So I work for a community college. And .edu’s are very, very popular with phishers. And we have users that still respond to those emails that ask them for their username and password. So, every semester, we have at least one or two compromised accounts. And these can do a ton of damage to your email reputation in one overnight binge.
Now, being the kind of person that likes to occastionally sleep, I needed a way to stem the flood of spam until I could be awake enough to deal with it. So how, on exchange 2003, do you do that without interfereing with normal email operations or buying additional products?
Well I came up with what I think is a pretty nifty script and I’m going to share it with you now.
First we have to get the queues and we do that with the get-wmiobject for exchange. Can’t give you a ton more info there because I shamelessly googled it.
$queues=get-wmiobject -class exchange_smtpqueue -namespace root\microsoftexchangev2 -computername yourserverhere
Next we pipe the results of that to a foreach loop which gets us the number of messages in each queue. The foreach loop has an IF statement in it that increments a counter if the queue has more then 10 messages in it.
| foreach-object{if($_.messagecount -gt 10){$counter=$counter + 1}}
Next we check to see the value of the counter. If the value of counter is greater then 3 we drop into the IF statement and send an email with the value of counter.
$queues=If($counter -gt 3){$emailFrom = "me@blah.blah"
$emailTo = "me@blah.blah,you@blah.blah,everyone@blah.blah"
$subject = "Servername Queues are Filling Fast"
$body="More than " + $counter + " queues are filling!"
$smtpServer = "yoursmtp.server.com"
$smtp = new-object Net.Mail.SmtpClient($smtpServer)
$smtp.Send($emailFrom,$emailTo,$subject,$body)
The step that is very important comes next. We’re going to actually stop the smtp service on the exchange server so we don’t flood the world with more spam.
sc.exe \\yourserver.name.here stop smtpsvc
Then we close the IF statement and clear the counters just in case.
Complete version of the script. Bits in bold you need to enter your own info for. As always, if you can do it better, share with me.
$queues=get-wmiobject -class exchange_smtpqueue -namespace root\microsoftexchangev2 -computername yourserverhere | foreach-object{if($_.messagecount -gt 10){
$counter=$counter + 1
}}
$queues=If($counter -gt 3){$emailFrom = "me@blah.blah"
$emailTo = "me@blah.blah,you@blah.blah,everyone@blah.blah"
$subject = "Servername Queues are Filling Fast"
$body="More than " + $counter + " queues are filling!"
$smtpServer = "yoursmtp.server.com"
$smtp = new-object Net.Mail.SmtpClient($smtpServer)
$smtp.Send($emailFrom,$emailTo,$subject,$body)
sc.exe \\yourserver.name.here stop smtpsvc
}
$counter=0
$queues=0
Live@EDU Pearls 