Exchange & Outlook UPDATE, Exchange Edition, December 9, 2004

1. Commentary
- When Tar Is Your Friend

2. Resources
- Test Your AD Knowledge
- Featured Thread: Delayed Outlook Messages
- Outlook Tip: Choosing Calendar Colors

3. New and Improved
- Manage Your Email
- Tell Us About a Hot Product and Get a T-Shirt!

~~~~ Sponsor: PSTs from Discovery to the Archive: white paper ~~~~
Read C2C's new white paper, "PSTs from Discovery to the Archive" and find out how you can get PSTs under control. This new paper covers
- assessing the risks associated with PSTs
- alternatives to a PST strategy
- how to locate local or even laptop based files
- user transparency to the discovery & control process
- steps in moving towards a central archive
- action list for addressing PSTs.
Read the new white paper now!
http://www.c2c.com/pst.htm

Editor's note: Share Your Exchange Discoveries and Get $100
Share your Exchange Server and Outlook discoveries, comments, or problems and solutions for use in the Exchange & Outlook Administrator print newsletter's Reader to Reader column. Email your contributions (500 words or less) to [email protected]. We edit submissions for style, grammar, and length. If we print your submission, you'll get $100.

==== 1. Commentary: When Tar Is Your Friend ==== by Paul Robichaux, Exchange Editor, [email protected]

Spammers send spam because they make money at it. In fact, if you ever want to get your blood up, try reading a book such as "Inside the Spam Cartel" (Syngress) or "Spam Kings" (O'Reilly), which detail the myriad sleazy tricks that spammers use. Of course, as an Exchange Server administrator, you already know the number-one trick: Spammers send a lot of mail that contains forged sender and recipient addresses. Even though filtering these bogus addresses is relatively straightforward, doing so consumes your resources, not the spammers, and throwing inbound spam on the floor doesn't do anything to discourage future outbursts.

What if you could make spamming uneconomical for the spammer? If you could somehow make each bogus delivery attempt take an unreasonable amount of time--say, 30 seconds--a spammer who wanted to send your organization 10,000 messages would need a little more than 83 hours to do so. Intentionally slowing down or delaying illegitimate connections is a process known as "tarpitting," and it has an illustrious history. Until now, tarpitting software has generally been available only to UNIX mail administrators. But this week, Microsoft released a Windows Server 2003 SMTP service hotfix that lets you tarpit incoming SMTP messages that have been sent to nonexistent addresses. The change doesn't affect legitimate senders or messages sent by authenticated users, but it drastically affects directory-harvest attacks, password-cracking attacks, and scripted spam runs. The tarpit delay is adjustable, so you can select the degree of punishment you want to hand out to spammers who try to flood your server.

To install the tarpit capability, you need two components. The first is Microsoft Security Bulletin MS04-035 (Vulnerability in SMTP Could Allow Remote Code Execution--885881), which fixes a remote code execution vulnerability in the Windows 2003 SMTP server (go to http://support.microsoft.com/?kbid=885881 for details). The second component is the hotfix that provides the tarpit support; that fix is available via the Microsoft article "A security update is available to help prevent the enumeration of Exchange Server 2003 e-mail addresses" ( http://support.microsoft.com/?kbid=842851 ). After you install these components--which work only on Exchange Server 2003 running on Windows 2003--you can add a new REG_DWORD registry entry, HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SmtpSvc\Parameters\TarpitTime. Set the entry's value to the number of seconds of delay that you want to impose on spam requests. After setting the TarpitTime value, stop and restart the SMTP service. That's it!

The tarpit feature works on Windows 2003's SMTP server too, so if you're using it as a front end to your Exchange servers (perhaps with a dedicated SMTP virus scanner), you can still use the feature. However, when you install the feature on an Exchange 2003 server, you can use recipient filtering to gain more granular control.

The tarpit feature doesn't block messages sent to valid recipients, even if those messages are spam, so it isn't a complete antispam solution in and of itself. However, its release as a standalone hotfix bodes well for the kinds of transport control and antispam features we're likely to see in future Exchange releases and shows that Microsoft is paying attention to measures that have been successful in reducing spam in the wider messaging community.

~~~~ Sponsor: Email Archiving for Any Budget ~~~~
Need a cost-efficient archiving solution? Archive Attender from Sherpa Software automatically archives information from Exchange mailboxes and PST files to a secure, external storage device.
Messages and attachments can be archived by age, size and user. Search the archive by keyword, subject, sender and date. Also, eliminate unnecessary PST files by moving PST content into the archive. Recover storage space, address compliance issues, secure information and reduce liabilities. Archive Attender is easy to install and there is no additional hardware or client installations required. Download a FREE TRIAL today!
http://www.sherpasoftware.com/windowsnetEO.shtml

==== Announcements ==== (from Windows IT Pro and its partners)

Try a Sample Issue of Windows Scripting Solutions
Windows Scripting Solutions is the monthly newsletter that shows you how to automate timeconsuming, administrative tasks by using our simple downloadable code and scripting techniques. Sign up for a sample issue right now, and find out how you can save both time and money. Plus, get online access to our popular "Shell Scripting 101" series--click here!
http://www.winscriptingsolutions.com/rd.cfm?code=fsep264cup

Microsoft Exchange Connections Conference
Mark your calendar for the next Microsoft Exchange Connections, October 30-November 2, 2005, at the Manchester Grand Hyatt in San Diego, California. Microsoft and Windows IT Pro partner to bring IT professionals from around the world together again! Call 203-268-3204 or 800-505-1201 or check our Web site for details.
http://www.devconnections.com

Get the Cliffs Notes to Migrating from Novell NDS to Windows Server 2003
Migrating from Novell NDS to Windows Server 2003 means moving from an established directory service to the latest version of Active Directory. Missing a step in the migrating process could mean real problems. Use our quick reference guide as a cheat-sheet to help you manage each step of the migration process. Download the guide now.
http://www.windowsitpro.com/essential/index.cfm?code=1206emailannc

Managing and Securing Corporate Email Forum: January 31 – February 2, 2004, Harrah’s, Las Vegas
Spammers and negligent email users are draining your budget and resources! With over 20 case studies, discussion groups and workshops, you’ll walk away with end user strategies, proven to make your organization’s email safer. For a full agenda and registration information log on to
http://www.iqpc.com/NA-2237-01/ITPRO or call 1-800-882-8684.

~~~~ Hot Release: Reporting on Exchange with PROMODAG Reports V6.6 ~~~~ Analyze, report, strategize and optimize your messaging system! Easy to use reporting solution that simplifies management of Exchange organizations. Nothing to install on the server, all Exchange versions supported, priced per server. Reports on mailboxes, public folders content, traffic, OWA, servers communication, delivery time and more...
Free fully functional evaluation:
http://www.promodag.com/indexitpro091204.asp

==== 2. Resources ====

Test Your AD Knowledge Congratulations to the winners of the Windows IT Prolympics. Contestants tested and showed off their Active Directory (AD) prowess by taking a written exam and participating in a virtual-lab skills test.
The gold medal went to Steven Schullo, Hixson, Tennessee. He won a trip to TechEd, a subscription to Windows IT Pro, and an AD t-shirt. Michael Royer, West Hollywood, California, took home the silver medal. He won an iPod, a subscription to Windows IT Pro, and an AD t-shirt. And Nathan Casey, Santa Rosa, California, won the bronze medal and received an xBox, a subscription to Windows IT Pro, and an AD t-shirt. You'll be able to read more about these IT Prolympians in the January issue of Windows IT Pro.
Even though the contest is over, you can still test your AD knowledge and see how you stack up against your peers. Simply go to http://www.windowsitpro.com/itprolympics , download the study guide, then take the written and virtual-lab exams. Challenge yourself and learn at the same time.

Featured Thread: Delayed Outlook Messages
A forum reader is trying to track down the cause of a delay in message delivery to random Outlook users. If you can help or want to join the discussion, visit
http://www.winnetmag.com/forums/rd.cfm?cid=40&tid=128088

Outlook Tip: Choosing Calendar Colors by Sue Mosher, [email protected]

Q: I'm displaying several other users' calendar folders in Microsoft Office Outlook 2003. Can I set the color that each one uses?
Find the answer (and links to more great tips) at http://www.windowsitpro.com/article/articleid/42619/42619.html

==== Events Central ==== (A complete Web and live events directory brought to you by Windows IT Pro: http://www.windowsitpro.com/events )

Get a Free Windows IT Pro Subscription at the Server Consolidation Roadshow
Come and join us for this free event and find out how a more strategic and holistic approach to IT planning helps organizations increase operational efficiency and facilitate the implementation of new technology. Attend and get a free 6-month digital Windows IT Pro subscription. Plus, you could win an iPod! Sign up today.
http://www.windowsitpro.com/roadshows/serverconsolidation/index.cfm?code=1206emailannc

==== 3. New and Improved ==== by Angie Brew, [email protected]

Manage Your Email
Nemx Software released Nemx Power Tools for Exchange 5.0, a suite of content-management components that help you manage email content and keep spam and viruses out of your Exchange Server environment. Power Tools measures the frequency and destination of incoming external email messages and automatically sets up a list of "friendly domains." The product features Concept Manager, a tool that uses thesaurus matching to monitor and block email, based on the entire meaning of a message. You can create and implement Action Handlers to perform multiple actions on any message that's flagged as spam, infected with a virus, or determined to contain content violations. Power Tools for Exchange is available in an Internet edition and an advanced edition. For pricing, contact Nemx Software at 613-831-2010.
http://www.nemx.com

Tell Us About a Hot Product and Get a T-Shirt!
Have you used a product that changed your IT experience by saving you time or easing your daily burden? Tell us about the product, and we'll send you a T-shirt if we write about the product in a future Windows IT Pro What's Hot column. Send your product suggestions with information about how the product has helped you to [email protected].

~~~~ Contact Us ~~~~

About the newsletter -- [email protected]
About technical questions -- http://www.windowsitpro.com/forums
About product news -- [email protected]
About your subscription -- [email protected]
About sponsoring UPDATE -- [email protected]