Boswell's Q&A

Bad, Bad, BadMail

How to handle the growing problem that is the BadMail folder.

• By Bill Boswell
• 06/08/2004

I think the cause is the accumulation of files to the following path:

     C:\ProgramFiles\Exchsrvr\Mailroot\vsi 1\BadMail\

This BadMail folder has three types of files in it: .BAD, .BDP, and .BDR. Is it safe to delete some or all of these files? Is there a configuration setting to delete them automatically? What are these files?
—George

George: Questions about how to deal with the contents of the BadMail folder top the list of e-mails I get every week. Microsoft has finally decided to help out by issuing a script that either clears the files out of the BadMail folder or archives the files to a specified location.

You can download the BadMail Archival and Deletion script at the Microsoft Download Center (click here), but I'd recommend downloading it as part of the newly updated bundle of Exchange 2003 tools (click here).

The script, named Badmailadmin.wsf, is a Windows Script Host file that you can use on a server running Exchange 2003 or Exchange 2000. The script also works on a Windows 2003 or 2000 server that is not running Exchange but is simply acting as an SMTP server.

The script combines both VBScript and Jscript code to do the following:

• Accepts a command line argument for either archiving or deleting the contents of the BadMail folder. If you want to archive the contents, you must specify the path to an archive folder of your choice. Archiving BadMail files can help you figure out why your server is receiving invalid e-mail messages, but the archive folder can take up quite a bit of space. If you have no diagnostic reason to save the BadMail files, simply tell the script to delete them.
• Determines if the total content of the BadMail folder exceeds a value specified on the command line of the script. The default value is 0, meaning that all files in BadMail are either archived or deleted. Another command line switch tells the script to delete older files until the specified size is reached. This is a useful compromise to archiving. You can choose to simply delete older messages until some arbitrary size is reached, such as 100MB. This leaves a quantity of recent files to help you with diagnostics.
• Determines the path to the BadMail folder on the specified server, either by searching the SMTP Protocol entries for the server in Active Directory (Exchange servers) or by searching through the IIS Metabase (Windows servers). If a server has more than one SMTP virtual server, the script can clear out BadMail for all of the virtual servers or for a selected virtual server.
• Performs the desired action, either archiving or deleting the BadMail files.

The script also has options for disabling the BadMail folder by setting the NTFS permissions so that the server can no longer write to the folder. This is a drastic action but one that can help you avoid building up massive amounts of BadMail files during a worm outbreak or spam attack.

Here's a listing of the command line options:

     badmailadmin.wsf - Deletes, archives, or disables SMTP
                      badmail folder content.

SYNTAX:
     badmailadmin.wsf [-A DELETE | ARCHIVE | DISABLE]
                    [-V <VSI#> | ALL]
                    [-F LARGEST | OLDEST]
                    [-L OFF | VERBOSE | EVENTS]
                    [-M <Max MB size>]
                    [-S <server/cluster resource name>]
                    [-P <archive path>]

DEFAULT PARAMETERS:
     badmailadmin.wsf -A DELETE -F OLDEST -V ALL
                    -L OFF -M 0 -S <localhost>

I especially like the -L VERBOSE option because it prints out each step taken by the script, an invaluable diagnostic aid. I wish more Microsoft scripts had this feature.

You can use the Task Scheduler to run the script on a regular basis. The document that accompanies the script shows how to configure the job.

The BadMail script is a welcome addition to any Exchange administrator's arsenal of tools. Although you can make a case that the functionality should have been built into Exchange itself, with triggers based on the size of the BadMail folder or the number of items, it's still good to have a standardized way of dealing with the contents of the BadMail folder.

Hope this helps.