Prev: IPX/SPX VPN access to SBS network
Next: error - did not register with DCOM within required timeout
From: Stuart on 24 May 2005 03:19
I have the following event log 10-15 times per day:
-----
This is an SMTP protocol log for virtual server ID 1, connection #45. The
client at "***.***.233.218" sent a "xexch50" command, and the SMTP server
responded with "504 Need to authenticate first ". The full command sent was
"xexch50 2244 2". This will probably cause the connection to fail. For more
information, click http://www.microsoft.com/contentredirect.asp.
-----

The IP address is another company's exchange server (a customer) and we
receive quite a bit of email traffic which is all successful.

Why would I be getting this event? And should I worry? There are also
occasions when this event occurs with IP addresses where there is no reverse
dns record (i.e. spammers).



From: "Brandy Nee [MSFT]" on 25 May 2005 04:21
Hello,

Thank you for posting to the SBS Newsgroup.

From your post, I understand that you have the error information in the
event log which is: 504 Need to authenticate first. You want to know how
this issue happens, and how to resolve it. If I have misunderstood your
concern, please let me know.

Please see my steps below:

1. Please perform the steps shown in the KB article below to test whether
it works or not.

843106 How to troubleshoot the "504 need to authenticate first" SMTP
protocol
http://support.microsoft.com/?id=843106

2. If this issue persists, please run "eventvwr", paste the full content of
the error information to the Newsgroup. Like Event Type, Event Source,
Event Category, Event ID, and Description.

3. Please help me to collect MSExchangeTransport event logs. To do so,

1) On the server, go to the Exchange System Manager.

2) Expand to Yourserver(Exchange)\Servers\Yourserver.

3) Right click Yourserver, go to Properties, and select Diagnostics Logging.

4) In the Services Console, highlight MSExchangeTransport, then click each
Category which are displaying in the Categories Console, change the Logging
level from None to Maximum.

5) Reproduce the issue.

6) Run "eventvwr" and paste all the related issue to the Newsgroup.

4. Also, please collect the Protocol Logging and paste the full content to
the Newsgroup. To do so, please see:

How to troubleshoot for Exchange Server 2003 transport issues
http://support.microsoft.com/?id=821910#5

Thanks for your time. If there is anything unclear or you need any
assistance, please feel free to post back. I am looking forward to your
reply.

Best regards,

Brandy Nee

Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security

=====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
=====================================================

This posting is provided "AS IS" with no warranties, and confers no rights.

From: Stuart on 2 Jun 2005 13:09
Thanks Brandy

I've looked through the articles which are helpful. I had been through some
other ones but these identified some 'normal' behaviours that occur when the
Exchange server isn't part of the domain. None of the servers that create
this message should be on our network.

I just wanted to check why this happended to ensure we weren't being
targeted by hackers. Some days we have 20-30 of these errors - is there a way
of eliminating them?

Thanks
Stuart

""Brandy Nee [MSFT]"" wrote:

> Hello,
>
> Thank you for posting to the SBS Newsgroup.
>
> From your post, I understand that you have the error information in the
> event log which is: 504 Need to authenticate first. You want to know how
> this issue happens, and how to resolve it. If I have misunderstood your
> concern, please let me know.
>
> Please see my steps below:
>
> 1. Please perform the steps shown in the KB article below to test whether
> it works or not.
>
> 843106 How to troubleshoot the "504 need to authenticate first" SMTP
> protocol
> http://support.microsoft.com/?id=843106
>
> 2. If this issue persists, please run "eventvwr", paste the full content of
> the error information to the Newsgroup. Like Event Type, Event Source,
> Event Category, Event ID, and Description.
>
> 3. Please help me to collect MSExchangeTransport event logs. To do so,
>
> 1) On the server, go to the Exchange System Manager.
>
> 2) Expand to Yourserver(Exchange)\Servers\Yourserver.
>
> 3) Right click Yourserver, go to Properties, and select Diagnostics Logging.
>
> 4) In the Services Console, highlight MSExchangeTransport, then click each
> Category which are displaying in the Categories Console, change the Logging
> level from None to Maximum.
>
> 5) Reproduce the issue.
>
> 6) Run "eventvwr" and paste all the related issue to the Newsgroup.
>
> 4. Also, please collect the Protocol Logging and paste the full content to
> the Newsgroup. To do so, please see:
>
> How to troubleshoot for Exchange Server 2003 transport issues
> http://support.microsoft.com/?id=821910#5
>
> Thanks for your time. If there is anything unclear or you need any
> assistance, please feel free to post back. I am looking forward to your
> reply.
>
> Best regards,
>
> Brandy Nee
>
> Microsoft CSS Online Newsgroup Support
>
> Get Secure! - www.microsoft.com/security
>
> =====================================================
> When responding to posts, please "Reply to Group" via your newsreader so
> that others may learn and benefit from your issue.
> =====================================================
>
> This posting is provided "AS IS" with no warranties, and confers no rights.
>
>
From: "Brandy Nee [MSFT]" on 6 Jun 2005 21:26
Hello Stuart,

Thank you for posting back.

I am glad to hearing that the information helps. If you have any further
questions or concerns, please let me know. I am glad to be of assistance,
and I am looking forward to hearing from you soon.

Best regards,

Brandy Nee

Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security

=====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
=====================================================

This posting is provided "AS IS" with no warranties, and confers no rights.

From: Stuart on 7 Jun 2005 03:01
Hi Brandy

No change following the registry edit - error as follows:

Event Type: Error
Event Source: MSExchangeTransport
Event Category: SMTP Protocol
Event ID: 7010
Date: 06/06/2005
Time: 17:43:43
User: N/A
Computer: SERVER
Description:
This is an SMTP protocol log for virtual server ID 1, connection #2. The
client at "195.102.148.25" sent a "xexch50" command, and the SMTP server
responded with "504 Need to authenticate first ". The full command sent was
"xexch50 2004 2". This will probably cause the connection to fail.

For more information, click http://www.microsoft.com/contentredirect.asp.

Any more thoughts?
Thanks
Stuart

""Brandy Nee [MSFT]"" wrote:

> Hello Stuart,
>
> Thank you for posting back.
>
> I am glad to hearing that the information helps. If you have any further
> questions or concerns, please let me know. I am glad to be of assistance,
> and I am looking forward to hearing from you soon.
>
> Best regards,
>
> Brandy Nee
>
> Microsoft CSS Online Newsgroup Support
>
> Get Secure! - www.microsoft.com/security
>
> =====================================================
> When responding to posts, please "Reply to Group" via your newsreader so
> that others may learn and benefit from your issue.
> =====================================================
>
> This posting is provided "AS IS" with no warranties, and confers no rights.
>
>
 |  Next  |  Last
Pages: 1 2
Prev: IPX/SPX VPN access to SBS network
Next: error - did not register with DCOM within required timeout