| Event Id | 4192 |
| Source | MSExchangeIMC |
| Description | Message Transfer Delivery of a message was aborted because it appeared to be an impersonation attempt or unwanted bulk mail. |
| Event Information | According to Microsoft : CAUSE: The reason for this behavior is that by default the turf directory is set to \Turfdir in the registry. This directory is not created by the Microsoft Exchange Server setup process. WORKAROUND: WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk. • Create a directory called Turfdir in the root of the hard disk that holds the Exchange system files. This should allow the messages to be copied to that directory. - or - • Create a directory elsewhere, and change the registry to point to the path of this new directory. You can accomplish this by performing the following steps: 1. Start Registry Editor (Regedt32.exe). 2. Locate the TURFDIR value under the following key in the registry: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSExchangeIMC \Parameters\ NOTE: The above registry key is one path; it has been wrapped for readability. 3. Highlight the TURFDIR value and on the Edit menu, select String. Change the string to reflect the desired path. Add the drive letter if a drive other then C is desired. 4. Quit Registry Editor. |
| Reference Links | TURFDIR Must Be Manually Created for Message Filtering |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.