Exchange no longer receives Mails after Email and Server Security Installation

MarkusMitK

Hello,

 

For the first time I installed a F-Secure product and it was going down very fast straight to Exchange hell.

 

The server is a MS Windows SBS 2011 with Exchange. In this case the SBS Exchange receives the messages from a local installed POP3-connector called POPcon.

 

Informations about POPcon: http://www.servolutions.com/popcon.htm?_ga=2.132317838.12212364.1507095231-1184183453.1488278761

 

I installed the Business Suite Policy Manager on the MS Windows SBS 2011.

 

 

Then i wanted to install the Email and Server Security to the Server with the Policy Manger by searching for Hosts. The Policy Manager found the Server, but an error message about insufficent rights appeart in the deployment process.

 

So I installed the Email and Server Security directly, without the Policy Manger.

 

And now the trouble began. From now on, the Exchange is no longer receiving emails and doesn't respond to requests.

 

Telnet on port 25 doesn't work too.

 

I checked the receiveconnectors but the configuration is ok.

 

Reinstallation of Email and Server Security doesn't changed anything.

 

Actually I don't have any idea what happend. Hope somebody can help.

MarkusMitK

After a nice call from an F-Secure engineer this afternoon, I got some hints how the "Email and Server Security" works. One was "F-Secure doesn't change the Exchange configuration". So uninstallation of the F-Secure products should have done the job, but in my case the failure persists.

 

Well I found the source of the problem. It wasn't an Exchange or F-Secure problem!

 

An unclean uninstallation of Trend Micro Worry Free Business Security and his message security component was the "root of the evil". Worry free, really? I wasn't near close to worry free the last hours!

 

So, thats the way I found out what the problem was:

 

1.  I looked at the Windows Services and recognized, that after a short time the Microsoft Exchange Transport service crashed again and again.

 

2. So I opened a Powershell and checked the transport Agents

Get-TransportAgent

 What I got was this:

Identity Enabled Priority
-------- ------- --------
ScanMail SMTP Receive Agent True 1
ScanMail Routing Agent True 2
Transport Rule Agent True 3
Journaling Agent True 4
AD RMS Prelicensing Agent False 5
Connection Filtering Agent True 6
Content Filter Agent True 7
Sender Id Agent True 8
Sender Filter Agent True 9
Recipient Filter Agent True 10
Protocol Analysis Agent True 11

 

3. ScanMail? What the hack?

Get-TransportAgent ScanMail* | fl

Example:

Identity : ScanMail SMTP Receive Agent
Enabled : True
Priority : 1
TransportAgentFactory : TrendMicro.SMEX.hookE12TransportAgent.hookE12SmtpReceiveAgentFactory
AssemblyPath : C:\Program Files\Trend Micro\Messaging Security Agent\hookE12TransportAgent.dll

 

4. Let's get rid of them!

Get-TransportAgent ScanMail* | Uninstall-TransportAgent

 

5. (Re)Start the Windows Exchange-Transport service and that's it!

 

After a little google research i found out, that this is an known issue for more than 3 years!

 

Other users described that the failure doesn't appear directly after the uninstallation, but after a reboot.

 

I checked receiving and sending emails after uninstallation, everything was fine. But didn't checked after the reboot and startet directly with the F-Secure Email and Server Security. So that first pointed me in the wrong direction.

 

Eventually this helps somebody with the same problem.