I have an SBS 2003 Standard system with SP1. In the last three or four weeks have been getting warnings overnight that there are large number of messages in the message queue. Initially I put it down to the satellite modem being down in bad weather which was confirmed on at least one occasion. However, after more thorouhgh investigation I found that there are close to 70 SBS SMTP connectors set up with a postmaster@domain.name.com message, scheduled to send to unrecognised addresses. It definitely appears to be SPAM. The system is not set to relay. Some users do have weak passwords so it may have been set up via one of those. The problem is that when I try to remove the Connector, there is no option available to do that. I can Freeze it but I am not sure what that does and the next day I found a number of new ones set up. Any suggestions would be most welcome. Please assume that I need some elementary handholding as looking after this SBS is only a part time job. I am forcing users to use strong passwords now, but that is shutting the gate after the horses have bolted. Thanks in advance, Janos

Hi Janos, Looks like your server is the target of a reverse non-delivery report (NDR) attack. Just make sure that recipient filter set to prevent Exchange Server from accepting messages that are sent to recipients who do not exist. This would help you to clear your queues. In Exchange Server 2003 or in Exchange 2000 Server, the Exchange Server queues are filled with many non-delivery reports from the postmaster account because of a reverse non-delivery report attack http://support.microsoft.com/kb/909005 You may also think about implementing RBLs in Exchange 2003

Thank you for the reply. I am implemenying it now. I believe it will solve my problem as the symptoms are exactly as described, Best regards, Janos