. They also checked everything else as well (basic and integrated).

I want to remove the anonymous but im not sure what will break, researching online didnt give me the answer I was looking for.

Hopefully someone here can help

Thanks

Under Relay are you restricting to only local machines?

Originally Posted by CortinaD

Under Relay are you restricting to only local machines?

No I unchecked the box, The only thing enabled on that scree is "relay only for the following IP's" and nothing is listed in that window.

Thanks

Exchange 2003 does provide the ability for client-side users to recognize spoofed mail by displaying the actual SMTP address of nonauthenticated mail as opposed to the display name as it appears in the global address list (GAL). However, disabling anonymous SMTP access on all internal Exchange servers is recommended. The Outlook behavior concerning nonauthenticated (or potentially spoofed) mail is subtle. It takes an attentive and experienced user to recognize that an actual SMTP address means that the sender did not authenticate. Therefore, disabling anonymous access ensures that only authenticated users can submit messages within your organization. Additionally, requiring authentication forces client programs such as Outlook Express and Outlook in Internet Mode (Post Office Protocol version 3, or POP3, or Internet Message Access Protocol version 4rev1, or IMAP4) to authenticate before sending mail.

You can most likely turn it off.

I take that back. It depends if people are accessing the server using phones without proper settings.

Originally Posted by Tauce says

You can most likely turn it off.

I take that back. It depends if people are accessing the server using phones without proper settings.

Ok well I turned it off (un-checked) the anonymous option. So far so good, no calls to the help desk but its also closer to the end of the day.

We will hope for the best and fix issues as they come up tomorrow. If phones are setup incorrectly we will switch them over to active sync, that should fix it.

Thanks for the help everyone

Looks like we stopped receiving external email after I removed the anonymous check box, I put it back and mail started flowing again.

I think external servers could not auth with us if that option is not checked. (Guessing here)