Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 2028 Source: MSExchangeISPublic

Level
Description
The delivery of a message sent by a public folder /o=<organization name>/ou=<site name>/cn=RECIPIENTS/cn=name  MAIL8906ADF48906ADF48906ADF4A223184B0666C4 has failed To: <name>  Cc:  The non-delivery report has been deleted.
Comments
 
If this is happening on Exchange 2007, you may not have your Spam Quarantine set up properly. The way the Antispam quarantine works on Exchange 2007 is that the message that is considered spam is wrapped in a NDR. Since NDRs can only be sent to mailboxes and not public folders, it will create this error in the App log every time you get a quarantined spam message. See the link to “Configuring and Managing Spam Quarantine” for information on how to properly set up the Spam Quarantine.
See ME900088 for a hotfix applicable to Microsoft Exchange Server 2003.
See ME290621 for a hotfix applicable to Microsoft Exchange Server 5.5.

As per Microsoft: "This issue can occur if a moderated public folder or another rule that forwards posts to Exchange Server mailboxes sends e-mail messages to specified accounts. If an account is deleted, the rule still attempts to send the message and generates an NDR and the events in the "Symptoms" section of this article". See ME259343 for more details.

See "EventID 2028 from source MSExchangeIS" for additional information on this event.
As per Microsoft, NDRs can only be delivered to mailboxes, not to public folders. If a user sends a message on behalf of a public folder and that message generates a NDR, the NDR should be delivered to the public folder. However, as Exchange cannot deliver it to the public folder, the NDR is deleted and Exchange reports that to the event log.
If you are using delivery restrictions, be sure to verify they are set accordingly on the Exchange servers configured for SMTP.
From a newsgroup post: "When you install Exchange 5.5, by default, automatic replies to the Internet are disabled.  Have a look on the Internet Mail tab of the IMS property pages.  In particular, click on the advanced options tab and see if any of those settings are affecting your system."


I fixed this problem by granting permission of anonymous on that folder to more than a contributor.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...