Active Directory NTDS.DIT Database

Active directory database called NDS.DIT (directory Information Tree). Active directory database gets installed by defaults following directory.

C:\windows\NTDS\NTDS.DIT and .DIT stands for Directory information tree. It is essential for Exchange administrators to know and understand about the structure of .DIT database since Exchange related information gets stored on Domain, Configuration and Schema partitions of active directory. Of course DNS zone Data will contain records (host records) which every host will use these records within the Active directory environment

 

.DIT Database in Active Directory 2000

Domain = Domain Partition ( RDO Resident directory Objects)   DNS Data Stored here (.DIT windows 2000 AD)

Configuration= Configuration partition Contains information about other domains Exchange organization information is held here as well as Domain, and schema partitions

Schema= Definition of objects

 

Domain Partition

(Resident directory object)

This partition stores below objects User, Groups, Computer accounts, all these are resident directory object lives in this partition.DNS data also gets stored here with windows 2000 active directory.

 

Schema Partition

Definition of an object is called schema, all domain controllers must be agree definition of an object, and this definition is replicated to all other domain controllers so all domain controllers is agree about the schema. Definition is replicated to all other Domain controllers in active directory FOREST. So all domain controllers are agree about definition of Object

 

Configuration partitions

It contains information about all other domain controllers, lets every domain controllers know existenceof other domain controllers, where they are, what are the names of those Domain controllers and so on

 

DIT Database in Active Directory 2003

Domain = Domain Partition ( RDO Resident directory Objects)

Configuration= Configuration partition Contains information about other domains Exchange organization information is held here as well as Domain, and schema partitions

Schema= Definition of objects

Application Partition Application specific data , such as DNS Zone data DNS Data Stored here (.DIT windows 2000 AD)

 

Microsoft realized the problem with .DIT partitioned database in Windows 2000. The DNS zone data information was being kept in the Domain partition of the Database. When replication occurs, this data was getting replicated to the domain controller which is not DNS servers. Therefore the problems was fixed on .DIT partitioned database on windows 2003 architecture by adding additional partition called application partition date will be stored here and this will avoid unnecessary replication.

Where Exchange recipient related information would be kept in .DIT database?

 

Best Regards

Oz

 

Configuring mail forwarding by using only a Contact object

This is not recommended way by Microsoft, however you may want to use this method to forward the e-mails to your former employees and don't have to use your CALS, or reserving a mailbox for this purpose. The Microsoft article (kb-555187) talks about some security related reasons and why this method might be selected forwarding the mails to external recipient rather than using on the regular mailbox, exchange general delivery option on forward to external recipient by selection contact object in Active directory.

Scenario: User Dan quits his present company and gets hired by Microsoft as Exchange subject matter expert. Dan goes back to security department of his company and asks them if they can forward mail to Dan for couple mounts. Since Dan is a great employee security, will say no problem. However the network is regulated and all users' mailboxes must be blown away within 10 days of employee termination. This case security team lead G cannot use the regular forwarding option under Exchange general tab and wants to use another method to achieve the same goal.Dan provides his new mail address to G, as Dan@Microsoft.com. Dan quits his company and his SMTP proxy address blown away (Dan@donateBlod.com).G goes to active directory and creates a contact for Dan, and configures SMTP Proxy address for this contact, as Dan@Microsoft.com . Existing Recipient policy will stamp this object with @donateBlod.com and now Dan has two SMTP Proxy address. G goes back to AD and locates the contact for Dan, and sets the primary SMTP address to Dan@DonateBlod.com and leaves the second Proxy address as second SMTP address Dan@microsoft.com

When SMTP session open from external users, who has no idea Dan has quit from DonateBlod.com Company will e-mail Dan and let's see what will happen. Mail gateways alterative for SMTP name space @DonateBlod.com will accept the mail behalf of DAN External sender sends mail to Dan@DonamteBlod.com There is no mailbox for Dan@DonateBlod.com "Security team blown away the mailbox and the user account"

The contact information however stays in Active directory .DIT database with two SMTP Proxy address already configured for this contact object.

When mail is accepted by smart host or mail relay gateway, for behalf of Dan@DonateBlod.com , mail get to the exchange server. Exchange server locates the contacts. Exchange server sees the attribute called "targetAddress" set to second SMTP Proxy address and forwards (redirects) e-mails to this address and in this example the address is Dan@DonateBlod.com

 

Best Regards,

Oz Ozugurlu

 

 

AOL 550 your e-mail was rejected for policy reasons

Cannot sent mail to AOL, check this out to determine why you cannot.

Most often I see people are asking how to go by not being able to send mail to some certain domains while any other domain accepts e-mails from their mail servers.When most of the servers won't accept e-mails from any domain, most of the time they give the reason back to the senders and telling the sender what the reason is The NRD reposts normally indicates or lead the exchange administrator to the clue why the destination server was rejected or not accepted such mail from sender SMTP domain.Here is the example of the NDR came from AOL 550 your e-mail was rejected for policy reasons on this gateway. Reasons for rejection may be related to content such as obscene language, graphics, or spam-like characteristics (or) other Reputation problems.

The fastest way to deal with AOL is by clicking the link here AOL Post master Trouble

Fair enough we get the explanation from the AOL support page

550 "username" Is Not Accepting Mail from This Sender This error indicates that the AOL Member has configured his account, possibly inadvertently, to only accept mail from certain addresses and/or domains on the Internet. Using Mail Controls he will have to modify those settings to receive mail from you. AOL Postmaster cannot override these Member defined settings. We respect Member's privacy and their ability to control their own mail. Postmaster cannot forward the mail for you

Verify quickly some of the settings below

Make sure you have RDNS for your domain. Make sure you are not on the any of the RBL list

Make sure you are not on Yahoo, AOL or etc black list (call yahoo, submit the case for unblocking your mail server)

Enable SMTP logging on your default virtual server, in order to have better view of what is going on

To turn on Diagnostics Logging on the MSExchangeTransport service, follow these steps:

1. Start Exchange System Manager.

2. Expand Servers, right-click Your_ Server_Name, and then click Properties.

3. Click the Diagnostics Logging tab, and then click MSExchangeTransport under Services.

4. Under Categories, click the category that you want to log.

5. Under Logging Level, click the appropriate logging level for the issue that you are investigating:

• None
  
• Minimum
  
• Medium
  
• Maximum
  
  
  

Note: to see event messages turn up the logging level to medium or high.

Check to see if you receive the following event messages in Events viewer with event logging turned on.

Try to telnet into the destination mail server and pay attention to recipient server responses. If you get any response, Google it up and figured out what needs to be done

Telnet commands are below

Telnet mailserver.mailserver.com 25 or the IP address of the mail server can be inserted as

Telnet 192.168.1.100 25 (replace the IP address I used here to recipient mail server Public IP)

Helo: SpamKing (or anything you like, don't you say your name when you meet with someone, that does not mean you are telling your true name, don't forget the columns after Helo:

Mail from:
SpamKing@Spam.com (or anything you like)

Rcpt to: recipient mail address goes here (destination mailbox, intended mail recipient) most of the server will reject invalid E-mail addresses.

Data
Hit Enter after this

Subject: Type the subject here hit enter when you finish

Start typing the Data here, need to know how to finish, press dot (.) Enter dot (.)

Now your mail went to the recipient mail server

Best

Oz Ozugurlu

 

 

 

 

 

5.7.1 You do not have permission to send to this recipient

We need to investigate the cause of 571.The client claims to be sending mail to every other domain on the internet but some certain domains returns 5.7.1 SMTP code. One of the first things we can do is getting the mail server IP address and manually telnetting into Destination mail server and find out the destination mail server response.

Your message did not reach some or all of the intended recipients.

Subject: test

Sent: 6/1/2007 2:08 PM

The following recipient(s) cannot be reached:

571 on 6/1/2007 2:00 PM

You do not have permission to send to this recipient. For assistance, contact your system administrator.

<mail.smtp25.org #5.7.1>

The host name for the mail server is mail.smtp25.org. and the IP address is 71.246.241.20

PS C:\> telnet mail.smtp25.org 25 ( this is the recipient mail server, instead of host records I could use IP address as well, don't forget to telnet into port 25 !!!)

220 mail.smtp25.org Whatz Up Punk!! Sent it OVER Fri, 1 Jun 2007 14:07:16 -0400' (Server relies back with 220, it mean go ahead and send me the mail)

Helo (think, when you talk to someone what do you say, Hi or hello isn't it. This is the same way here, only spelling hello is different now)

250 mail.smtp25.org Hello [162.6.243.67] ( mail server gives us 250 again)

Mail from:<> ( now we say mail from: <>, either use brackets or, tell the server who the mail will be coming from by typing the SMTP Proxy address, or Just any word, would be fine example Mail from: Spammer Mail from:Spamking@Spamworld.com Mail from: Hello Mailfrom:Anything@anything.com

250 2.1.0 <>....Sender OK

rcpt to:571@smtp25.org ( this is the recipient mail address)

250 2.1.5 571@smtp25.org

Data ( this is where you enter the data, no column)

354 Start mail input; end with <CRLF>.<CRLF>

Subject: This is Test E-mail (Subject goes here) Hit enter after this to input the data

Please ignore

. (When you read to finish, hit Dot(.) Enter Dot(.) on the keyboard and you will see If message is getting accepted or now by the recipient mail server

554 5.1.0 Sender Denied This is the last message we get

Using telnet is easy and to determine one more time what is going on, knowing basic is always as good credit

So, we used

Now let's take a look recipient configuration

As you see on the recipient mail box has "From authenticated users only is selected"

It means the recipient is configured not to accept any mail from outside of their SMTP domain. Simply inbound mail is not allowed for this recipient

Here is the Microsoft KB article, and the explanation, who would be External user, or who would be

KB 827616

Because most Internet Simple Mail Transfer Protocol (SMTP) servers do not require authentication for inbound Internet e-mail, there is the risk that unauthorized Internet users might send e-mail messages to users and to distribution lists that are for internal use only. If you configure a user or a distribution group to receive e-mail messages from authenticated users only, those recipients do not receive e-mail messages that are submitted anonymously. Authenticated users can include the following

• External users who pass credentials when they send e-mail from the Internet.
  

• Internal users in the Exchange organization.
  

Microsoft Exchange Server 2003 has a new feature that permits mailbox users or distribution groups to only receive e-mail messages from authenticated users. This feature permits you to restrict inbound Internet e-mail for specific users or for distribution groups. The feature is enabled when you click to select the From authenticated users only check box in the Message restrictions settings for an individual user or a distribution group.

Best

Oz