Why do certain emails not get sent ?

A few days ago our small business server 2003 started to have problems with
certain outbound emails. Some get through fine but some just keep reporting
as smtp: started outbound transfer of message. The next line then reads:
message transferred to through smtp. (when I do a message trace). These
entries in the message trace just keep reocurring. We have server reports
showing: a large number of messages are pending in the email server send
queue .

How do I find this queue and and why do some get sent ok and some not ?

Any help greatly appreciated
Craig C

The queue is easy to find. In Server Management:

* Navigate to Advanced Management | First Organization (Exchange) |
Servers | <yourserver> | Queues.

Are you sending directly (CEICW: "Use DNS to route e-mail") or via a
smarthost (CEICW: "Forward all e-mail to e-mail server at your ISP")?
If you are using a smarthost, it may have a maximum message size (for
example, 2 megabytes) and certain messages you are trying to send may be
larger than that. Those are blocked, the smaller ones go through.

-- Owen Williams (SBS MVP)

In article <87FCB774-96D3-4733-987E->,
says...
> A few days ago our small business server 2003 started to have problems with
> certain outbound emails. Some get through fine but some just keep reporting
> as smtp: started outbound transfer of message. The next line then reads:
> message transferred to through smtp. (when I do a message trace). These
> entries in the message trace just keep reocurring. We have server reports
> showing: a large number of messages are pending in the email server send
> queue .
>
> How do I find this queue and and why do some get sent ok and some not ?
>
> Any help greatly appreciated
> Craig C

Hi Craig,

Thank you posting here.

From your problem description, I understand this issue to be: A large
number of messages are pending in the e-mail server send queue. If I am off
base, please do not hesitate to let me know.

For this issue, we have to know what messages are in the pending submission
queue first. Please start ''Exchange System Manager'' and expand to Queues
under your Exchange Server. Please check if there are any messages stuck in
the specific queue. If so, is it the "Messages pending submission" queue?
Please check where these messages are sent from and will be sent to. Is the
sender address or destination address in your email organization? Please
also check "Additional queue information" in the right pane to see the
possible reason why the e-mails queued up there. Please paste the
information back here.

The most possible cause is the Exchange SMTP server is set to open relay. I
would like to suggest checking this settings via the following KB article.

324958 HOW TO: Block Open SMTP Relaying and Clean Up Exchange Server SMTP
http://support.microsoft.com/?id=324958


In addition, I would think this is an NDR attack issue. Spammers have a new
means to avoid filters built into many systems. They take advantage of a
mail systems sending of a non-delivery report (NDR) when a message cannot
be delivered as addressed and returns the original contents. Since this
follows the RFC standard, most all mail servers will function this way.
This is what is called a "Reverse NDR attack" (RNDR). This form of attack
is becoming increasingly widespread. Some users get it so badly that over
33% of their Internet messages are attributed to this type of spam. The end
result is the spammer has attained a new form of mail relaying. Your
server''s resources are being stolen to deliver spam.

How does a "Reverse NDR" attack work?

Step 1 Spam e-mail is created with the intended spam victim''s address in
the sender field and a random, fictitious recipient, at your domain, in the
To: field.

Step 2 Your mail server cannot deliver the message and sends an NDR e-mail
back to what appears to be the sender of the original message, the spam
victim.

Step 3 The return e-mail carries the non-delivery report and possibly the
original spam message. Thinking it is e-mail they sent, the spam victim
reads the NDR and the included spam.

What are the symptoms of a RNDR attack?

1. Sluggish e-mail delivery

2. Outbound queues full of non-delivery notices

3. Excessive admin time to clear outbound queues

If you are experiencing any of the above, chances are good your mail server
is under attack.

To stop the RNDR from happening, you can try either of the following
methods:

1. Follow the steps below to enable recipient filtering on the SMTP virtual
server:

NOTE: When you enable recipient filtering on the SMTP virtual server,
e-mail messages that are received from anyone on the recipient filter are
not accepted. Recipient filtering is set globally, but you enable it on a
per-Virtual Server basis on each SMTP virtual server.

- To create a recipient filter:

A. Click "Start", point to "Programs", point to "Microsoft Exchange", and
then click "System Manager".

B. Expand "Global Settings", right-click "Message Delivery", and then click
"Properties".

C. Click the "Recipient Filtering" tab, and then click the checkbox "Filter
recipients who are not in the directory" at the bottom.

D. Specify any additional filter options that you want to configure. Select
Apply, and then click "OK".

- To enable recipient filtering on the SMTP virtual server:

A. In Exchange System Manager, expand "Servers", expand "<ServerName>", and
then expand "Protocols".

B. Expand "SMTP", right-click "Default SMTP Virtual Server", and then click
"Properties".

C. Click the "General" tab, and then click "Advanced".

D. In the "Address" list, click the IP address where you want to apply the
recipient filter, and then click "Edit".

E. Click to select the "Apply Recipient Filter" check box, click "OK", and
then click "OK".

NOTE: Recipient filter rules apply only to anonymous connections.
Authenticated users and Exchange servers bypass these validations.

2. Another option is to set Exchange to not send NDR''s globally by going
into Exchange System Manager -> Global Settings -> Internet Message Formats
and right-click on "Default" on the right ( the one with the * ) and click
Properties. Click the Advanced tab and uncheck "Allow non-delivery reports".


Please note that there are consequences to both methods:

1. Implementing recipient filtering - Exchange will check to see if the
user exists prior to accepting an incoming message. This solution "may"
allow the "bad guys" to determine which email addresses are valid on your
domain. Also, this type of filtering will increase the processing overhead
of incoming messages (in SBS environments, that should not be a big
problem).

842851A software update is available to help prevent the enumeration of
Exchange 2003 e-mail addresses
http://support.microsoft.com/?id=842851A

2. Turning off NDR''s - This will impact the business as if a legitimate
person on the Internet "typos" an email address when sending to your domain
(like
<private.php?do=newpm&u=>), he will NOT get an NDR and will
have no notification that the user did not get the message.

You will need to understand the implicatons of the 2 methods above and
determine which is appropriate.


Furthrmore, following article may help you to secure your exchange network.

Antispam Capabilities in Exchange Server 2003
http://www.microsoft.com/exchange/te...y/antispam.asp

Exchange Server 2003 Security Hardening Guide
http://www.microsoft.com/downloads/d...11F-E5C9-4AEF-
9A44-504DB09B9065&displaylang=en

If you have any questions or concerns related to this issue, please let me
know.

Hope this helps.



Best Regards,

Chace Zhang (MSFT)

Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security

================================================== ===
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities...s/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.

================================================== ===

This posting is provided "AS IS" with no warranties, and confers no rights.
--------------------
| Thread-Topic: Why do certain emails not get sent ?
| thread-index: AcamCbNh5jIBwgyMQEWkk//njDiswA==
| X-WBNR-Posting-Host: 82.38.32.207
| From: =?Utf-8?B?Q3JhaWcgQw==?= <>
| Subject: Why do certain emails not get sent ?
| Date: Wed, 12 Jul 2006 16:20:02 -0700
| Lines: 12
| Message-ID: <87FCB774-96D3-4733-987E->
| MIME-Version: 1.0
| Content-Type: text/plain;
| charset="Utf-8"
| Content-Transfer-Encoding: 7bit
| X-Newsreader: Microsoft CDO for Windows 2000
| Content-Class: urn:content-classes:message
| Importance: normal
| Priority: normal
| X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.1830
| Newsgroups: microsoft.public.windows.server.sbs
| Path: TK2MSFTNGXA01.phx.gbl
| Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.server.sbs:280987
| NNTP-Posting-Host: TK2MSFTNGXA01.phx.gbl 10.40.2.250
| X-Tomcat-NG: microsoft.public.windows.server.sbs
|
| A few days ago our small business server 2003 started to have problems
with
| certain outbound emails. Some get through fine but some just keep
reporting
| as smtp: started outbound transfer of message. The next line then reads:
| message transferred to through smtp. (when I do a message trace). These
| entries in the message trace just keep reocurring. We have server reports
| showing: a large number of messages are pending in the email server send
| queue .
|
| How do I find this queue and and why do some get sent ok and some not ?
|
| Any help greatly appreciated
| Craig C
|

"Owen Williams" wrote:

> The queue is easy to find. In Server Management:
>
> * Navigate to Advanced Management | First Organization (Exchange) |
> Servers | <yourserver> | Queues.
>
> Are you sending directly (CEICW: "Use DNS to route e-mail") or via a
> smarthost (CEICW: "Forward all e-mail to e-mail server at your ISP")?
> If you are using a smarthost, it may have a maximum message size (for
> example, 2 megabytes) and certain messages you are trying to send may be
> larger than that. Those are blocked, the smaller ones go through.
>
> -- Owen Williams (SBS MVP)
>
> In article <87FCB774-96D3-4733-987E->,
> says...
> > A few days ago our small business server 2003 started to have problems with
> > certain outbound emails. Some get through fine but some just keep reporting
> > as smtp: started outbound transfer of message. The next line then reads:
> > message transferred to through smtp. (when I do a message trace). These
> > entries in the message trace just keep reocurring. We have server reports
> > showing: a large number of messages are pending in the email server send
> > queue .
> >
> > How do I find this queue and and why do some get sent ok and some not ?
> >
> > Any help greatly appreciated
> > Craig C
>
Thanks for your reply Owen,
Maybe I am doing something wrong but I cannot find the queue...under first
organisation I cannot see Servers, only Global settings,Recipients,Admin
groups,Tools. I have expanded all these but still no queue ?
We are using DNS to route emails to the internet.
There are critical errors reported on Store.exe, MAD.exe, WIN32.API, LDAP
Bind, SAM server, Sharepoint services. This all looks scary but most of the
emails are being sent & received ok but the server has rebooted itself 3
times this week.
I new to the SBS2003 so am hoping to learn quickly! Any help greatly
appreciated.

Craig C

In article <5A00039F-12F6-4D29-84AE->,
says...
> Maybe I am doing something wrong but I cannot find the queue...under first
> organisation I cannot see Servers, only Global settings,Recipients,Admin
> groups,Tools. I have expanded all these but still no queue ?
> We are using DNS to route emails to the internet.
> There are critical errors reported on Store.exe, MAD.exe, WIN32.API, LDAP
> Bind, SAM server, Sharepoint services. This all looks scary but most of the
> emails are being sent & received ok but the server has rebooted itself 3
> times this week.
> I new to the SBS2003 so am hoping to learn quickly! Any help greatly
> appreciated.

Well, this is not good! SBS2003 installed in the recommended manner
should, in Server Management under Advanced Management | First
Organization (Exchange), show:

* Global Settings
* Recipients
* Servers
* Connectors
* Tools
* Folders

And the critical errors you are seeing combined with three reboots in a
week is more than scary: it is not normal and says there are serious
problems with how this SBS was configured. For example, Store.exe and
MAD.exe are more or less the "guts" of Exchange.

Since you are new to SBS, I am going to GUESS that you did not complete
the entire SBS integrated install, which is the recommended method. Or,
if you did complete it, you may have made some mistakes answering some
of the questions the installer asks.

Is this the first time you have installed SBS? Those new to SBS should
really install it three times from scratch (that is, boot from CD and
format the hard disk(s)) before putting their first server into
production.

Any possibility you can start over and reinstall this SBS?

-- Owen Williams (SBS MVP)

"Owen Williams" wrote:

> In article <5A00039F-12F6-4D29-84AE->,
> says...
> > Maybe I am doing something wrong but I cannot find the queue...under first
> > organisation I cannot see Servers, only Global settings,Recipients,Admin
> > groups,Tools. I have expanded all these but still no queue ?
> > We are using DNS to route emails to the internet.
> > There are critical errors reported on Store.exe, MAD.exe, WIN32.API, LDAP
> > Bind, SAM server, Sharepoint services. This all looks scary but most of the
> > emails are being sent & received ok but the server has rebooted itself 3
> > times this week.
> > I new to the SBS2003 so am hoping to learn quickly! Any help greatly
> > appreciated.
>
> Well, this is not good! SBS2003 installed in the recommended manner
> should, in Server Management under Advanced Management | First
> Organization (Exchange), show:
>
> * Global Settings
> * Recipients
> * Servers
> * Connectors
> * Tools
> * Folders
>
> And the critical errors you are seeing combined with three reboots in a
> week is more than scary: it is not normal and says there are serious
> problems with how this SBS was configured. For example, Store.exe and
> MAD.exe are more or less the "guts" of Exchange.
>
> Since you are new to SBS, I am going to GUESS that you did not complete
> the entire SBS integrated install, which is the recommended method. Or,
> if you did complete it, you may have made some mistakes answering some
> of the questions the installer asks.
>
> Is this the first time you have installed SBS? Those new to SBS should
> really install it three times from scratch (that is, boot from CD and
> format the hard disk(s)) before putting their first server into
> production.
>
> Any possibility you can start over and reinstall this SBS?
>
> -- Owen Williams (SBS MVP)
> I didn,t install the server it has been running fine for about a year. The person who did the installtion is no longer around and I am the next best thing!
The only thing that coincides with strange happening on the sbs is I have
been setting up a trial version of Windows server 2003 to learn about
terminal services. I did connect the test server onto the domain for a day to
test the terminal services over the LAN. It is no longer on the network.

Craig C

In article <9878CA13-5A28-406C-9212->,
says...

> I didn,t install the server it has been running fine for about a
> year. The person who did the installtion is no longer around and
> I am the next best thing!

OK, this is useful information. If it was running fine for a year,
something obviously changed, and it's not feasible to just start over.
(Although it may come to that; I hope you have some good backups!)
Either something got damaged / corrupted or a configuration has been
really fouled up.

> The only thing that coincides with strange happening on the sbs
> is I have been setting up a trial version of Windows server 2003
> to learn about terminal services. I did connect the test server
> onto the domain for a day to test the terminal services over the
> LAN. It is no longer on the network.

Adding and removing a Terminal Server from an SBS network normally
should not cause these types of problems, but we should not just dismiss
the coincidence.

[Aside: I would not recommend testing this sort of thing on a production
server. You should do your testing with spare computers or get
Microsoft Virtual PC 2004 - which is now free - and test on virtual
machines.]

Do you use the Server Manager and its wizards to administer the SBS?
(Stuff like adding users and computers, reconfiguring Internet and e-
mail settings, etc?) If not, how do you do this?

Did you use Manage Your Server on the Windows Server to configure
Terminal Services? Did you configure any other roles in addition to TS?

When you added the Terminal Server to the domain, did you add the
computer account to the SBS then use the http://sbserver/ConnectComputer
method on the TS to add it to the network? If not, please describe what
you did to add AND remove the TS.

NOTE: If you need a quick solution, you may want to consider contacting
Microsoft Customer Support Services. It will cost US$245 (nights and
weekends may be higher), but they will work with you until the problem
is resolved.

-- Owen Williams (SBS MVP)

"Owen Williams" wrote:

> In article <9878CA13-5A28-406C-9212->,
> says...
>
> > I didn,t install the server it has been running fine for about a
> > year. The person who did the installtion is no longer around and
> > I am the next best thing!
>
> OK, this is useful information. If it was running fine for a year,
> something obviously changed, and it's not feasible to just start over.
> (Although it may come to that; I hope you have some good backups!)
> Either something got damaged / corrupted or a configuration has been
> really fouled up.
>
> > The only thing that coincides with strange happening on the sbs
> > is I have been setting up a trial version of Windows server 2003
> > to learn about terminal services. I did connect the test server
> > onto the domain for a day to test the terminal services over the
> > LAN. It is no longer on the network.
>
> Adding and removing a Terminal Server from an SBS network normally
> should not cause these types of problems, but we should not just dismiss
> the coincidence.
>
> [Aside: I would not recommend testing this sort of thing on a production
> server. You should do your testing with spare computers or get
> Microsoft Virtual PC 2004 - which is now free - and test on virtual
> machines.]
>
> Do you use the Server Manager and its wizards to administer the SBS?
> (Stuff like adding users and computers, reconfiguring Internet and e-
> mail settings, etc?) If not, how do you do this?
>
> Did you use Manage Your Server on the Windows Server to configure
> Terminal Services? Did you configure any other roles in addition to TS?
>
> When you added the Terminal Server to the domain, did you add the
> computer account to the SBS then use the http://sbserver/ConnectComputer
> method on the TS to add it to the network? If not, please describe what
> you did to add AND remove the TS.
>
> NOTE: If you need a quick solution, you may want to consider contacting
> Microsoft Customer Support Services. It will cost US$245 (nights and
> weekends may be higher), but they will work with you until the problem
> is resolved.
>
> -- Owen Williams (SBS MVP)
>
We do use server manager to administer users on the sbs.

I did user server manager to add the TS role to the windows server. I also
enabled file server role and created a share through the wizard.

When I added the Windows server to the account I did use the add server
wizard and then the http://sbserver/ConnectComputer method on the TS to add
it to the network. There were no problems with any of these procedures.

The sbs does a back up everynight but it backs up onto another hard drive
rather than a tape. I am not sure how this is configured (full, incremental,
overwrite previous etc)

Craig C

In article <2AEE4763-9B90-4CD9-813F->,
says...
> We do use server manager to administer users on the sbs.
>
> I did user server manager to add the TS role to the windows server. I also
> enabled file server role and created a share through the wizard.
>
> When I added the Windows server to the account I did use the add server
> wizard and then the http://sbserver/ConnectComputer method on the TS to add
> it to the network. There were no problems with any of these procedures.
>
> The sbs does a back up everynight but it backs up onto another hard drive
> rather than a tape. I am not sure how this is configured (full, incremental,
> overwrite previous etc)
>
> Craig C

OK, to start, check the Services on the SBS. They should be simliar to
the following. [I had to abbreviate some lines to avoid wrapping, so
your text may be somewhat different. And you may have more or less
services than these, depending on what your SBS is running.]

Name Status Startup Log On As
----------------------- ------- --------- ---------------
Alerter Disabled Local Service
Application Experience Started Automatic Local System
Application Layer Gate Manual Local Service
Application Management Manual Local System
ASP.NET State Service Manual Network Service
Automatic Updates Started Automatic Local System
Background Intelligent Started Manual Local System
ClipBook Disabled Local System
COM+ Event System Started Automatic Local System
COM+ System Application Manual Local System
Computer Browser Started Automatic Local System
Cryptographic Services Started Automatic Local System
DCOM Server Process Started Automatic Local System
DHCP Client Started Automatic Network Service
DHCP Server Started Automatic Local System
Distributed File System Started Automatic Local System
Distributed Link Client Manual Local System
Distributed Link Server Disabled Local System
Distributed Transaction Started Automatic Network Service
DNS Client Started Automatic Network Service
DNS Server Started Automatic Local System
Error Reporting Service Started Automatic Local System
Event Log Started Automatic Local System
Fax Manual Network Service
File Replication Serv Started Automatic Local System
Help and Support Started Automatic Local System
HTTP SSL Started Manual Local System
Human Interface Device Disabled Local System
IIS Admin Service Started Automatic Local System
IMAPI CD-Burning COM Disabled Local System
Indexing Service Manual Local System
Intersite Messaging Disabled Local System
IPSEC Services Started Automatic Local System
Kerberos Key Distrib Started Automatic Local System
License Logging Started Automatic Network Service
Logical Disk Manager Started Automatic Local System
Logical Disk Admin Service Manual Local System
Messenger Disabled Local System
Msft Connector for POP3 Disabled Local System
Msft Exch Event Manual Local System
Msft Exch IMAP4 Disabled Local System
Msft Exch Info Store Started Automatic Local System
Msft Exch Management Started Automatic Local System
Msft Exch MTA Stacks Disabled Local System
Msft Exch POP3 Disabled Local System
Msft Exch Routing Started Automatic Local System
Msft Exch Site Repl Disabled Local System
Msft Exch System Attend Started Automatic Local System
Msft Firewall Started Automatic Network Service
Msft ISA Serv Control Started Automatic Local System
Msft ISA Serv Job Sched Started Automatic Local System
Msft ISA Serv Storage Started Automatic Network Service
Msft Search Started Automatic Local System
Msft SW Shadow Copy Prov Manual Local System
MSSQL$MSFW Started Automatic Local System
MSSQL$SBSMONITORING Started Automatic Local System
MSSQL$SHAREPOINT Started Automatic Local System
MSSQL$WSUS Started Automatic Local System
MSSQLServerADHelper Manual Local System
Net Logon Started Automatic Local System
NetMeeting Rmt Desktop Disabled Local System
Network Connections Started Manual Local System
Network DDE Disabled Local System
Network DDE DSDM Disabled Local System
Network Location Aware Started Manual Local System
Network News Transfer Disabled Local System
Network Provisioning Manual Local System
NT LM Security Support Started Manual Local System
Perf Logs & Alerts Manual Network Service
Plug and Play Started Automatic Local System
Portable Media Serial Disabled Local System
Print Spooler Started Automatic Local System
Protected Storage Started Automatic Local System
Rmt Access Auto Connect Disabled Local System
Rmt Access Connect Mgr Started Manual Local System
Rmt Desktop Help Sess Manual Local System
Rmt Proc Call (RPC) Started Automatic Network Service
(RPC) Locator Manual Network Service
Remote Registry Started Automatic Local Service
Removable Storage Manual Local System
Resultant Set of Policy Manual Local System
Routing and Rmt Access Disabled Local System
SBCore Service Started Automatic Local System
Secondary Logon Started Automatic Local System
Security Accts Manager Started Automatic Local System
Server Started Automatic Local System
SharePoint Timer Svc Started Automatic NETWORK SERVICE
Shell HW Detection Started Automatic Local System
Simple Mail Transfer Started Automatic Local System
Smart Card Manual Local Service
Special Admin Console Manual Local System
SQLAgent$MSFW Manual Local System
SQLAgent$SBSMONITORING Started Automatic Local System
SQLAgent$SHAREPOINT Manual Local System
SQLAgent$WSUS Manual Local System
System Event Notifica Started Automatic Local System
Task Scheduler Started Automatic Local System
TCP/IP NetBIOS Helper Started Automatic Local Service
Telephony Started Manual Local System
Telnet Disabled Local Service
Terminal Services Started Manual Local System
TS Session Directory Disabled Local System
Themes Disabled Local System
Update Services Started Automatic Network Service
Upload Manager Disabled Local System
Virtual Disk Service Manual Local System
Volume Shadow Copy Manual Local System
WebClient Disabled Local Service
Win Audio Manual Local System
Win Firewall/ICS Disabled Local System
Win Image Acquisition Disabled Local Service
Win Installer Manual Local System
WINS Started Automatic Local System
Win Management Instrum Started Automatic Local System
Win Mgmt Instrum Drv Ext Manual Local System
Windows Time Started Automatic Local Service
Win User Mode Driver Manual Local Service
WinHTTP Web Proxy Auto Manual Local Service
Wireless Configuration Manual Local System
WMI Performance Adapter Manual Local System
Workstation Started Automatic Local System
World Wide Web Pub Started Automatic Local System

Let me know if you find any discrepancies, especially the Exchange
services.

-- Owen Williams (SBS MVP)

"Owen Williams" wrote:

> In article <2AEE4763-9B90-4CD9-813F->,
> says...
> > We do use server manager to administer users on the sbs.
> >
> > I did user server manager to add the TS role to the windows server. I also
> > enabled file server role and created a share through the wizard.
> >
> > When I added the Windows server to the account I did use the add server
> > wizard and then the http://sbserver/ConnectComputer method on the TS to add
> > it to the network. There were no problems with any of these procedures.
> >
> > The sbs does a back up everynight but it backs up onto another hard drive
> > rather than a tape. I am not sure how this is configured (full, incremental,
> > overwrite previous etc)
> >
> > Craig C
>
> OK, to start, check the Services on the SBS. They should be simliar to
> the following. [I had to abbreviate some lines to avoid wrapping, so
> your text may be somewhat different. And you may have more or less
> services than these, depending on what your SBS is running.]
>
> Name Status Startup Log On As
> ----------------------- ------- --------- ---------------
> Alerter Disabled Local Service
> Application Experience Started Automatic Local System
> Application Layer Gate Manual Local Service
> Application Management Manual Local System
> ASP.NET State Service Manual Network Service
> Automatic Updates Started Automatic Local System
> Background Intelligent Started Manual Local System
> ClipBook Disabled Local System
> COM+ Event System Started Automatic Local System
> COM+ System Application Manual Local System
> Computer Browser Started Automatic Local System
> Cryptographic Services Started Automatic Local System
> DCOM Server Process Started Automatic Local System
> DHCP Client Started Automatic Network Service
> DHCP Server Started Automatic Local System
> Distributed File System Started Automatic Local System
> Distributed Link Client Manual Local System
> Distributed Link Server Disabled Local System
> Distributed Transaction Started Automatic Network Service
> DNS Client Started Automatic Network Service
> DNS Server Started Automatic Local System
> Error Reporting Service Started Automatic Local System
> Event Log Started Automatic Local System
> Fax Manual Network Service
> File Replication Serv Started Automatic Local System
> Help and Support Started Automatic Local System
> HTTP SSL Started Manual Local System
> Human Interface Device Disabled Local System
> IIS Admin Service Started Automatic Local System
> IMAPI CD-Burning COM Disabled Local System
> Indexing Service Manual Local System
> Intersite Messaging Disabled Local System
> IPSEC Services Started Automatic Local System
> Kerberos Key Distrib Started Automatic Local System
> License Logging Started Automatic Network Service
> Logical Disk Manager Started Automatic Local System
> Logical Disk Admin Service Manual Local System
> Messenger Disabled Local System
> Msft Connector for POP3 Disabled Local System
> Msft Exch Event Manual Local System
> Msft Exch IMAP4 Disabled Local System
> Msft Exch Info Store Started Automatic Local System
> Msft Exch Management Started Automatic Local System
> Msft Exch MTA Stacks Disabled Local System
> Msft Exch POP3 Disabled Local System
> Msft Exch Routing Started Automatic Local System
> Msft Exch Site Repl Disabled Local System
> Msft Exch System Attend Started Automatic Local System
> Msft Firewall Started Automatic Network Service
> Msft ISA Serv Control Started Automatic Local System
> Msft ISA Serv Job Sched Started Automatic Local System
> Msft ISA Serv Storage Started Automatic Network Service
> Msft Search Started Automatic Local System
> Msft SW Shadow Copy Prov Manual Local System
> MSSQL$MSFW Started Automatic Local System
> MSSQL$SBSMONITORING Started Automatic Local System
> MSSQL$SHAREPOINT Started Automatic Local System
> MSSQL$WSUS Started Automatic Local System
> MSSQLServerADHelper Manual Local System
> Net Logon Started Automatic Local System
> NetMeeting Rmt Desktop Disabled Local System
> Network Connections Started Manual Local System
> Network DDE Disabled Local System
> Network DDE DSDM Disabled Local System
> Network Location Aware Started Manual Local System
> Network News Transfer Disabled Local System
> Network Provisioning Manual Local System
> NT LM Security Support Started Manual Local System
> Perf Logs & Alerts Manual Network Service
> Plug and Play Started Automatic Local System
> Portable Media Serial Disabled Local System
> Print Spooler Started Automatic Local System
> Protected Storage Started Automatic Local System
> Rmt Access Auto Connect Disabled Local System
> Rmt Access Connect Mgr Started Manual Local System
> Rmt Desktop Help Sess Manual Local System
> Rmt Proc Call (RPC) Started Automatic Network Service
> (RPC) Locator Manual Network Service
> Remote Registry Started Automatic Local Service
> Removable Storage Manual Local System
> Resultant Set of Policy Manual Local System
> Routing and Rmt Access Disabled Local System
> SBCore Service Started Automatic Local System
> Secondary Logon Started Automatic Local System
> Security Accts Manager Started Automatic Local System
> Server Started Automatic Local System
> SharePoint Timer Svc Started Automatic NETWORK SERVICE
> Shell HW Detection Started Automatic Local System
> Simple Mail Transfer Started Automatic Local System
> Smart Card Manual Local Service
> Special Admin Console Manual Local System
> SQLAgent$MSFW Manual Local System
> SQLAgent$SBSMONITORING Started Automatic Local System
> SQLAgent$SHAREPOINT Manual Local System
> SQLAgent$WSUS Manual Local System
> System Event Notifica Started Automatic Local System
> Task Scheduler Started Automatic Local System
> TCP/IP NetBIOS Helper Started Automatic Local Service
> Telephony Started Manual Local System
> Telnet Disabled Local Service
> Terminal Services Started Manual Local System
> TS Session Directory Disabled Local System
> Themes Disabled Local System
> Update Services Started Automatic Network Service
> Upload Manager Disabled Local System
> Virtual Disk Service Manual Local System
> Volume Shadow Copy Manual Local System
> WebClient Disabled Local Service
> Win Audio Manual Local System
> Win Firewall/ICS Disabled Local System
> Win Image Acquisition Disabled Local Service
> Win Installer Manual Local System
> WINS Started Automatic Local System
> Win Management Instrum Started Automatic Local System
> Win Mgmt Instrum Drv Ext Manual Local System
> Windows Time Started Automatic Local Service
> Win User Mode Driver Manual Local Service
> WinHTTP Web Proxy Auto Manual Local Service
> Wireless Configuration Manual Local System
> WMI Performance Adapter Manual Local System
> Workstation Started Automatic Local System
> World Wide Web Pub Started Automatic Local System
>
> Let me know if you find any discrepancies, especially the Exchange
> services.
>
> -- Owen Williams (SBS MVP)
>
Thanks Owen, I have now checked ther services and found a few discrepancies
as follows:
Application Layer Gateway Started Manual
AVG7 Alert Manager Service Started Auto Local
AVG7 Update Service Started Auto Local
Certificate services Started Auto Local
Messenger Started Auto Local
MS Connector for POP3 Started Auto Local
MS Exchange IMAP4 Started Auto Local
MS EXchange MTA Stacks Started Auto Local
MS Exchange POP3 Started Auto Local
MS Exchange Site Repl Started Auto Local
No Entries for MS ISA Serv Local
No Entry for MSSQL$MSFW Local
MSSQL Server Adhelper Manual Local
No Entry for MSSQL$WSUS
Routing & Remote Access Started Auto Local
Sharepoint Timer Serv Started Auto NT Auth\NETWORK SVC
No Entry for SQL agent$MSFW
No Entry for SQLAgent$WSUS
Uninter Power Supply Manual Local
No Entry for Update Services
Web Client Started Auto

Also today I had a critical error as follows:
<The store.exe process is allocating more memory than usual.

Check to see if you are having problems with e-mail. If so, stop and then
restart the Microsoft Exchange Information Store service.>

I proceeded to stop & restart as above and also the MS Connector for POP3

Thanks again for your help

Craig C