SMTP connectors no longer transfer messages after you upgrade from Exchange 2000 Server or Exchange Server 2003 SP1 to Exchange Server 2003 SP2

You upgrade computers that are running Microsoft Exchange 2000 Server or Microsoft Exchange Server 2003 Service Pack 1 (SP1) to Microsoft Exchange Server 2003 Service Pack 2 (SP2). After you do this, the Simple Mail Transfer Protocol (SMTP) connectors that you previously configured between your routing groups no longer transfer messages between those routing groups.

Additionally, the following event appears in the Application log in Event Viewer:

Event Type: Warning
Event Source: MSExchangeTransport
Event Category: SMTP Protocol
Event ID: 1709
Date: date
Time: time
User: N/A
Computer: server name
Description: The SMTP client" IP Address " did not authenticate before attempting to send mail. Access was denied.
Data: 0000: 05 00 07 80 ...�

This problem occurs when the following conditions are true:

• You have configured an SMTP connector to an SMTP virtual server that is not the default SMTP virtual server.
• This SMTP connector does not have a routing group that is connected to other routing groups.
• You have turned off anonymous access for this SMTP connector.

X-EXPS Kerberos authentication is not performed for a virtual server whose name does not match the fully qualified domain name (FQDN) or the NetBIOS name of the computer. This is true for Exchange 2000 Server Service Pack 3 (SP3), for Exchange Server 2003, and for Exchange Server 2003 service packs.

Hotfix information

A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.

If the hotfix is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site: Note The "Hotfix download available" form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.

Hotfix installation information

You must apply the hotfix on the computers that are hosting the SMTP connectors. After you apply this hotfix, you must set a bit in the heuristics field of the Active Directory connector object. This action will cause Exchange Server 2003 to revert to the authentication behavior from Exchange 2000 Server Service Pack 2 (SP2).

When you set this bit to the value that is specified, the connector is considered to be internal to the routing group, and EXPS authentication is enabled. Use the Active Directory Service Interfaces (ADSI) Edit snap-in to enable EXPS authentication.

Warning If you use the ADSI Edit snap-in, the LDP utility, or any other LDAP version 3 client, and you incorrectly modify the attributes of Active Directory objects, you can cause serious problems. These problems may require you to reinstall Microsoft Windows 2000 Server, Microsoft Windows Server 2003, Microsoft Exchange 2000 Server, Microsoft Exchange Server 2003, or both Windows and Exchange. Microsoft cannot guarantee that problems that occur if you incorrectly modify Active Directory object attributes can be solved. Modify these attributes at your own risk.

1. Click Start, click Run, type adsiedit.msc in the Open box, and then click OK.
   
   Note The ADSI Edit snap-in is included with the Microsoft Windows Server 2003 Support Tools. To install the Windows Server 2003 Support Tools, run the Setup.exe program from the Support\Tools folder on the Windows Server 2003 CD.
2. Expand Configuration Container [ servername.yourdomain.root_domain ], expand CN=Configuration,DC=Your_Domain,DC=Root_Domain, expand CN=Services, expand CN=Microsoft Exchange, expand CN= Organization Name, expand CN=Administrative Groups, expand CN= First Administrative Group Name, expand CN=Routing Groups, expand CN= First Routing Group Name, and then click CN=Connections.
3. In the right pane, right-click the locally scoped SMTP connector item, and then click Properties.
4. In the Select which properties to view list, click Both.
5. In the Select a property to view list, click heuristics.
6. In the Edit Attribute box, type 16384 (4000 hexadecimal), and then click Set.
7. Click Apply, and then click OK.
8. Exit the ADSI Edit snap-in.

Important When you set this bit to the value that is specified, Exchange Server considers the SMTP connector to be internal to the routing group if the connector is not configured to use direct Domain Name System (DNS). Therefore, EXPS authentication is enabled.

The SMTP connector is not configured to use direct DNS when the Use DNS to route to each address space on this connector option is not selected in the connector_name Properties dialog box in Exchange System Manager.

If the connector is configured to use DNS to route to each address space, external EXPS is disabled. This is true even if you use the previous steps to set the heuristics bit to enable external EXPS on the connector.

Note External EXPS is disabled because a direct DNS relay on a connector relays mail to DNS names that coincide with the domain part of the SMTP address. In that scenario, a malicious external user could receive your EXPS authentication information.

Prerequisites

You must install Microsoft Exchange Server 2003 Service Pack 2 (SP2) before you apply the hotfix.
For more information, click the following article number to view the article in the Microsoft Knowledge Base:

Restart requirement

You do not have to restart the computer after you apply the hotfix.

Hotfix replacement information

This hotfix does not replace any other hotfixes.

File information

The global version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

For more information about the terminology that Microsoft uses for software that is corrected after it is released, click the following article number to view the article in the Microsoft Knowledge Base: For more information about the naming schema for Exchange software updates, click the following article number to view the article in the Microsoft Knowledge Base: For more information about a hotfix for Exchange 2000 Server Service Pack 3 (SP3), click the following article number to view the article in the Microsoft Knowledge Base: - For more information about a hotfix for Exchange Server 2003 Service Pack 1 (SP1), click the following article number to view the article in the Microsoft Knowledge Base: