Stopping Admin Alert SPAM

From: Ed Sunder (edsunder@3hd.com)
Date: 01/22/03

  • Next message: Shane Brooks: "Re: Bypass Traverse Checking?" 
    Date: Wed, 22 Jan 2003 10:41:21 -0500
From: "Ed Sunder" <edsunder@3hd.com>
To: <focus-ms@securityfocus.com>

    Okay, I haven't found a good answer to this online and would appreciate
    any advice this group has... Our servers are being deluged with Admin
    Alert Spam's. At a certain point, particularly over a weekend, with no
    one actively looking at the machine, if there are enough messages it can
    cause some services to shut down. I read that blocking ports 137-139
    would stop these messages, but I did that in our firewall and yet the
    messages still came.

    I'm wondering:
    1) If I disable the messenger service on the server, could there be any
    bad ramifications of that, other than potentially not receiving
    legitimate messages about system shutdowns etc.? Also, would that stop
    the problem?
    2) Is there some other way to stop these messages? Are they coming in on
    another port etc.?

    Any help on this would be appreciated.
    Thanks in advance,

    Ed Sunder
    Three HD

    Relevant Pages

    • Re: B5 actor sighting - Boxleitner on SyFy (was Re: Bruce Boxleitner)
      ... shift folks because I knew other members of my team tended ... The few recurring problems (e.g. mail servers ... stuff resistant to the "normal" problems, so when we get an alert, it ... Work had to call through D*C ops ...
      (rec.arts.sf.tv.babylon5.moderated)
    • Re: Process (store.exe) Alert on SERVER
      ... Install the Update to SP1 ... Frank McCallister SBS MVP ... >I installed Exchange 2003 Service Pack 1 on all three servers and now I am ... > You can disable this alert or change its threshold by using the Change ...
      (microsoft.public.windows.server.sbs)
    • Re: Constant Pop-up messages
      ... >Pointing the pop-up servers to 127.0.0.1 in your local host file will block ... Here is a list of some ad servers. ... number of pop-ups caused by the messenger service, ...
      (microsoft.public.inetserver.iis.security)
    • Re: Critical Alert = Process (store.exe)
      ... > Thanks Gary,but i'm not familier with the acronym PSS. ... >> GaryK ... >>>I have two SBS 2003 Premium servers that manage. ... >>> You can disable this alert or change its threshold by using the Change ...
      (microsoft.public.windows.server.sbs)
    • Re: Critical Alert = Process (store.exe)
      ... After doing so I started to get the following critical alert in the server performance report on both servers. ... You can disable this alert or change its threshold by using the Change Alert Notifications task in the Server Management Monitoring and Reporting ... I have checked and in both casses the exchange information store service is running and email appears to be working fine. ...
      (microsoft.public.windows.server.sbs)