Troubleshoot Duplicate Exchange Email on exchange 2003

To troubleshoot this issue, I suggest you perform the following steps:

Step 1: Check SMTP log to see how many times the message was sent by the external sender server
============================================================================
On your Exchange server 2003:

a. Open Exchange System Manager. If administrative groups are enabled,
expand Administrative Groups.
b. Expand Servers, expand Protocols, expand SMTP, right-click SMTP Virtual
Server, and then click Properties.
c. On the General tab, please check the option "Enable logging".
d. Select W3C Extended Log File Format from the list below.
e. Click the Properties button. In the General Properties tab, please
confirm the following settings:
f. Check the option Daily
g. Check the option "Use local time for file naming and rollover"
h. Confirm the setting for "Log file directory" to be
"C:\WINNT\System32\LogFiles"
i. Switch to the Advanced tab, choose all available options under
Extended logging options.

Wait for the issue is reproduced, go the folder
C:\WINNT\System32\LogFiles\SMTPSVC#" (# is a number. The number for the
Default SMTP Virtual Server is 1), open the latest SMTP log file.

You can search the sender address to check how many times the sender sever
sent the problematic email.

Please let me know the result of the above step and continue performing the
following steps:

Step 2: Verify if there is any mail scan application installed on your
Exchange server. If yes, I suggest you temporarily disable email
scan/protect feature. Then, test if the issue can be fixed.

Note: Similar issue can also be caused by third party antivirus
applications which keep scanning Exchange files. So please make sure that
we exclude the following locations on your Exchange server from being
scanned by any file-level antivirus software:

- Exchange databases (default location: Exchsrvr\Mdbdata)
- Exchange MTA files (default location: Exchsrvr\Mtadata)
- Exchange temporary files: Tmp.edb
- Additional log files (default location: Exchsrvr\server_name .log)
- Virtual server folder (default location: Exchsrvr\Mailroot)
- Site Replication Service (SRS) files (default location: Exchsrvr\Srsdata)
- Internet Information Service (IIS) system files
(:\Winnt\System32\Inetsrv)
- Working folder for message conversion .tmp files. (default location:
Exchsrvr\Mdbdata)



1. Verify if the issue occurs to all inbound messages or just certain ones.
If only certain ones are affected, check the duplicate messages are
received from some specific external domain?
2. Did the issue occur before? Was any mail scan application installed
prior to the issue?



3. Please take a screenshot of the result when using Message Tracking to
trace the duplicate message and SMTP log for further investigation.
=================
a. Start Exchange System Manager on the Exchange server
b. Navigate to the your Exchange server object. Right Click on the server
and choose properties On the General Tab Check the option "Enable Message
tracking"
c. Reproduce the issue.
d. In the console tree, double-click Tools.
e. Click Message Tracking Center
f. Next to the Server button, type the name of the Exchange server. To
browse a list of available servers, click Server, select a server, and then
click OK.
g. Input the sender and recipient information and click Find now
h. After finding the message, open it. Please capture a screenshot of the
message history and send it to us.
i. Meanwhile, send me the SMTP log file of the day on which the duplicate
email was received. The SMTP log file is stored under
C:\WINNT\System32\LogFiles\SMTPSVC#" (# is a number. The number for the
Default SMTP Virtual Server is 1).






Check SMTP log to see how many times the message was sent by the external sender server
==========================================================
On your Exchange server 2003:

a. Open Exchange System Manager. If administrative groups are enabled, expand Administrative Groups.
b. Expand Servers, expand Protocols, expand SMTP, right-click SMTP Virtual Server, and then click Properties.
c. On the General tab, please check the option "Enable logging".
d. Select W3C Extended Log File Format from the list below.
e. Click the Properties button. In the General Properties tab, please confirm the following settings:
f. Check the option Daily
g. Check the option "Use local time for file naming and rollover"
h. Confirm the setting for "Log file directory" to be "C:\WINNT\System32\LogFiles"
i. Switch to the Advanced tab, choose all available options under Extended logging options.

Wait for the issue is reproduced, go the folder

C:\WINNT\System32\LogFiles\SMTPSVC#" (# is a number. The number for the Default SMTP Virtual Server is 1), open the latest SMTP log file.