XFOR: How to Disable Support for VRFY Command in MCIS (247346)

SUMMARY

Microsoft Commercial Internet Server (MCIS) 2.0 responds to incoming Verify (VRFY) commands issued by other servers, by default. It responds to this command by verifying if such a user exists in the domain. In some situations, the administrator may like to disable this feature. This article describes how to prevent MCIS from providing information about the users by disabling the Verify command.

MORE INFORMATION

To disable the Verify command of MCIS 2.0 SMTP service, you need to make changes to the local metabase database on the MCIS server:

Open a command prompt, and change directory to %SystemRoot%\System32\Inetsrv\Adminsamples.

NOTE: %SystemRoot% is usually Winnt on most systems.
Type in the following command:
adsutil.vbs enum /p smtpsvc
If this is the first time you have run this script, or if your script interpreter is set to wscript, you will be prompted to associate this script with cscript. Click OK to associate the script with cscript, and run the above command again.
As the result of the above command, your SMTP sites will be displayed. Typically, there are only two lines listed. The /1 listed is your default site. To change the VRFY functionality for the default site, you need to use /1 in step 4 as shown below.
Run the following command at the command prompt:
adsutil.vbs set smtpsvc/1/allowverify false
This changes the metabase to disable the VRFY option.

The response from the server changes as a result of the preceding changes. This prompts MCIS to respond with the following:

252 Cannot VRFY user, but will take message for <user@domain.com>