HEDMON's questions

this is the situation:

messages sent to a DistributionGroup-Universal group are not delivered to the group members. The same message sent to the group + a directly member address is delivered just to that member. For example, here is a example with Get-MessageTrackingLog from a message:

sent: external user

to: [email protected][member1, member2, member3, member4], [email protected]

MessageId       : <0001>
EventId         : RECEIVE
Timestamp       : 14.12.2016 19:03:47
Recipients      : [email protected], [email protected]}
RecipientStatus :

MessageId       : <0001>
EventId         : EXPAND
Timestamp       : 14.12.2016 19:03:47
Recipients      : {[email protected], [email protected], [email protected], [email protected]}
RecipientStatus : 250 2.1.5 RESOLVER.GRP.Expanded; distribution list expanded

MessageId       : <0001>
EventId         : TRANSFER
Timestamp       : 14.12.2016 19:03:47
Recipients      : {[email protected], [email protected], [email protected], [email protected]}
RecipientStatus : {, , , }

MessageId       : <0001>
EventId         : DELIVER
Timestamp       : 14.12.2016 19:03:47
Recipients      : [email protected]
RecipientStatus :

MessageId       : <0001>
EventId         : DUPLICATEDELIVER
Timestamp       : 14.12.2016 19:03:48
Recipients      : [email protected]
RecipientStatus :

you can see the 250 2.1.5 RESOLVER.GRP.Expanded in the EXPAND event, and later the message is delivered just to member1, which is the only one user addressed in the e-mail out of the group. I believe the DUPLICATEDELIVER event is because member1 is addressed 2 times (inside the group and directly).

Finally, the e-mail was not delivered to the group members (and the sender didn't receive any NDR) and I don't understand why (it's a DistributionGroup-Universal, not DDG)

UPDATE: I tried again (from a different external account) and now the e-mail was delivered first to member1, and after to all group members, except member1 because is a duplicate message. I believe this is the right behavior:

MessageId       : <0002>
EventId         : RECEIVE
Timestamp       : 21.12.2016 7:05:02
Recipients      : {[email protected], [email protected]}
RecipientStatus :
MessageSubject  : test mail

MessageId       : <0002>
EventId         : EXPAND
Timestamp       : 21.12.2016 7:05:02
Recipients      : {[email protected], [email protected], [email protected], [email protected]}
RecipientStatus : 250 2.1.5 RESOLVER.GRP.Expanded; distribution list expanded
MessageSubject  : test mail

MessageId       : <0002>
EventId         : TRANSFER
Timestamp       : 21.12.2016 7:05:02
Recipients      : {[email protected], [email protected], [email protected], [email protected]}
RecipientStatus : {, , , }
MessageSubject  : test mail

MessageId       : <0002>
EventId         : DELIVER
Timestamp       : 21.12.2016 7:05:02
Recipients      : [email protected]
RecipientStatus :
MessageSubject  : test mail

MessageId       : <0002>
EventId         : DELIVER
Timestamp       : 21.12.2016 7:05:02
Recipients      : {[email protected], [email protected], [email protected]}
RecipientStatus :
MessageSubject  : test mail

MessageId       : <0002>
EventId         : DUPLICATEDELIVER
Timestamp       : 21.12.2016 7:05:02
Recipients      : [email protected]
RecipientStatus :
MessageSubject  : test mail

The original problem happened the last week, concretely from only one external address, and I see others emails to the group (from others external users) had been delivered to all group members. I tried now the combination of group + member1, how was in the problematic message for check if the noise come from the duplicate message, but I see there is delivered to everybody, so, I don't know what can be...

I have access to the office from outside (VPN, e-mail, etc.). I have at home Internet from ISP(A) and at office from ISP(B). Everything were working fine till I received an e-mail from my ISP(A) that they needed change my public IP. From that moment I lost the connection with the office.

I checked everything from the office side and I don't see problem, for more, I can connect from other places without problem, even with the phone data connection is possible connect, so, I don't believe the issue come from the firewall at office.

I contacted to ISP(A) and they told me there is everything ok, they asked me for contact the ISP(B). I called to ISP(B) and they asked for the 'phone number' of my connection with ISP(A), but what I have from ISP(A) is a wireless connection (WiFi) with an Ubiquiti antenna, but ISP(B) insist that 'every Internet connection have a associated phone number'. Now I wrote to ISP(A) asking for that number, but I really don't understand how a phone number can be associated to a WiFi connection?? I didn't have answer yet.

For try to find the problem I tried:

• Telnet to different ports, and never connect. Again, from other ISPs Telnet can connect
• Traceroute and the packets died in an IP which belong to ISP(B), but I tried from others connection and always the packets are lost in the same IP, I believe there is something blocking the ICMP.

What more can I check and how can I debug where is the problem??

UPDATE:

Pfsense won't log all rules by default, so before I didn't see nothing in the logs, and by the rules are defined I believed everything look good. Now I started to log everything and I see the firewall is blocking the IP as a 'bogon network'. Concretely I get: b

lock drop in log quick on re 1 from bogons:3594 to any label block bogon ipv4 networks from wan

I think now I'm on the good way! any comment is welcome

I noticed our PDCe is running 1:20min late and, of course, also the rest of devices in the network. I'm trying to sync with an external time source but it's not going well.

It's a virtual Windows Server 2008 R2 over XenServer 6.0.0. The host is using ptbtime1.ptb.de and ptbtime2.ptb.de as NTP servers and the time is correct. The PDCe (in theory) has the same NTP servers but the time is around 80 seconds late. And I said 'in theory' because HKLM\SYSTEM\CurrentControlSet\services\W32Time\Parameters\NtpServer has value ptbtime1.ptb.de ptbtime2.ptb.de (I also tried ptbtime1.ptb.de,0x1 ptbtime2.ptb.de,0x1 without results), but when I tried in PowerShell

PS C:\>w32tm /query /peers
Number peers: 1

Peer:
Status: Pending
Time Remaining: 94.6710000s
Mode: 0 (Reserved)
Stratum: 0 (not specified)
Peer polling interval: 0 (not specified)
Host polling interval: 0 (not specified)

and

PS C:\>w32tm /query /configuration
[Configuration]

EventLogFlags: 2 (Directive)
AnnounceFlags: 10 (directive)
TimeJump Audit Offset: 28800 (Local)
MinPollInterval: 6 (Directive)
MaxPollInterval: 10 (directive)
MaxNegPhaseCorrection: 172800 (directive)
MaxPosPhaseCorrection: 172800 (directive)
MaxAllowedPhaseOffset: 300 (directive)

FrequencyCorrectRate: 4 (Policy)
PollAdjustFactor: 5 (directive)
LargePhaseOffset: 50000000 (directive)
SpikeWatchPeriod: 900 (directive)
Local Clock dispersion: 10 (directive)
Hold Period: 5 (directive)
PhaseCorrectRate: 1 (directive)
UpdateInterval: 100 (directive)


[Time Provider]

NtpClient (Local)
DllName: C: \ Windows \ system32 \ w32time.dll (Local)
Enabled: 1 (Local)
Input providers: 1 (Local)
CrossSiteSyncFlags: 2 (Directive)
AllowNonstandardModeCombinations: 1 (Local)
ResolvePeerBackoffMinutes: 15 (directive)
ResolvePeerBackoffMaxTimes: 7 (Directive)
CompatibilityFlags: 2147483648 (Local)
EventLogFlags: 0 (directive)
LargeSampleSkew: 3 (Local)
SpecialPollInterval: 3600 (directive)
Type: NT5DS (directive)

NtpServer (Local)
DllName: C: \ Windows \ system32 \ w32time.dll (Local)
Enabled: 1 (Local)
Input providers: 0 (Local)
AllowNonstandardModeCombinations: 1 (Local)

VMICTimeProvider (Local)
DllName: C: \ Windows \ System32 \ vmictimeprovider.dll (Local)
Enabled: 1 (Local)
Input providers: 1 (Local)

I also tried set HKLM\SYSTEM\CurrentControlSet\services\W32Time\Config\AnnounceFlags from A to 5 and set again the NTP servers by cmdlets:

PS C:\> w32tm.exe /config /manualpeerlist:"ptbtime1.ptb.de ptbtime2.ptb.de" /syncfromflags:manual /reliable:YES /update
PS C:\> w32tm /config /update
PS C:\> w32tm /resync
PS C:\> Restart-Service w32time

I don't understand why the server won't sync with the external NTP server. I don't know if XenServer plays some role in the problem. In any case the time in the guest is not the same time from the host.

UPDATE 23.9

PS C: \> w32tm / query / configuration
[Configuration]

EventLogFlags: 2 (Directive)
AnnounceFlags: 10 (directive)
TimeJump Audit Offset: 28800 (Local)
MinPollInterval: 6 (Directive)
MaxPollInterval: 10 (directive)
MaxNegPhaseCorrection: 172800 (directive)
MaxPosPhaseCorrection: 172800 (directive)
MaxAllowedPhaseOffset: 300 (directive)

FrequencyCorrectRate: 4 (Policy)
PollAdjustFactor: 5 (directive)
LargePhaseOffset: 50000000 (directive)
SpikeWatchPeriod: 900 (directive)
Local Clock dispersion: 10 (directive)
Hold Period: 5 (directive)
PhaseCorrectRate: 1 (directive)
UpdateInterval: 100 (directive)


[Time Provider]

NtpClient (Local)
DllName: C: \ Windows \ system32 \ w32time.dll (Local)
Enabled: 1 (Local)
Input providers: 1 (Local)
CrossSiteSyncFlags: 2 (Directive)
AllowNonstandardModeCombinations: 1 (Local)
ResolvePeerBackoffMinutes: 15 (directive)
ResolvePeerBackoffMaxTimes: 7 (Directive)
CompatibilityFlags: 2147483648 (Local)
EventLogFlags: 0 (directive)
LargeSampleSkew: 3 (Local)
SpecialPollInterval: 3600 (directive)
Type: NT5DS (directive)

NtpServer (Local)
DllName: C: \ Windows \ system32 \ w32time.dll (Local)
Enabled: 1 (Local)
Input providers: 0 (Local)
AllowNonstandardModeCombinations: 1 (Local)

VMICTimeProvider (Local)
DllName: C: \ Windows \ System32 \ vmictimeprovider.dll (Local)
Enabled: 1 (Local)
Input providers: 1 (Local)

I have installed the Exchange Management Console in Windows 10 Pro for manage a Exchange 2010 server. It connects to the server, even the Exchange Management Shell (Power Shell) connects without problem. But I'm stuck because the console tree shows only Microsoft Exchange -> Microsoft Exchange On-Premises (server.domain.com), but there are not any other nodes (Organization configuration, Server configuration, etc.) I'm using a domain admin account, and also tried run the console 'as administrator' with the same result. Exchange Management Console