| Event Id | 2028 |
| Source | MSExchangeIS Public |
| Description | The delivery of a message sent by a public folder /o=MICROSOFT/ou=SITENAME/cn=RECIPIENTS/cn=PublicFolderName213E31CA213E31CA213E31CA18482398000BC1 has failed To: Recipient Cc: |
| Event Information | According to Microsoft: CAUSE : This problem can occur if an antivirus solution that is based on the antivirus application programming interface (API) is under stress on the Exchange Server 5.5 computer at the same time that an autoforward-type public folder rule is running. When a post is made to the public folder, the rule generates a new message to deliver to the recipients that are specified in the rule. Because the post contains an attachment, the attachment must be submitted to the antivirus vendor for scanning. If the new message is being scanned when the message delivery is attempted, the Exchange Server computer attempts to deliver the message several times, with a delay between each attempt. This behavior can be controlled by modifying two registry keys that are described in the "Workaround" section of this article. WORKAROUND: To work around this problem if you are an Exchange Server administrator, examine and adjust the SendRetries and SendRetryInterval registry values for your environment. However, if this problem still occurs after you make adjustments to these registry values. To adjust the SendRetries and SendRetryInterval values: 1. Start Registry Editor (Regedt32.exe).2. Locate the SendRetries value under the following key in the registry: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSExchangeIS\VirusScan3. On the Edit menu, click REG_DWORD, change this decimal value as applicable (the default value is 2), and then click OK. 4. Locate the SendRetryInterval value under the following key in the registry:HKEY_LOCAL_HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSExchangeIS\VirusScan5. On the Edit menu, click REG_DWORD, change this decimal value as applicable (the default value is 60000), and then click OK.6. Quit Registry Editor. If this is happening on Exchange 2007, you may not have your Spam Quarantine set up properly. The way the Antispam quarantine works on Exchange 2007 is that the message that is considered spam is wrapped in a NDR. Since NDRs can only be sent to mailboxes and not public folders, it will create this error in the App log every time you get a quarantined spam message. See the link to “Configuring and Managing Spam Quarantine” for information on how to properly set up the Spam Quarantine. Following are Some more causes for this event to be generated: i.This issue can occur if a moderated public folder or another rule that forwards posts to Exchange Server mailboxes sends e-mail messages to specified accounts. If an account is deleted, the rule still attempts to send the message and generates an NDR and the events in the "Symptoms. ii. NDRs can only be delivered to mailboxes, not to public folders. If a user sends a message on behalf of a public folder and that message generates a NDR, the NDR should be delivered to the public folder. However, as Exchange cannot deliver it to the public folder, the NDR is deleted and Exchange reports that to the event log. iii. If you are using delivery restrictions, be sure to verify they are set accordingly on the Exchange servers configured for SMTP. According to News Group : When you install Exchange 5.5, by default, automatic replies to the Internet are disabled. Have a look on the Internet Mail tab of the IMS property pages. In particular, click on the advanced options tab and see if any of those settings are affecting your system."fixed this problem by granting permission of anonymous on that folder to more than a contributor. |
| Reference Links | XADM: Public Folder Rules Are Disabled When You Use an Antivirus API-Based Solution |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.