how to stop employees email bombing each other?

[quell]

Hello,
It has come to my attention that a few employees have figured out how to use e-mail bomber software that they downloaded off the internet using our exchange server. I have looked in exchange admin for a setting that would only allow a certain number of emails from a client with in a certain time frame but would not affect clients sending email to multiple users or groups. Has anyone come up with a solution for this? Other then getting them in further trouble I would like to handle this at a lower level. I could just ask them to quick but I would like the piece of mind knowing that they can’t or don’t have access to do this anymore. Basically I just was wondering if there is some exchange setting I can set to stop this. Any ideas would be greatly appreciated.
Thank you.

 

[zbnet]

Ed Crowley once said: "There are seldom good technical solutions to behavioural problems".

I'm assuming the software in question is connecting to the IMS in much the same way any SMTP host on the Internet sends mail? You didn't give details of the specific problem you're having.

Tell them that it's not permitted to use the software, set logging in the IMS to track any connections, and then discipline anyone who uses it. You should only have to sack one person for violating your code of conduct before the rest will stop.

 

[quell]

lol...Thanks for the info but I do not wish to get anyone in trouble for such things. The program they have been using is called mail bomber. To configure mail bomber they put in the IP address of the exchange server (smtp) and there login/password to authenticate. I was just curious if there is software or a setting that would prevent a user from sending out a certain amount of emails in a given time frame.

 

[zbnet]

On the IMS Connections tab you can specifiy a list of IP addresses, and set whether to accept or reject messages from them.

Your question about restricting the amount of email a person can send doesn't make sense. Think about it. When they run mail bomber, they are running an SMTP connection to your IMS just like anyone else on the internet. Would you want your IMS to restrict the number of emails another server could send to you?

 

[quell]

>Would you want your IMS to restrict the number of emails another server could send to you? Obviously no, However, the IMS is not used for internal email. I’m not for sure what service is. The reason I say IMS is not used is because I can stop the IMS service and still be able to send/receive email on our local network. Now if I want to send an email out of our network then yes IMS does need to be running. Whatever type of connection outlook or any other client uses to connect to our server internally the mail bomber makes the same type of connection. I’m not for sure what protocol or service it uses though. (I know I’m a newb)
Scenario here. Joe Smo (employee) downloads some email bomber software from the net and uses it messing around with his fellow employees. Now as an admin you do not want to prevent him from sending out email completely. But if he sends lets say 40 different emails to the same person in 20 seconds then yes I would like to prevent this from happening somehow.
So back to my original question, can you prevent a user from sending out a specified amount of emails within a specified time frame via software of some sort of configuration setting.

 

[dennisbbb]

Exchange alone cannot perform this task. You need an external software with emailbomb protection on all individual users. Surfcontrol Email Filter has this feature, you need to tinker around for it. It is a powerful spam/bulkmail detector. If N amount of email, or certain email content, is coming from the same IP, it will email alert the admin and put these email on Hold until the admin dispenses them, while allowing everyone else thru.

Exchange Server IMS service is a simple SMTP/POP3 packet forwarder. It doesn't provide much else.

 

[quell]

Dennisbbb-Thank you for the info

 

[Marcs41]

Like zbnet already said, it is a user abuse problem, DEAL WITH IT!
You don't want to cause anyone trouble? Then why do you let them cause you trouble?
There a rules to be followed in a company, failing in doing so should be disciplined, period.
You can 'punnish' them by resttrictiong them temp. in the amount of mails they can sent, turn down their allowed message size, limit the number of addressees in one mailing, etc.
Does this effect business? Probably, but let THEM go and complain to the bosses, and also explain WHY you had to take that action, see who will win!

Alternative: Install Policies so they cannot install ANYTHING on their PC, that may even be more effective in the long run.
It all comes down to one simple rule: YOU are responsible for the smooth working, THEY interfere with that, YOU should protect yourself against people who do not respect your job.
After all, it does not sound as a business need to use a mailbomber, so where can they go an complain about it?

Marc
_{If 'something' 'somewhere' gives 'some' error, expect random guesses or no replies at all. Please specify details.
Free Tip: The F1 Key does NOT destroy your PC!}

 

[cmeagan656]

Quote

"Install Policies so they cannot install ANYTHING on their PC, that may even be more effective in the long run."

I absolutely agree with Marc. You don't want users installing anything on their PC. If your users are installing e-mail bomber software then what else are they installing. There are network performance and licensing issues to be considered here as well.

We have a complete lockdown of our PCs and terminal servers. If a user wants anything installed they have to request it in writing and include the reason for the request and a copy of the EULA, etc. before I even consider it.

Cheers.