Article ID: 917309
Article Last Modified on 10/30/2007
APPLIES TO
- Microsoft Exchange Server 2003 Service Pack 2
SYMPTOMS
You upgrade computers that are running Microsoft Exchange 2000 Server or Microsoft Exchange Server 2003 Service Pack 1 (SP1) to Microsoft Exchange Server 2003 Service Pack 2 (SP2). After you do this, the Simple Mail Transfer Protocol (SMTP) connectors that you previously configured between your routing groups no longer transfer messages between those routing groups.
Additionally, the following event appears in the Application log in Event Viewer:
Event Type: Warning
Event Source: MSExchangeTransport
Event Category: SMTP Protocol
Event ID: 1709
Date: date
Time: time
User: N/A
Computer: server name
Description: The SMTP client" IP Address " did not authenticate before attempting to send mail. Access was denied.
Data: 0000: 05 00 07 80 ...€
CAUSE
This problem occurs when the following conditions are true:
- You have configured an SMTP connector to an SMTP virtual server that is not the default SMTP virtual server.
- This SMTP connector does not have a routing group that is connected to other routing groups.
- You have turned off anonymous access for this SMTP connector.
X-EXPS Kerberos authentication is not performed for a virtual server whose name does not match the fully qualified domain name (FQDN) or the NetBIOS name of the computer. This is true for Exchange 2000 Server Service Pack 3 (SP3), for Exchange Server 2003, and for Exchange Server 2003 service packs.
RESOLUTION
Hotfix information
A supported hotfix is now available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next service pack that contains this hotfix.
To resolve this problem, submit a request to Microsoft Online Customer Services to obtain the hotfix. To submit an online request to obtain the hotfix, visit the following Microsoft Web site:
Note If additional issues occur or any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. To create a separate service request, visit the following Microsoft Web site:
Hotfix installation information
You must apply the hotfix on the computers that are hosting the SMTP connectors. After you apply this hotfix, you must set a bit in the heuristics field of the Active Directory connector object. This action will cause Exchange Server 2003 to revert to the authentication behavior from Exchange 2000 Server Service Pack 2 (SP2).
When you set this bit to the value that is specified, the connector is considered to be internal to the routing group, and EXPS authentication is enabled. Use the Active Directory Service Interfaces (ADSI) Edit snap-in to enable EXPS authentication.
Warning If you use the ADSI Edit snap-in, the LDP utility, or any other LDAP version 3 client, and you incorrectly modify the attributes of Active Directory objects, you can cause serious problems. These problems may require you to reinstall Microsoft Windows 2000 Server, Microsoft Windows Server 2003, Microsoft Exchange 2000 Server, Microsoft Exchange Server 2003, or both Windows and Exchange. Microsoft cannot guarantee that problems that occur if you incorrectly modify Active Directory object attributes can be solved. Modify these attributes at your own risk.
- Click Start, click Run, type adsiedit.msc in the Open box, and then click OK.
Note The ADSI Edit snap-in is included with the Microsoft Windows Server 2003 Support Tools. To install the Windows Server 2003 Support Tools, run the Setup.exe program from the Support\Tools folder on the Windows Server 2003 CD.
- Expand Configuration Container [
servername.yourdomain.root_domain], expand CN=Configuration,DC=Your_Domain,DC=Root_Domain, expand CN=Services, expand CN=Microsoft Exchange, expand CN=Organization Name, expand CN=Administrative Groups, expand CN=First Administrative Group Name, expand CN=Routing Groups, expand CN=First Routing Group Name, and then click CN=Connections. - In the right pane, right-click the locally scoped SMTP connector item, and then click Properties.
- In the Select which properties to view list, click Both.
- In the Select a property to view list, click heuristics.
- In the Edit Attribute box, type 16384 (4000 hexadecimal), and then click Set.
- Click Apply, and then click OK.
- Exit the ADSI Edit snap-in.
Important When you set this bit to the value that is specified, Exchange Server considers the SMTP connector to be internal to the routing group if the connector is not configured to use direct Domain Name System (DNS). Therefore, EXPS authentication is enabled.
The SMTP connector is not configured to use direct DNS when the Use DNS to route to each address space on this connector option is not selected in the connector_name Properties dialog box in Exchange System Manager.
If the connector is configured to use DNS to route to each address space, external EXPS is disabled. This is true even if you use the previous steps to set the heuristics bit to enable external EXPS on the connector.
Note External EXPS is disabled because a direct DNS relay on a connector relays mail to DNS names that coincide with the domain part of the SMTP address. In that scenario, a malicious external user could receive your EXPS authentication information.
Prerequisites
You must install Microsoft Exchange Server 2003 Service Pack 2 (SP2) before you apply the hotfix.
For more information, click the following article number to view the article in the Microsoft Knowledge Base:
836993 How to obtain the latest service packs for Exchange Server 2003
Restart requirement
You do not have to restart the computer after you apply the hotfix.
Hotfix replacement information
This hotfix does not replace any other hotfixes.
File information
The global version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.
| File name | File version | File size | Date | Time | Platform |
|---|---|---|---|---|---|
| Reapi.dll | 6.5.7651.17 | 835,584 | 19-Apr-2006 | 08:00 | x86 |
| Resvc.dll | 6.5.7651.17 | 325,632 | 19-Apr-2006 | 08:00 | x86 |
STATUS
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.
MORE INFORMATION
For more information about the terminology that Microsoft uses for software that is corrected after it is released, click the following article number to view the article in the Microsoft Knowledge Base:
824684 Description of the standard terminology that is used to describe Microsoft software updates
For more information about the naming schema for Exchange software updates, click the following article number to view the article in the Microsoft Knowledge Base:
817903 New naming schema for Exchange Server software update packages
For more information about a hotfix for Exchange 2000 Server Service Pack 3 (SP3), click the following article number to view the article in the Microsoft Knowledge Base: -
818530 SMTP routing group connectors do not permit message transfer after you upgrade from Exchange 2000 Service Pack 2 to Exchange 2000 Service Pack 3
For more information about a hotfix for Exchange Server 2003 Service Pack 1 (SP1), click the following article number to view the article in the Microsoft Knowledge Base:
898905 SMTP connectors no longer transfer messages after you upgrade from Exchange 2000 Server to Exchange Server 2003
Additional query words: XCON
Keywords: kbhotfixserver kbqfe kbfix kbbug kbpubtypekc KB917309
