Exchange 2013 Malware Filter and ScanningProcess.exe

Hi all...
We have an Exchange 2013 environment with an external Mail Security Appliance (FortiMail), because of this our Malware Filter was disabled, but the process ScanningProcess.exe (Microsoft Filtering Server Scanning Process) are still running and
sometimes hangs the CPU for several minutes scanning attachments.
Is there a method to disable the process and avoid the CPU high use?
(all servers have Exchange 2013 CU7)

Hi Nico,
According to the description, I know it doesn't send to Mailbox-B a Alert Text as expected, just like following problem:
After the appaling result, i made an additional test. I tested to send internal Malware mails from Mailbox-A to Mailbox-B. The Mail was send from Mailbox-A with no interruption and only on the receive Mailbox-B the attachment was deleted.
I suggest double check this issue on OWA to verify whether Mailbox-B have received the Alert Text.
If in OWA everything is OK, it seems an issue on the Outlook client side.
If this issue exists in OWA, I suggest get the Malware Policy in details to check whethe it specifies some limitation.
Thanks
Mavis
Mavis Huang
TechNet Community Support

Similar Messages

Exchange 2013 SPAM filter- can wildcards be used for partial word matching?

We have migrated to Exchange 2013 and have set up the Anti-Spam and Anti-Malware features. One thing I am trying to figure out is how to setup a wildcard filter for partial words. For example, I have Viagra listed but it doesn't catch something
like USviagra. How would I set a filter for catching anything that ahs the word Viagra buried in it?
Thanks.

I have also seem a large increase in spam since upgrading to Exchange 2013.The malware engines are enabled and content filtering is turned on but everyone is getting about 20 emails a day from the Pfizer eStore. ForeFront used to block it all.
Also images are blocked in standard emails but in these Viagra emails the images all show!
The title is always a bit different too and it is spelt with extra i's. Surely this shouldn't be too much and defeat the content filter!
Robin
Robin Wilson

Exchange 2013 recipient filter working bad

Hello,
I have seen, that the recipient filter in Exchange 2013 is working a Little bit different like in the older Versions.
Here an Example (Exchange 2013):
<<<220 EX2013.test.local Microsoft ESMTP MAIL Service ready at .....
>>>helo test
<<<250 EX2013.test.local Hello [192.168.0.10]
>>>mail from:[email protected]
<<<250 2.1.0 Sender OK
>>>rcpt to:[email protected]
<<<250 2.1.5 Recipient OK
>>>data
<<<354 Start mail input; end with <CRLF>.<CRLF>
>>>Subject: Test2
>>>
>>>Test2
>>>.
<<<550 5.1.1 User unknown
All other pervious Versions of Exchange 2003, 2007, 2010 are working different:
Look here (Exchange 2010):
<<<220 ex2010.test.local Microsoft ESMTP MAIL Service ready at ...
>>>helo helo test
<<<250 xxxxxxx Hello [192.168.0.20]
>>>mail from:[email protected]
<<<250 2.1.0 Sender OK
>>>rcpt to:<[email protected]>
<<<250 2.1.5 Recipient OK
>>>rcpt to:<[email protected]>
<<<550 5.1.1 Invalid RecipientThis is very simple and more effectiv than the other Strategie, because I won't have data inhouse and then the server decide, if recipient are valid, there is no reason to change this.
Thank you for a help
Bernd

Hi,
I noticed that the issue happened when you released quarantined messages to their intended recipients by using the Send Again feature in Microsoft Outlook.
Does the issue happen to all quarantined mailboxes. Please confirm if the messages have been sent to the intended recipients successfully or sent failed with NDR returned because of the wrong email address.
Please try to
disable the mailbox quarantine then enable to check whether the issue persists. Also make sure there is no third-party program installed in Exchange server and local machine for quarantine mailboxes.
Regards,
Winnie Liang
TechNet Community Support

Exchange 2013 Licencing Terms and Agreements

When you install Exchange 2013 you have to agree to the terms and conditions with the /IAcceptExchangeServerLicenceTerms
If you dont setup.exe points you to a URL
The the URL is http://go.microsoft.com/fwlink/p/?LinkId=150127
However when you go to the link there is only an option for Exchange 2007 and 2010 ? Where’s the version selection for Exchange 2013?
And How has the rest of the world been accepting these license terms for Exchange 2013?
I need our legal department to give me (the technical guy) approval that I can accept these terms on behalf of the organization and without the terms I technically cannot go ahead..

Hi Riccardo,
For licensing related question, it's recommended to consult the local supplier for more accurate information,
you may
get effective solution timely:
http://support.microsoft.com/gp/customer-service-phone-numbers/en-us
Best regards,
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected]
Niko Cheng
TechNet Community Support

Exchange 2013 Content filter agent quarantined message: wrong address appears when I click "Send Again"

Hello,
This is a strange one. I have Exchange 2013 and outlook 2013 and I have been using the content filter agent as a layer of spam protection since we were on 2008 and 2007. I redirect all my spam to a quarantine mailbox and examine it daily for false positives.
When I find one I click "Send Again" from the message in the quarantine mailbox to forward it on to the original sender. Normally Oulook automatically populates it with the original recipient. Today I noticed one that, for some reason, inserted "groupwise-"
in the front of the address(so for example "[email protected]:3:1") This concerns me as there is no such address and I have no idea where it is pulling this address from. I don't
use groupwise software. The quarantine mailbox has info in a postmaster and abuse reporting email. It shows the address correctly as "[email protected]" Only when you click "Send Again" does it
insert this groupwise address. Any ideas why?
This has only happened on one email so far.
Thanks.

Hi,
I noticed that the issue happened when you released quarantined messages to their intended recipients by using the Send Again feature in Microsoft Outlook.
Does the issue happen to all quarantined mailboxes. Please confirm if the messages have been sent to the intended recipients successfully or sent failed with NDR returned because of the wrong email address.
Please try to
disable the mailbox quarantine then enable to check whether the issue persists. Also make sure there is no third-party program installed in Exchange server and local machine for quarantine mailboxes.
Regards,
Winnie Liang
TechNet Community Support

Exchange 2013 with CAS and HLB in different sites

Hello...
Coming son, we'll deploy Exchange 2013 with high availability in all roles. The CAS and Hub Transport roles, are with a HLB; and the Mailbox with DAG. The infrastructure is formed by:
Citi1:
- AD Site 1
- 1 Hardware Load Balance: HLB01 to load balance the CAS and Hub Transport of Exc01 and Exc02
- 2 Exchange: Exc01 and Exc02 multiroles Exchange Server 2013
- 1 DAG for Citi1 databases: conformed by the Exc01 and Exc02
Citi2:
- AD Site 2
- 1 Hardware Load Balance: HLB02 to load balance the CAS and Hub Transport of Exc03 and Exc04
- 2 Exchange: Exc03 and Exc04 multiroles Exchange Server 2013
- 1 DAG for Citi2 databases: conformed by the Exc03 and Exc04
The Active Directory is one forest with one domain. The Domain Controllers are Windows Server 2012. The Site1 and Site 2 are connected by a WAN link. The accepted domain is domain.com. The smtp address is @domain.com
How to make that users of Citi1 always connect throught the HLB01 to their mailboxes; and the users of Citi2 always connect throught the HLB02 to their mailboxes if the autodiscover.domain.com is the same for all users?
I have not found documentation about
this architecture. Please help me.
Thank you very much.
Best regards, Javier Uribe

Hi javier,
In this issue, I guess you can try to use site affinity for the Autodiscover service for intranet-based traffic.
To use site affinity, you specify which Active Directory sites are preferred for clients to connect to a particular Autodiscover service
instance.
You configure site affinity by using the
Set-ClientAccessServer cmdlet. This cmdlet lets you specify the preferred Active Directory sites for connecting to the Autodiscover service on a specific Client Access server. After you configure site affinity for the Autodiscover service,
the client will connect to the Autodiscover service as you specified.
According to your needs, you might want to allow users in the site1 to use site1, users in site2 to use site2 to access the Autodiscover Service.
You can configure site scope for Client Access servers in the Site1 by following command.
Set-ClientAccessServer -Identity "site1-cas" -AutodiscoverServiceInternalURI "https://internal.domain.com/autodiscover/autodiscover.xml" –AutodiscoverServiceSiteScope “site1”
The Command for Site2.
Set-ClientAccessServer -Identity "site2-cas" -AutodiscoverServiceInternalURI "https://internal.domain.com/autodiscover/autodiscover.xml" –AutodiscoverServiceSiteScope “site2”
Hope it helps
Best regards

Exchange 2013 CU1 UM and Avaya SM R6

Hello! I have a problem integrating Avaya and Exchange 2013 CU1 UM.
In 2010 environment it works perfectly fine, however with Exchange 2013 I was unable to make it work.
I was looking into the packets sent by 2010 and 2013, the only difference is in 302 reply. Exchange 2010 sends
extension@ip:port as the Contact URI while Exchange 2013 sends
extension@fqdn:port
Avaya doesn't seem to recognize the format and instead of connecting to the specified within the contact field service just keeps querying TCP 5060 (Call Router Service).
Is there any way to force Exchange to use IP within the contact field instead of FQDN?
Pointing SIP Entity to 5065/5067 directly is not an option for obvious reasons well covered here on the forums.

To get this functioning u must do the following! The CM will handle the "302 moved" FQDN request with this setup. CM 5.2.1 with 6.2 SM.
1. Lockdown the CAS server worker port to 5065. A restart of the UM service every couple of days will take care of this because it defaults to 5065.
2. CM hunt group set "voice mail handle" to a name. EX: sipms
3. SM create SIP entity for CAS server with entity link SM TCP 5060 -> CAS TCP 5060
4. SM Create SIP entity for each MBX server and port needed.
EX: Entity MBX-1-5062 IP 10.10.10.1 with entity link SM TCP 5062 -> MBX-1-5062 TCP 5062
Entity MBX-1-5065 IP 10.10.10.1 with entity link SM TCP 5060 -> MBX-1-5065 TCP 5065
Note: IF the SM is not listening on 5060 for the 5065 link MWI and "play on phone" will fail. This is why you need to lockdown the worker port to 5065.
5. SM Create routing policies for each entity.
6. SM create regular expressions for the CAS server and each of the MBX server entities and assign to the appropriate routing policy. The examples below are for one CAS server and one MBX server. There are one CAS and six MBX servers in my environment,
so I have 13 routing policies and 13 reg expressions.
EX: "sip:sipms@example\.org" asign to CAS policy.
"sip:sipms@mbx1@example\.org:5062.*" assign to MBX-1-5062 policy.
"sip:sipms@mbx1@example\.org:5065.*" assign to MBX-1-5065 policy.
Hopefully this is enough to get you going. I would have killed to have this information when I started on my quest!

Exchange 2013 Health mailbox and Journaling

Hi All,
We have recently build green field Exchange 2013 environment with standard journaling. Now we are seen that as per journal capture process it captures health mailboxes emails as well.
As we all know we will use options ignore/disable health mailboxes emails
Method 1 : Dynamic DL
Method 2 : Use global override
http://support.microsoft.com/kb/2823959/en-us
My questions
if go for Method 2
1. What will be the challenge will face in environment
2. Is Microsoft recommendation is go with Method 2 ( I am still looking for clarification even though I mentioned in MS KB)
Thanks
Vishal Saxena

Hi Vishal,
1. As it says in KB some server monitoring applications may not correctly monitor transport server components if you have any. Basically you will lose the ability to detect any condition when server stop accepting mails automatically.
2. You can definitely go with method 2 considering you have another way to monitor transport components and this failure detection.
Blog |
Get Your Exchange Powershell Tip of the Day from here

2 exchange 2013 multirole server and 1 addess for Outlook Anywhere. How to?

Hello everybody.
I'm coming to you with a question about my new Exchange 2013 infrastructure.
I have 2 Exchange 2013 SP1 servers. Both are multirole (CAS + MBX). My servers are Server12 and Server13.
I created a DAG which IP adderss is 192.168.3.30 (Servers IP are 3.31 and 3.32). Everything's working fine.
For CAS High Availability, I followed this thread : http://exchangeserverpro.com/exchange-2013-client-access-server-high-availability/
On my firewall, I use NAT to send https flow from my public IP address (mail.domain.fr, external domain
published on internet) to point to mail.domain.org (internal domain, non published on Internet). The mail.domain.org alias is my record defined in my internal DNS to
point to my 2 multirole server, as shown in the tutorial above.
I encounter a problem with external outlook anywhere. My problem comes with Outlook Anywhere which is not working fine when I redirect https flow to my cluster IP address (192.168.3.30) (DAG's address, corresponding to my servers). If I do the same redirection,
but pointing to only one of my servers, it's working fine. In Exchange, external outlook Anywhere directory points to mail.domain.fr
But anyway, if this servers goes down, I have to change manually the NAT on my firewall. And I don't want to :).
How can I do ? Can I do something without a physical load-balancer?
Thanks

You cannot point Outlook Anywhere to your DAG cluster IP address. It must be pointed to the actual IP address of either server.
For no extra cost DNS round robin is the best you will get, but it does have some drawbacks as it may give the IP address of a server you have taken down for maintenance or the server has an issue.
You could look to implement a load balancer but again if you are doing this for high availability then you want more than one load balancer in the cluster - otherwise you've just moved your single point of failure.
Having your existing NAT and just remembering to update it to point to the other server during maintenance may suit your needs for now.
If you can go into more detail about what the high availability your business is looking to achieve and the budget we can suggest the best method to meet those needs for the price point.
Have a great day
Oliver
Oliver Moazzezi | Exchange MVP, MCSA:M, MCITP:Exchange 2010,Exchange 2013, BA (Hons) Anim | http://www.exchange2010.com | http://www.cobweb.com | http://twitter.com/OliverMoazzezi

Exchange 2013 Transport Rules and Exchange 2007 Decommissioning

Hello,
I recently migrated from Exchange 2010 to Exchange 2013, I do have a few traces of Exchange 2007 in the Active Directory that I would like to completely remove. The Exchange 2007 server failed earlier and wasn't decommissioned properly. I read a few articles
on how to completely remove it from AD, I am still concerned to make the changes in "ADSI Edit".
Here is the error message I receive when creating transport rules in Exchange 2013:
"You are about to create a rule in an organization where Hub Transport servers running Exchange Server 2007
exist. To ensure the rule is applied consistently across all Hub Transport servers in the organization, you must create an equivalent rule from the Exchange Management Console on an Exchange 2007 server."
I also noticed that the version of the rules remain Version: 14.0.0.0 for any new rules that I am creating in Exchange 2013.
I would really appreciate if someone can provide their views and the best practices to remove the traces of Exchange 2007 in AD.

Hi Sathish,
How about the result after using ADSI Edit ?
Best regards,
Niko Cheng
TechNet Community Support

Exchange 2013 with CU3 and silent redirection to different AD site

After updating
Exchange 2013 CU2 to Exchange 2013 CU3, OWA silent site redirection feature become not available. The customer has two Exchange 2013 sites. Before we updated to CU3, user whose mailbox located on site A, could be automatically redirected to OWA on
site A, after he logged on to OWA on site B. IE gives Error page and bring out link to the OWA page on site A. Here is screenshot about issue workaround.
Hopefully someone will help with some hint because it is quite anoying.
All other stuff works good, Outlook anywhere, autodiscover, only this remained.
Thanks in advance,
Fajar

Hi Angela,
According to your description, OWA request cannot be automatically redirected after upgrade.
YESS after upgrade Exchange 2013 CU2 to CU3. CU2 not problem.
1. Will OWA work well if you manually click the OWA URL in the web page?
If i click manual, OWA Url in web page, OWA work well...
PS Command "Get-OWAVirtualDirectory | fl CrossSiteRedirectType"
ONLY HAVE ON EXCHANGE 2010 NOT ON EXCHANGE 2013.
2. Do you can login OWA in site A?
My Mailbox on Site-A, if i login OWA Site A (owa-A.domain.com), OWA work well & i can access my email.
But... if i login from OWA Site-B (owa-B.domain.com), OWA not automatic silent redirect to Site-A, and i must click link below "Use following link to open to mailbox with the best performance https://owa-a.domain.com/owa/auth.owa
My friend Mailbox on Site-B, if he login to OWA Site B (owa-B.domain.com), OWA-B work well & he can access email.
But.. if he login from OWA Site-A (owa-A.domain.com), OWA not automatic silent redirection to Site-B, and he must click link below "Use following link to open to mailbox with the best performance https://owa-b.domain.com/owa/auth.owa
3. Check the IIS log on site B CAS server and find if there is any error about the redirection.
whether there is a bug in CU3?
Hopefully someone will help with some hint because it is quite anoying on our custommer.
Regards,
Fajar

Exchange 2013 OWA,Async,And OA error MsExchange BackEndRehydration event id 3002

Hi team,
I had issue in My Exchange system.
I had two Exchange 2013 muli role with CAS and MBX
Server A had no problem connection when client access OWA directly (https://servernamefqdn/owa)
but, theres issue when I pointing to server B OWA (https://serverBfqdn/owa). its same when outlook connect (using OA ),and Aysnc connection.
when I failed to connect OWA, theres event id 3002 MsExchange BackEndRehydration event id 3002.
the error show at Server A ( server at a good condition )
heres the error
Thanks

Hello Team,
I have a similar issue with Event ID 3002 filling up the App log on both Mailbox servers. Here is a snippet of the error. Any help is greatly appreciated. Thank you.
"Protocol /EWS failed to process request from identity DOMAIN\CASServer. Exception: Microsoft.Exchange.Security.OAuth.InvalidOAuthTokenException: The user specified by the user-context in the token is ambiguous.
   at Microsoft.Exchange.Security.OAuth.OAuthActAsUser.InternalCreateFromAttributes(OrganizationId organizationId, Boolean calledAtFrontEnd, Dictionary`2 rawAttributes, Dictionary`2 verifiedAttributes)
   at Microsoft.Exchange.Security.Authentication.BackendAuthenticator.OAuthAuthenticator.ExtractActAsUser(OrganizationId organizationId, CommonAccessToken token)
   at Microsoft.Exchange.Security.Authentication.BackendAuthenticator.OAuthAuthenticator.InternalRehydrate(CommonAccessToken token, Boolean wantAuthIdentifier, String& authIdentifier, IPrincipal& principal)
   at Microsoft.Exchange.Security.Authentication.BackendAuthenticator.Rehydrate(CommonAccessToken token, BackendAuthenticator& authenticator, Boolean wantAuthIdentifier, String& authIdentifier, IPrincipal& principal, IAccountValidationContext&
accountValidationContext)
   at Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.ProcessRequest(HttpContext httpContext)
   at Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.OnAuthenticateRequest(Object source, EventArgs args).

Winmail.dat attachments from Exchange 2013 on premi and Hosted Office 365 set up.

Hello TechNet,
I have an on going situation with winmail.dat attachments. I currently have a ticket open with Microsoft, but I want to see if anyone has personal experience with this. Here is the rundown.
We have migrated from an Exchange 2007 server to Exchange 2013 for the migration to Office 365. We also have a hosted Office 365 server with half of our mailboxes in the cloud and half of them on the Exchange 2013 on premise server.
The current settings for TNEFEnabled:
On Premise: False
Hosted: False
Whenever a internal email with a calendar invite(exchange calendar, go to meeting) goes out to any external domain the recipients receive winmail.dat.
When settings for TNEFEnabled On Premise and Hosted are set to true both calendar invites and PDF, Excel attachments etc the recipients receive winmail.dat.
When speaking with Microsoft about this issue. The representative was watching me through a LogMeIn session as I set both TNEFEnabled false on both on Premise and Hosted.
This is really frustrating as many employees depend on this to be fully functional, and to be honest am tired of dealing with this.
I need help.
-Ben

I am having the same issue.
Luckily I have only migrated my own mailbox to office365.
Tried both true and false TNEFEnabled on both onpremise and office365 via powershell and confirmed that both have been applied.
If I send the email as a plain text then the attachment works ok. If I send it as HTML then I get winmail.dat.
The above KB doesnt really help me, sending plain text emails is like going back to the dark ages!
I am sending from outlook to outlook (I send from my external email address, to my work email address and visa-versa)
If someone with an onpremise mailbox sends me an email, the attachment works ok.
If someone sends me an attachment via hotmail, the attachment works ok.
It seems to only effect emails I send to myself through outlook, i am sending it through a POP3 account to our onpremise exchange 2010 which forwards the email to office365

Exchange 2007 edb to Exchange 2013 - mailbox extraction and mounting

Hello everyone, here is my question:
I have a client who has Exchange 2007 running on a Domain Controller which is a Server 2008 and that is the only domain controller in his environment. That said, his domain controller crashed and all the AD data is now lost along with Exchange except the
EDB files. He wants to create a new domain controller with Server 2012 and wants to deploy Exchange Server 2013. Since the Domain Name will be the same, is it even possible to extract the mailbox information from Exchange 2007 EDB and attach it with new Exchange
Server 2013 and point them to newly created users on Exchange? If yes, how exactly will this work? Thanks in advance.

Excellent and factual responses from the others and the instructions/guidance should serve you well. If however you want to avoid building a new server etc you could use Lucid8's DigiScope
http://www.lucid8.com/product/digiscope.asp to open the 2007 EDB on a 64 bit machine and then you could take 1 of 2 actions to resolve your issue.
1. You could then export all mailboxes to PST and then Import them into the 2013 environment
2. OR you could have DigiScope migrate/recover the data directly from the offline 2007 EDB into the Production 2013 server on the fly, i.e. no end user downtime is required.
Search, Recover, & Extract Mailboxes, Folders, & Email Items from Offline Exchange Mailbox and Public Folder EDB's and Live Exchange Servers or Import/Migrate direct from Offline EDB to Any Production Exchange Server, even cross version i.e. 2003 -->
2007 --> 2010 --> 2013 with Lucid8's
DigiScope

Exchange 2013: Event ID 2937 - MSExchangeSubmission.exe - edgetransport.exe - MSExchangeDelivery.exe - MSExchangeFrontendTransport.exe

Hi
I realise that there are a few threads about this specific ID, but all the solutions are unique to the particular occurrence. Could any of you gentleman or ladies have a look and tell me how to fix it please. Thanks in Advance
Process MSExchangeFrontendTransport.exe (PID=6120). Object [CN=VSAT-PM Group,OU=Users,OU=Connecting Africa,DC=connectingafrica,DC=local]. Property [ArbitrationMailbox] is set to value [connectingafrica.local/Deleted Objects/SystemMailbox{1f05a927-9036-4018-a6c3-5c29c152f5ac}
DEL:f068d90d-28c9-4eea-9e5b-e786bb7ff87d], it is pointing to the Deleted Objects container in Active Directory. This property should be fixed as soon as possible.
Process MSExchangeDelivery.exe (PID=5532). Object [CN=VSAT-PM Group,OU=Users,OU=Connecting Africa,DC=connectingafrica,DC=local]. Property [ArbitrationMailbox] is set to value [connectingafrica.local/Deleted Objects/SystemMailbox{1f05a927-9036-4018-a6c3-5c29c152f5ac}
DEL:f068d90d-28c9-4eea-9e5b-e786bb7ff87d], it is pointing to the Deleted Objects container in Active Directory. This property should be fixed as soon as possible.
Process edgetransport.exe (Transport) (PID=15260). Object [CN=VSAT-PM Group,OU=Users,OU=Connecting Africa,DC=connectingafrica,DC=local]. Property [ArbitrationMailbox] is set to value [connectingafrica.local/Deleted Objects/SystemMailbox{1f05a927-9036-4018-a6c3-5c29c152f5ac}
DEL:f068d90d-28c9-4eea-9e5b-e786bb7ff87d], it is pointing to the Deleted Objects container in Active Directory. This property should be fixed as soon as possible.
Process MSExchangeSubmission.exe (PID=3888). Object [CN=VSAT-PM Group,OU=Users,OU=Connecting Africa,DC=connectingafrica,DC=local]. Property [ArbitrationMailbox] is set to value [connectingafrica.local/Deleted Objects/SystemMailbox{1f05a927-9036-4018-a6c3-5c29c152f5ac}
DEL:f068d90d-28c9-4eea-9e5b-e786bb7ff87d], it is pointing to the Deleted Objects container in Active Directory. This property should be fixed as soon as possible.

Hi,
First verify that you have all 5 Arbitration Mailboxes with: Get-Mailbox -Arbitration
The error you see indicates that the database they were on was deleted, possibly in ADSIEdit,and now you have recipients with an old value set. Can't say for sure, but it looks like groups and since they do have an ArbitrationMailbox configured by
default and to fix them all in one go, just run:
Get-DistributionGroup -resultsize unlimited | Set-DistributionGroup -ArbitrationMailbox "SystemMailbox{1f05a927*"
Similar issue here:
http://social.technet.microsoft.com/Forums/exchange/en-US/4378e410-c2c5-47a9-abc2-eb2926ff40da/the-recipient-is-configured-to-use-arbitration-mailbox-but-that-mailbox-has-been-deleted?forum=exchange2010
Martina Miskovic

Exchange 2013 Malware Filter and ScanningProcess.exe

Similar Messages

Maybe you are looking for