Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. The EventId.Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.
|Source: MSExchangeIS Public|
The delivery of a message sent by a public folder /o=<organization name>/ou=<site name>/cn=RECIPIENTS/cn=name MAIL8906ADF48906ADF48906ADF4A223184B0666C4 has failed To: <name> Cc: The non-delivery report has been deleted.
|English: Request a translation of the event description in plain English.|
|Concepts to understand:|
What is the role of the Microsoft Exchange Information Store service?
What is an Exchange public folder?
If this is happening on Exchange 2007, you may not have your Spam Quarantine set up properly. The way the Antispam quarantine works on Exchange 2007 is that the message that is considered spam is wrapped in a NDR. Since NDRs can only be sent to mailboxes and not public folders, it will create this error in the App log every time you get a quarantined spam message. See the link to “Configuring and Managing Spam Quarantine” for information on how to properly set up the Spam Quarantine.
See ME900088 for a hotfix applicable to Microsoft Exchange Server 2003.
See ME290621 for a hotfix applicable to Microsoft Exchange Server 5.5.
As per Microsoft: "This issue can occur if a moderated public folder or another rule that forwards posts to Exchange Server mailboxes sends e-mail messages to specified accounts. If an account is deleted, the rule still attempts to send the message and generates an NDR and the events in the "Symptoms" section of this article". See ME259343 for more details.
See "EventID 2028 from source MSExchangeIS" for additional information on this event.
As per Microsoft, NDRs can only be delivered to mailboxes, not to public folders. If a user sends a message on behalf of a public folder and that message generates a NDR, the NDR should be delivered to the public folder. However, as Exchange cannot deliver it to the public folder, the NDR is deleted and Exchange reports that to the event log.
If you are using delivery restrictions, be sure to verify they are set accordingly on the Exchange servers configured for SMTP.
From a newsgroup post: "When you install Exchange 5.5, by default, automatic replies to the Internet are disabled. Have a look on the Internet Mail tab of the IMS property pages. In particular, click on the advanced options tab and see if any of those settings are affecting your system."
I fixed this problem by granting permission of anonymous on that folder to more than a contributor.
|Private comment: Subscribers only. See example of private comment|
|Links: ME259343, ME290621, ME900088, EventID 2028 from source MSExchangeIS, Configuring and Managing Spam Quarantine|
|Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (0) - More links...|
Send comments or solutions
- Notify me when updated