How to Determine whether an authenticated user is relaying

To determine whether an authenticated user is relaying or not, enables logging in the Windows Event Viewer such that any authentication attempts against the SMTP service (successful or failures) are logged in the application log.

1.  Start Exchange Administrator.

2. Double-click Servers.

3.  Under Servers, right-click ServerName, and then click Properties.

4.  Click the Diagnostic Logging tab.

5.  Click MSExchangeTransport on the left.

6.  On the right, click SMTP Protocol.

7.  Under Logging Level, click Maximum.

8.  Click OK to close Server Properties.

If a remote user is authenticating against the Small Business Server computer as part of an operation to relay SMTP e-mail, you will see an event that is similar to the following in the application log:

Event Type: Information
Event Source: MSExchangeTransport
Event Category: SMTP Protocol
Event ID: 1708
Date: 8/13/2003
Time: 10:13:24 AM
User: N/A
Computer: SERVER
Description: SMTP Authentication was performed successfully with client remote_computername. The authentication method was LOGIN and the username was company\username.

If a remote user is authenticating against the Small Business Server as part of an operation to relay SMTP e-mail using the guest account, you will see an event that is similar to the following in the application log:

Event Type: Information
Event Source: MSExchangeTransport
Event Category: SMTP Protocol
Event ID: 1708
Date: 8/13/2003
Time: 10:27:52 AM
User: N/A
Computer: SERVER
Description: SMTP Authentication was performed successfully with client remote_computername. The authentication method was LOGIN and the username was COMPANY\Guest.

Post your questions, comments, feedbacks and suggestions

Contact a consultant

Related Topics