SMTP connectors no longer transfer messages after you upgrade from Exchange 2000 Server to Exchange Server 2003 (898905)


The information in this article applies to:

  • Microsoft Exchange Server 2003 Enterprise Edition
  • Microsoft Exchange Server 2003 Standard Edition

SYMPTOMS

You upgrade computers that are running Microsoft Exchange 2000 Server to Microsoft Exchange Server 2003 or Microsoft Exchange Server 2003 Service Pack 1 (SP1). After you do this, the Simple Mail Transfer Protocol (SMTP) connectors that you previously configured between your routing groups no longer transfer messages between those routing groups.

Additionally, the following event appears in the Application log in Event Viewer: Event Type: Warning
Event Source: MSExchangeTransport
Event Category: SMTP Protocol
Event ID: 1709
Date: date
Time: time
User: N/A
Computer: server name
Description: The SMTP client" IP Address " did not authenticate before attempting to send mail. Access was denied.
Data: 0000: 05 00 07 80 ...?

CAUSE

This problem occurs when the following conditions are true:
  • You have configured an SMTP connector to an SMTP virtual server that is not the default SMTP virtual server.
  • This SMTP connector does not have a routing group that is connected to other routing groups.
  • You have turned off anonymous access for this SMTP connector.
X-EXPS Kerberos authentication is not performed to a virtual server whose name does not match the fully qualified domain name (FQDN) or the NetBIOS name of the computer. This is true for Exchange 2000 Server Service Pack 3 (SP3), for Exchange Server 2003, and for Exchange Server 2003 service packs.

RESOLUTION

Hotfix information

A supported hotfix is now available from Microsoft, but it is only intended to correct the problem that is described in this article. Only apply it to systems that are experiencing this specific problem. This hotfix may receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next Exchange Server 2003 service pack that contains this hotfix.

To resolve this problem immediately, contact Microsoft Product Support Services to obtain the hotfix. For a complete list of Microsoft Product Support Services telephone numbers and information about support costs, visit the following Microsoft Web site:

http://support.microsoft.com/contactus/?ws=support

Note In special cases, charges that are ordinarily incurred for support calls may be canceled if a Microsoft Support Professional determines that a specific update will resolve your problem. The usual support costs will apply to additional support questions and issues that do not qualify for the specific update in question.

Hotfix installation information

You must apply the hotfix on the computers that are hosting the SMTP connectors. After you apply this hotfix, you must set a bit in the heuristics field of the Active Directory connector object. This action will cause Exchange Server 2003 to revert to the authentication behavior from Exchange 2000 Server Service Pack 2 (SP2).

When you set this bit to the value that is specified, the connector is considered to be internal to the routing group, and EXPS authentication is enabled. Use the Active Directory Service Interfaces (ADSI) Edit snap-in to enable EXPS authentication.

Warning If you use the ADSI Edit snap-in, the LDP utility, or any other LDAP version 3 client, and you incorrectly modify the attributes of Active Directory objects, you can cause serious problems. These problems may require you to reinstall Microsoft Windows 2000 Server, Microsoft Windows Server 2003, Microsoft Exchange 2000 Server, Microsoft Exchange Server 2003, or both Windows and Exchange. Microsoft cannot guarantee that problems that occur if you incorrectly modify Active Directory object attributes can be solved. Modify these attributes at your own risk.
  1. Click Start, click Run, type adsiedit.msc in the Open box, and then click OK.

    Note The ADSI Edit snap-in is included with the Microsoft Windows Server 2003 Support Tools. To install the Windows Server 2003 Support Tools, run the Setup.exe program from the Support\Tools folder on the Windows Server 2003 CD.
  2. Expand Configuration Container [servername.yourdomain.root_domain], expand CN=Configuration,DC=Your_Domain,DC=Root_Domain, expand CN=Services, expand CN=Microsoft Exchange, expand CN= Organization Name, expand CN=Administrative Groups, expand CN= First Administrative Group Name, expand CN=Routing Groups, expand CN= First Routing Group Name, and then click CN=Connections.
  3. In the right pane, right-click the locally scoped SMTP connector item, and then click Properties.
  4. In the Select which properties to view list, click Both.
  5. In the Select a property to view list, click heuristics.
  6. In the Edit Attribute box, type 16384 (4000 hexadecimal), and then click Set.
  7. Click Apply, and then click OK.
  8. Exit the ADSI Edit snap-in.
Important When you set this bit to the value that is specified, Exchange Server considers the SMTP connector to be internal to the routing group if the connector is not configured to use direct Domain Name System (DNS). Therefore, EXPS authentication is enabled.

The SMTP connector is not configured to use direct DNS when the Use DNS to route to each address space on this connector option is not selected in the connector_name Properties dialog box in Exchange System Manager.

If the connector is configured to use DNS to route to each address space, external EXPS is disabled. This is true even if you use the previous steps to set the heuristics bit to enable external EXPS on the connector.

Note External EXPS is disabled because a direct DNS relay on a connector relays mail to DNS names that coincide with the domain part of the SMTP address. In that scenario, a malicious external user could receive your EXPS authentication information.

Prerequisites

You must install Microsoft Exchange Server 2003 Service Pack 1 (SP1) before you apply the hotfix. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

836993 How to obtain the latest service packs for Exchange Server 2003

Restart requirement

You do not have to restart the computer after you apply the hotfix.

Hotfix replacement information

This hotfix does not replace any other hotfixes.

File information

The global version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.
File nameFile versionFile sizeDateTimePlatform
Reapi.dll6.5.7234.2832,00017-Feb-200604:37x86
Resvc.dll6.5.7234.2326,65617-Feb-200604:37x86

STATUS

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

MORE INFORMATION

For more information, click the following article numbers to view the articles in the Microsoft Knowledge Base:

824684 Description of the standard terminology that is used to describe Microsoft software updates

817903 New naming schema for Exchange Server software update packages

For more information about a hotfix for Exchange 2000 Server Service Pack 3 (SP3), click the following article number to view the article in the Microsoft Knowledge Base:

818530 SMTP routing group connectors do not permit message transfer after you upgrade from Exchange 2000 Service Pack 2 to Exchange 2000 Service Pack 3

Modification Type:MinorLast Reviewed:7/24/2006
Keywords:kbHotfixServer kbExchange2003sp1fix kbQFE kbfix kbBug kbpubtypekc KB898905 kbAudITPRO
©2004 Microsoft Corporation. All rights reserved.