Release From Quarantine by Email Fails From an Exchange 2007/2010 Server Without Access to Active Directory

Products

• Mail Security for Microsoft Exchange

Issue/Introduction

I release an item from quarantine by email. The item shows as gone from the Quarantine. However after a refresh the item shows back up in the Quarantine.

 

Conditions

• Exchange server has no access to Active Directory. A typical scenario for this situation is an Exchange Server that is set up as an Edge Server role.

• At least one internal domain is configured.

1. Click on Admin tab. Select Views|System Settings.
2. If the checkbox Enable list of internal domains is checked and there is at least one domain listed in the textbox then this condition is met.

• Debug log shows errors looking up the internal domain.

Capture a debugview log using this KB article: How to obtain a DebugView log file from Symantec Mail Security 6.0 for Microsoft Exchange.

You'll see entries similar to the following:

[1328] SAVFMSETask(530)[17DC] 2009-10-08 13:35:09 0437ms:
[1328] ..\..\..\src\Server\SAVFMSETask\TaskThreads.cpp(81) :
[1328] TQuarantineReleaseThread::OnCustomObject
[1328]
[1328] SAVFMSETask(530)[17DC] 2009-10-08 13:35:09 0437ms:
[1328] ..\..\..\src\Server\SAVFMSESHARED\TQuarantine.cpp(136) :
[1328] Found file = SYQ12845fbf1.QRM
[1328]
[1328] SAVFMSETask(530)[17DC] 2009-10-08 13:35:09 0437ms:
[1328] ..\..\..\src\Server\SAVFMSESHARED\TEncryptedItem.cpp(995) :
[1328] Decrypting file D:\Program Files(x86)\Symantec\SMSMSE\6.0\Server\Quarantine\SYQ12845fbf1.QRM to file D:\Program Files (x86)\Symantec\SMSMSE\6.0\Server\Quarantine\SYQ17dc16b61.QR.
[1328]
[1328]
[1328] SAVFMSETask(530)[17DC] 2009-10-08 13:35:09 0437ms:
[1328] ..\..\..\src\Server\SAVFMSESHARED\TEncryptedFile.cpp(824) :
[1328] Header claims attachment is 75776 bytes
[1328]
[1328] SAVFMSETask(530)[17DC] 2009-10-08 13:35:09 0437ms:
[1328] ..\..\..\src\Server\SAVFMSESHARED\TEncryptedFile.cpp(1115) :
[1328] Actually decrypted 75776 bytes
[1328]
[1328] SAVFMSETask(530)[17DC] 2009-10-08 13:35:09 0437ms:
[1328] ..\..\..\src\Server\SAVFMSESHARED\NtfyMsg.cpp(166) :
[1328] Debug Trace: HRESULT=0x8007054B - The specified domain either does not exist or could not be contacted.
[1328]
[1328] SAVFMSETask(530)[17DC] 2009-10-08 13:35:09 0437ms:
[1328] ..\..\..\src\Server\SAVFMSESHARED\NtfyMsg.cpp(172) :
[1328] Debug Trace: HRESULT=0x80004005 - Unspecified error
[1328]
[1328] SAVFMSETask(530)[17DC] 2009-10-08 13:35:09 0437ms:
[1328] ..\..\..\src\Server\SAVFMSESHARED\NtfyMsg.cpp(344) :
[1328] Debug Trace: HRESULT=0x80005001
[1328]
[1328] SAVFMSETask(530)[17DC] 2009-10-08 13:35:09 0453ms:
[1328] ..\..\..\src\Server\SAVFMSESHARED\SharedUtils.cpp(1368) :
[1328] Debug Trace: HRESULT=0x8007054B - The specified domain either does not exist or could not be contacted.
[1328]
[1328] SAVFMSETask(530)[17DC] 2009-10-08 13:35:09 0453ms:
[1328] ..\..\..\src\Server\SAVFMSESHARED\SharedUtils.cpp(1395) :
[1328] Debug Trace: HRESULT=0x8007054B - The specified domain either does not exist or could not be contacted.
[1328]
[1328] SAVFMSETask(530)[17DC] 2009-10-08 13:35:09 0453ms:
[1328] ..\..\..\src\Server\SAVFMSESHARED\SharedUtils.cpp(1948) :
[1328] Debug Trace: HRESULT=0x8007054B - The specified domain either does not exist or could not be contacted.

Cause

Symantec Mail Security for Microsoft Exchange has an issue in the code that handles release by email on a server with no access to active directory.

Resolution

This problem is fixed in Symantec Mail Security 6.5.1 for Microsoft Exchange. To download the latest release, read Obtaining an update or an upgrade for a Symantec Corporate product.

Workaround

Release the item to a file.

1. Open the SMSMSE Administration Console.
2. Click the Monitors tab.
3. Click the Views|Quarantine item.
4. Right click a quarantine item and select Release to File (save)...
5. Click Yes at the dialog Do you also want to remove the selected item(s) from the Quarantine?.
6. Click OK at the dialog with the name of the released file.