POP3 service

The POP3 service is an e-mail service that retrieves e-mail. Administrators can use the POP3 service to store and manage e-mail accounts on the mail server.

When the POP3 service is installed on the mail server, users can connect to the mail server and retrieve and download e-mail to their local computer using an e-mail client that supports the POP3 protocol (such as Microsoft Outlook). The POP3 service is used with the Simple Mail Transfer Protocol (SMTP) service, which sends outgoing e-mail.

  • Before proceeding, see Checklist: Installing and configuring the POP3 service.
  • For tips about using the POP3 service, see Best practices.
  • For help with specific tasks, see How to.
  • For general background information, see Concepts.
  • For problem-solving instructions, see Troubleshooting.


Checklist: Installing and configuring the POP3 service

Step | Reference
Read recommended topics. Best practices;
POP3 service overview;
E-mail concepts;
Name resolution for TCP/IP
Choose and configure the mail server running the POP3 service with a Domain Name System (DNS) name. It is recommended that you choose a name that reflects the role of the server, such as mailserver1. | To rename a computer
Contact your Internet Service Provider (ISP). | Contacting your Internet Service Provider
Configure TCP/IP for static addressing on the mail server on which the POP3 service is installed. | To configure TCP/IP for static addressing
Install the POP3 service. | To install e-mail services
Read "POP3 service authentication methods" and determine which method is best for your deployment. | POP3 service authentication methods
Configure the POP3 service to use the authentication method you have chosen. | To set the authentication method
Create a domain. | To create a domain
Create a mailbox. | To create a mailbox
Configure all e-mail clients to use the POP3 service. In addition, if you are using Secure Password Authentication (SPA), you should now configure your e-mail clients to use SPA. | Configure e-mail clients
Manage your mail server. | POP3 service administration tools


Best practices

Set the mail store on a volume other than the one on which the operating system is installed.

  • Because the mail store can potentially use large amounts of disk space, you should either set a disk quota limit on the volume of the mail store (to control its disk space usage) or set it to use a volume other than the one where the operating system is installed. This will prevent the possibility of the operating system running out of disk space if the mail store becomes too large. For more information, see To set the mail store. For more information on disk quotas, see Configuring disk quotas for the POP3 service.

Set the Badmail directory on a volume other than the one on which the operating system is installed.

  • When an e-mail is undeliverable, the Simple Mail Transfer Protocol (SMTP) service returns it to the sender with a non-delivery report (NDR). If the NDR cannot be delivered to the sender, a copy of the message is put in the Badmail directory. To prevent the possibility of the operating system running out of disk space (if the Badmail directory becomes too large), you must move the SMTP Badmail directory to a volume other than the one on which the operating system is installed. For more information on how to specify a location for the Badmail directory, see Storing NDRs.

Use an NTFS file system partition for the mail store and implement disk quotas.

  • NTFS file system partitions provide greater directory and folder security. This enhances the protection of e-mail stored on the local hard disk.
  • Disk quotas can prevent the mail store from using an excessive or unanticipated amount of disk space. This is important because excessive or unanticipated use of disk space can adversely affect the performance of the server on which the POP3 service is running.

Allocate adequate disk space for the mail store.

  • To ensure that you allocate adequate disk space for the mail store, estimate the amount of disk space it will need based on the number of users on the server, the volume of e-mail they will receive, and the average size of the e-mail they will receive.

Use strong passwords to protect your mail server.

  • Strong passwords protect your mail server from unauthorized access. For more information about passwords, see Strong passwords.


How to...

  • Set up the POP3 service
  • Change service settings
  • Manage domains
  • Manage mailboxes
  • Configure the Simple Mail Transfer Protocol service
  • Configure e-mail clients


Set up the POP3 service

  • Install e-mail services
  • Set the authentication method
  • Set the mail store


Install e-mail services

Microsoft Windows Graphic

To install e-mail services

  1. Open Add or Remove Programs.
  2. Click Add/Remove Windows Components.
  3. Scroll down and select the E-mail Services check box.
  4. Click Next, and then complete the wizard.

Notes

  • XOX
  • XOX
  • You can also install e-mail services using the Configure Your Server Wizard. For more information, see Related Topics.

Related Topics


Set the authentication method

To set the authentication method

Using the Windows interface

  1. Open POP3 service.
  2. In the console tree, right-click the computer_name node and click Properties.

    Where?

    • POP3 Service
    • computer_name
  3. In Authentication Method, click the drop-down menu, and then click the authentication method you want to use.

Important

  • You can change the authentication method only if there are no existing domains defined. If there are existing domains, the option to change the authentication method is disabled.
  • If you change this parameter, you must stop and restart the POP3 service and the IIS Admin service. For more information on how to change the POP3 service state and start and stop the IIS Admin service, see Related Topics.

Notes

  • XOX
  • XOX
  • If the computer on which the POP3 service is running is either a member of an Active Directory domain or a domain controller, the default authentication method is Active Directory integrated authentication. If the computer is not in a domain, the default is local Windows accounts authentication.
  • If the computer on which the POP3 service is running is a domain controller, the available authentication methods are Active Directory integrated authentication and encrypted password file authentication. If the computer on which the POP3 service is running is a member server in an Active Directory domain, all three authentication methods are available. Otherwise, the available authentication methods are local Windows accounts authentication and encrypted password file authentication.
  • XOX

Using a command line

  1. Open Command Prompt.
  2. Type:

    winpop set {authentication|auth} {1|2|3}

Value | Description
winpop set {authentication|auth} | Sets the type of authentication to be used by the POP3 service. The auth command provides the same functionality as authentication.
{1|2|3} Specifies the authentication method POP3 uses to verify users who connect to the mail server. The available authentication methods vary, depending on the configuration of your server.
  • If the computer on which the POP3 service is running is an Active Directory domain controller, the values are as follows:

    1 - Active Directory integrated authentication

    2 - Encrypted password file authentication

  • If the computer on which the POP3 service is running is an Active Directory member server, the values are as follows:

    1 - Active Directory integrated authentication

    2 - Local Windows accounts authentication

    3 - Encrypted password file authentication

  • Otherwise, the following values apply:

    1 - Local Windows accounts authentication

    2 - Encrypted password file authentication

Important

  • You can change the authentication method only if there are no existing domains defined. If there are existing domains, the option to change the authentication method is disabled.
  • If you change this parameter, you must stop and restart the POP3 service and the IIS Admin service. For more information on how to change the POP3 service state and start and stop the IIS Admin service, see Related Topics.

Notes

  • XOX
  • XOX
  • If the computer on which the POP3 service is running is either a member of an Active Directory domain or a domain controller, the default authentication method is Active Directory integrated authentication. If the computer is not in a domain, the default is local Windows accounts authentication.
  • If the computer on which the POP3 service is running is an Active Directory domain controller, the available authentication methods are Active Directory integrated authentication and encrypted password file authentication. If the computer on which the POP3 service is running is a member server in an Active Directory domain, all three authentication methods are available. Otherwise, the available authentication methods are local Windows accounts authentication and encrypted password file authentication.
  • XOX
  • To view the complete syntax for this command, at a command prompt, type:

    winpop set help


Set the mail store

To set the mail store

Using the Windows interface

  1. Open POP3 service.
  2. In the console tree, right-click the computer_name node, and then click Properties.

    Where?

    • POP3 Service
    • computer_name
  3. In Root Mail Directory, type the path to the mail store; for example, C:\mailstore. The maximum value is 260 characters.

Important

  • If you change this parameter, you must stop and restart the POP3 service and the IIS Admin service. For more information on how to change the POP3 service state and start and stop the IIS Admin service, see Related Topics.

Notes

  • XOX
  • XOX
  • You cannot set the mail store to the root directory of the hard disk, for example C:\, or to a directory in which files are currently in use.
  • It is recommended that you locate the mail store on a NTFS file system partition.
  • The default mail store is system_drive:\Inetpub\mailroot\Mailbox.
  • The mail store must be a directory on the local file system or a Universal Naming Convention (UNC) path; mapped drives are not supported.
  • If you change the mail store from its default location or from a previous location, and there is stored e-mail, you must manually move the folders in which the e-mail is stored to the new location.
  • If you transfer the mail store to a new directory, you must move the mail store directory to ensure the directory retains the correct ownership; copying the mail store will not work.
  • If you move the mail store to a new location or restore it from a backup, you must reset the permissions on the directory using the winpop set mailroot command.
  • XOX
  • Because the mail store can potentially use large amounts of disk space, you should either set a disk quota limit on the volume of the mail store (to control its disk space usage) or set it to use a volume other than the one where the operating system is installed. This will prevent the possibility of the operating system running out of disk space if the mail store becomes too large. For more information on disk quotas, see Configuring disk quotas for the POP3 service.

Using a command line

  1. Open Command Prompt.
  2. Type:

    winpop set mailroot path_to_mail_store

Value | Description
winpop set mailroot | Sets the mail store for the server.
path_to_mail_store | Specifies a directory on the local file system or a Universal Naming Convention (UNC) path. The maximum allowable value is 260 characters.

Important

  • If you change this parameter, you must stop and restart the POP3 service and the IIS Admin service. For more information on how to change the POP3 service state and start and stop the IIS Admin service, see Related Topics.

Notes

  • XOX
  • XOX
  • You cannot set the mail store to the root directory of the hard disk (for example C:\), or to a directory in which files are currently in use.
  • It is recommended that you locate the mail store on a NTFS file system partition.
  • The default mail store is system_drive:\Inetpub\mailroot\Mailbox.
  • The mail store must be a directory on the local file system or a Universal Naming Convention (UNC) path; mapped drivers are not supported.
  • If you change the mail store from its default or from a previous location, and there is stored e-mail, you must manually move the folders in which the e-mail is stored to the new location.
  • If you move the mail store to a new location or restore it from a backup, you must reset the permissions on the directory using the winpop set mailroot command.
  • XOX
  • To view the complete syntax for this command, at a command prompt, type:

    winpop set help

  • Because the mail store can potentially use large amounts of disk space, you should either set a disk quota limit on the volume of the mail store (to control its disk space usage) or set it to use a volume other than the one where the operating system is installed. This will prevent the possibility of the operating system running out of disk space if the mail store becomes too large. For more information on disk quotas, see Configuring disk quotas for the POP3 service.


Change service settings

  • Configure the mail server to require Secure Password Authentication
  • Change the POP3 service state
  • Set the port
  • Set the event logging level
  • Set the number of sockets
  • Set the number of threads
  • Connect to a remote server running the POP3 service


Configure the mail server to require Secure Password Authentication

To configure the mail server to require Secure Password Authentication

Using the Windows interface

  1. Open POP3 service
  2. In the console tree, right-click the computer_name node and click Properties.

    Where?

    • POP3 Service
    • computer_name
  3. Select Require Secure Password Authentication (SPA) for all client connections.

Important

  • XOX

Notes

  • XOX
  • XOX
  • SPA supports only Active Directory integrated authentication and local Windows accounts authentication.
  • If you enable SPA, users' e-mail clients must also be configured to use SPA. For more information, see Related Topics.
  • XOX
  • Configuring the mail server to require Secure Password Authentication affects only the POP3 service and not the Simple Mail Transfer Protocol (SMTP) service. For more information about the security options for the SMTP service, see Set Security Options.

Using a command line

  1. Open Command Prompt.
  2. Type:

    winpop set sparequired {0|1}

Value | Description
winpop set sparequired | Specifies whether Secure Password Authentication is required for all client connections.
{0|1} | Specifies whether secure authentication is required from all e-mail clients. The default is 0, which specifies that SPA is not required. 1 requires SPA from all e-mail clients and prevents e-mail clients from authenticating by using plaintext authentication.

Important

  • XOX

Notes

  • XOX
  • XOX
  • SPA supports only Active Directory integrated authentication and local Windows accounts authentication.
  • If you enable SPA, users' e-mail clients must also be configured to use SPA. For more information, see Related Topics.
  • XOX
  • To view the complete syntax for this command, at a command prompt, type:

    winpop set help

  • Configuring the mail server to require Secure Password Authentication affects only the POP3 service and not the Simple Mail Transfer Protocol (SMTP) service. For more information about the security options for the SMTP service, see Set Security Options.


Change the POP3 service state

To change the POP3 service state

Using the Windows interface

  1. Open POP3 service.
  2. In the console tree, right-click ComputerName, point to All Tasks, and then click the state you want, as described in the table.

    Where?

    • POP3 Service
    • computer_name
Service state | Description
Start | Starts the POP3 service from a stopped or paused state and allows POP3 clients to connect to the mail server and retrieve e-mail.
Stop | Stops the POP3 service. All current connections are terminated.
Pause | Pauses the POP3 service so that no new connections will be accepted. Existing connections are not affected.
Resume | Resumes the POP3 service from a paused state to allow POP3 clients to connect to the server and retrieve e-mail.
Restart | Restarts the POP3 service. All current connections are terminated.

Notes

  • XOX
  • XOX
  • XOX

Using a command line

  1. Open Command Prompt.
  2. Type:

    net {start|stop} pop3svc

Value | Description
net {start|stop} | Starts or stops a service.
pop3svc | Specifies the POP3 service.

Notes

  • XOX
  • XOX
  • XOX
  • To view the complete syntax for this command, at a command prompt, type:

    net start /help

    net stop /help


Set the port

To set the port

Using the Windows interface

  1. Open POP3 service.
  2. In the console tree, right-click the computer_name node and click Properties.

    Where?

    • POP3 Service
    • computer_name
  3. In Server Port, type an appropriate port number from 1 to 65535.

Important

  • XOX

Notes

  • XOX
  • XOX
  • The port used by the POP3 service is configured by default to 110, the Internet standard for the POP3 protocol. If you change the port from 110, you must notify users to configure their e-mail clients to reflect the change.
  • XOX

Using a command line

  1. Open Command Prompt.
  2. Type:

    winpop set port port_number

Value | Description
winpop set port | Sets the port that POP3 service monitors for clients.
port_number | Specifies any valid port number from 1 to 65535.

Important

  • XOX

Notes

  • XOX
  • XOX
  • XOX
  • The port used by the POP3 service is configured by default to 110, the Internet standard for the POP3 protocol. If you change the port from 110, you must notify users to configure their e-mail clients to reflect the change.
  • To view the complete syntax for this command, at a command prompt, type:

    winpop set help


Set the logging level

To set the event logging level

Using the Windows interface

  1. Open POP3 service.
  2. In the console tree, right-click the computer_name node, and then click Properties.

    Where?

    • POP3 Service
    • computer_name
  3. In Logging level, click the drop-down menu, and then click the logging level you want, as described in the following table.
POP3 event logging level | Description
None | No events are logged.
Low | Only critical events are logged.
Medium | Critical and warning events are logged.
High | Critical, warning, and informational events are logged.

Important

  • If you change this parameter, you must stop and restart the POP3 service and the IIS Admin service. For more information on how to change the POP3 service state and manage the IIS Admin service, see Related Topics.

Notes

  • XOX
  • XOX
  • XOX

Using a command line

  1. Open Command Prompt.
  2. Type:

    winpop set logging {0|1|2|3}

Value | Description
winpop set logging | Sets the event logging level for the POP3 service. For example, to log only critical events type: winpop set logging 1.
{0|1|2|3} | Specifies the level at which events are logged. 0 - No events are logged. 1 - Only critical events are logged. 2 - Critical and warning events are logged. 3 - Critical, warning, and informational events are logged.

Important

  • If you change this parameter, you must stop and restart the POP3 service and the IIS Admin service. For more information on how to change the POP3 service state and manage the IIS Admin service, see Related Topics.

Notes

  • XOX
  • XOX
  • XOX
  • To view the complete syntax for this command, at a command prompt, type:

    winpop set help


Set the number of sockets

To set the number of sockets

  1. Open Command Prompt.
  2. Type:

    winpop set socketmin number_of_sockets
    or
    winpop set socketmax number_of_sockets
    or
    winpop set socketthreshold number_of_sockets
    or
    winpop set socketbacklog number_of_sockets
    or
    winpop set socket socketbacklog socketmax socketmin socketthreshold

Variable | Description | Numeric value for number_of_sockets
winpop set socketmin | Sets the minimum number of sockets that the POP3 service can create (socketmin). The default setting is 10. | The value of number_of_sockets for this parameter must be from 1 to 32,000 and less than socketmax.
winpop set socketmax | Sets the maximum number of sockets the service can create (socketmax). Once socketmax has been reached, any new connection attempts are held in a queue (determined by socketbacklog) until an existing connection is disconnected. The default value is 50. | The value of number_of_sockets for this parameter must be from 1 to 32,000 and greater than socketmin + socketthreshold.
winpop set socketthreshold | Sets the number of new sockets that the POP3 service can create at a time. Once socketmin is reached, n number of new sockets are created (if there are still remaining sockets available), where n is the value of socketthreshold. | The value of number_of_sockets for this parameter must be from 1 to 99, or 0 if socketmin = socketmax.
winpop set socketbacklog | Sets the number of connections that are held in a queue once socketmax has been reached (determined by socket backlog). Connection requests that occur after socketmax has been reached, and are less than socketmax+socketbacklog, are accepted, but do not receive any response until a new socket becomes available. Once socketbacklog is filled, new connection attempts are denied. | The value of number_of_sockets for this parameter must be from 0 to 100.
winpop set socket | Sets all the socket values. You must provide a numeric value for each of the four four variables. | Each numeric value should follow the specifications for each variable, as described previously in this table; for example, winpop set socket 5 40 10 5.

Important

  • Do not change these parameters unless it is necessary to do so. Changing these parameters can adversely affect the performance of the POP3 service.
  • If you change these parameters, you must stop and restart the POP3 service. For more information on changing the POP3 service state, see Related Topics.

Notes

  • XOX
  • XOX
  • XOX
  • To view the complete syntax for this command, at a command prompt, type:

    winpop set help


Set the number of threads

To set the number of threads

  1. Open Command Prompt.
  2. Type:

    winpop set threadcount number_of_threads

Value | Description
winpop set threadcount | Sets the number of threads for the POP3 service. This value is based on the number of CPUs that are installed on the computer on which the POP3 service is running.
number_of_threads | Specifies the number of CPUs installed on the computer on which the POP3 service is running. This value must be from 1 to 32.

Important

  • Do not change this parameter unless it is necessary to do so. Changing this parameter can adversely affect the performance of the POP3 service.
  • XOX

Notes

  • XOX
  • XOX
  • XOX
  • To view the complete syntax for this command, at a command prompt, type:

    winpop set help


Connect to a remote server running the POP3 service

To connect to a remote server running the POP3 service

  1. Open POP3 service.
  2. In the console tree, right-click POP3 Service, and then click Connect.
  3. Do one of the following:
    • In Server Name, type the name of the computer to which you want to connect, and then click OK.
    • Or, click Browse to view the list of computers available on your network, select the appropriate computer, and then click OK.

Notes

  • XOX
  • To open the POP3 service snap-in, click Start, point to Administrative Tools, and then click POP3 Service.
  • XOX
  • To connect to a remote mail server running the POP3 service, your computer must also have the POP3 service installed and be on the same local network.


Manage domains

  • Create a domain
  • Delete a domain
  • List domains
  • Lock a domain
  • Unlock a domain
  • View domain statistics


Create a domain

To create a domain

Using the Windows interface

  1. Open POP3 service.
  2. In the console tree, right-click the computer_name node, point to New, and then click Domain.

    Where?

    • POP3 Service
    • computer_name
  3. In Domain name, type the name of the domain to be created, and then click OK.

Notes

  • XOX
  • XOX
  • Contact your Internet Service Provider (ISP) for domain naming requirements and conventions. For information about this, see Related Topics.
  • The POP3 service supports top-level and third-level domain names. For example, example.com and mailserver.example.com are both supported.
  • XOX

Using a command line

  1. Open Command Prompt.
  2. Type:

    winpop add domain_name

Value | Description
winpop add | Creates a new domain and adds it to the existing POP3 service directory structure.
domain_name | Specifies the name of the domain you want to create, for example, example.com.

Notes

  • XOX
  • XOX
  • Contact your Internet Service Provider (ISP) for domain naming requirements and conventions. For information about this, see Related Topics.
  • The POP3 service supports top-level and third-level domain names. For example, example.com and mailserver.example.com are both supported.
  • XOX
  • To view the complete syntax for this command, at a command prompt, type:

    winpop help


Delete a domain

To delete a domain

Using the Windows interface

  1. Open POP3 service.
  2. In the console tree, click ComputerName, right-click the domain you want to delete, and then click Delete.
  3. When the confirmation box appears, click Yes to delete the domain, all of the mailboxes stored in that domain, and all mail stored in that domain.

Caution

  • Deleting a domain will delete all of the mailboxes in that domain, the corresponding mail store directories, and all e-mail stored in those directories.

Notes

  • XOX
  • XOX
  • You cannot delete a domain while a user in that domain is connected to the server running the POP3 service.
  • If you are using local Windows accounts or Active Directory integrated authentication, and you have created user accounts, the user accounts are not deleted when the corresponding mailboxes are deleted.
  • XOX

Using a command line

  1. Open Command Prompt.
  2. Type:

    winpop delete domain_name

Value | Description
winpop delete | Deletes an existing domain.
domain_name | Specifies the name of the domain you want to delete, for example, example.com.

Caution

  • Deleting a domain will delete all of the mailboxes in that domain, the corresponding mail store directories, and all e-mail stored in those directories.

Notes

  • XOX
  • XOX
  • If you are using local Windows accounts or Active Directory integrated authentication, and you have created user accounts, the user accounts are not deleted when their corresponding mailboxes are deleted.
  • XOX
  • To view the complete syntax for this command, at a command prompt, type:

    winpop help


List domains

To list domains

Using the Windows interface

  1. Open POP3 service.
  2. In the console tree, click the computer_name node. All domains on that server appear in the details pane.

    Where?

    • POP3 Service
    • computer_name

Notes

  • XOX
  • To open the POP3 service snap-in, click Start, point to All Programs, point to Administrative Tools, and then click POP3 Service.
  • XOX

Using a command line

  1. Open Command Prompt.
  2. Type:

    winpop list

Value | Description
winpop list | Lists all POP3 service domains.

Notes

  • XOX
  • XOX
  • XOX
  • To view the complete syntax for this command, at a command prompt, type:

    winpop help


Lock a domain

To lock a domain

Using the Windows interface

  1. Open POP3 service.
  2. In the console tree, click the computer_name node.

    Where?

    • POP3 Service
    • computer_name
  3. In the details pane, right-click the domain you want to lock, and then click Lock.

Notes

  • XOX
  • XOX
  • When you lock a domain, you prevent all members of the domain from retrieving their e-mail. Incoming e-mail for the domain is still received and delivered to the appropriate mailbox directory in the mail store. The service will also continue to send outgoing mail.
  • When a domain is locked, individual mailboxes cannot be unlocked; the entire domain must be unlocked.
  • XOX

Using a command line

  1. Open Command Prompt.
  2. Type:

    winpop lock domain_name

Value | Description
winpop lock | Locks all mailboxes in a domain, which prevents users from downloading mail using the POP3 service.
domain_name | Specifies the domain you want to lock; for example, example.com

Notes

  • XOX
  • XOX
  • When you lock a domain, you prevent all members of the domain from retrieving their e-mail. Incoming e-mail for the domain is still received and delivered to the appropriate mailbox directory in the mail store. The service will also continue to send outgoing mail.
  • When a domain is locked, individual mailboxes cannot be unlocked; the entire domain must be unlocked.
  • XOX
  • To view the complete syntax for this command, at a command prompt, type:

    winpop help


Unlock a domain

To unlock a domain

Using the Windows interface

  1. Open POP3 service.
  2. In the console tree, click the computer_name node to display the list of domains.

    Where?

    • POP3 Service
    • computer_name
  3. In the details pane, right-click the locked domain you want to unlock, and then click Unlock.

Notes

  • XOX
  • XOX
  • When a domain is locked, individual mailboxes cannot be unlocked; the entire domain must be unlocked.
  • XOX

Using a command line

  1. Open Command Prompt.
  2. Type:

    winpop unlock domain_name

Value | Description
winpop unlock | Unlocks a locked domain to permit users to download e-mail again using the POP3 service.
domain_name | Specifies the name of the domain that you want to unlock, for example, example.com

Notes

  • XOX
  • XOX
  • When a domain is locked, individual mailboxes cannot be unlocked; the entire domain must be unlocked.
  • XOX
  • To view the complete syntax for this command, at a command prompt, type:

    winpop help


View domain statistics

To view domain statistics

Using the Windows interface

  1. Open POP3 service.
  2. In the console tree, click the domain you for which you want to view statistics.

    Where?

    • POP3 Service
    • computer_name
    • domain_name
    The domain statistics appear in the details pane.

Notes

  • XOX
  • XOX
  • Depending on the number of domains and mailboxes on the server running the POP3 service, this procedure might require considerable CPU resources.
  • XOX

Using a command line

  1. Open Command Prompt.
  2. Type:

    winpop stat

Value | Description
winpop stat | Displays statistics for the domain, including total number of mailboxes in the domain, lock/unlock status of the domain, total number of messages, and disk usage.

Notes

  • XOX
  • XOX
  • Depending on the number of domains and mailboxes on the server running the POP3 service, this procedure might require considerable CPU resources.
  • XOX
  • To view the complete syntax for this command, at a command prompt, type:

    winpop help


Manage mailboxes

  • Create a mailbox
  • Delete a mailbox
  • List mailboxes
  • Lock a mailbox
  • Unlock a mailbox
  • Change a password
  • View mailbox statistics
  • Create a quota file
  • Migrate an encrypted password file user account to an Active Directory user account


Create a mailbox

To create a mailbox

Using the Windows interface

  1. Open POP3 service.
  2. In the console tree, click the computer_name node.

    Where?

    • POP3 Service
    • computer_name
  3. In the details pane, right-click the domain in which you want to create a new mailbox, point to New, and then click Mailbox.
  4. Check the Create associated user for this mailbox box if you are using local Windows accounts authentication or Active Directory integrated authentication, unless a user account already exists with the same name as the mailbox you want to create. If the check box is already selected, clear it only if an account already exists with the same name as the mailbox you want to create.
  5. In Mailbox Name, type a name for the mailbox.
  6. In Password, type the password for the mailbox, and then retype it in Confirm Password.

Important

  • If you are using Active Directory integrated authentication and have multiple POP3 e-mail domains, when creating mailboxes, you should consider whether the mailbox you are creating has the same name as an existing mailbox in another POP3 e-mail domain.

    Each mailbox is associated with an Active Directory user account, which has both a user logon name and pre-Windows 2000 user logon name. The user logon name is the name of the Active Directory user account and the POP3 mailbox. Usually, the pre-Windows 2000 user logon name is the same as the user logon name. If you try to create a mailbox and user account when an existing user account has the same pre-Windows 2000 user logon name, a naming conflict will occur.

    Active Directory does not support multiple accounts with the same pre-Windows 2000 user logon name. If there is a naming conflict, the mailbox name and e-mail address will not be affected, but the account's pre-Windows 2000 logon name will be modified to prevent any naming conflict with the existing account. If you are using Secure Password Authentication and a naming conflict has occurred, the pre-Windows 2000 logon name must be used for e-mail client authentication.

    To determine the modified logon name, go to the Active Directory Users and Computers snap-in located in the Administrative Tools menu. Go to the Users folder, right-click the user account and then click Properties. Click the Account tab and the modified account name will be displayed in User logon name (pre-Windows 2000). You must note the pre-Windows 2000 logon name and provide it to the user. For more information about configuring e-mail clients to use Secure Password Authentication, see Related Topics.

  • Depending on your authentication method, certain characters are not allowed in mailbox names. Periods are allowed, but they must not be either leading or trailing. The following example illustrates the correct use of a period:

    john.someone@example.com

    The following table lists the characters that are prohibited for each type of authentication.

    Authentication method Prohibited characters
    Active Directory integrated authentication @ ( ) / \ [ ] : ; , “ < > * = | ? +
    Local Windows accounts authentication @ ( ) / \ [ ] : ; , “ < > * = | ? +
    Encrypted password file authentication @ ( ) / \ [ ] : ; , “ < > * = | ?

Notes

  • XOX
  • XOX
  • The Create associated user for this mailbox option is only available if the server is using Active Directory integrated authentication or local Windows accounts authentication.
  • The maximum length for a mailbox name is 20 characters for local Windows accounts authentication and 64 characters for encrypted password file authentication or Active Directory integrated authentication. The minimum length is 1 character.
  • XOX

Using a command line

  1. Open Command Prompt.
    • If you are using Active Directory integrated authentication or local Windows accounts authentication, type:

      winpop add username@domain_name [/createuser: new_user's_password]

    • If you are using encrypted password file authentication, type:

      winpop add username@domain_name /createuser: new_user's_password

Value | Description
winpop add | Creates a mailbox in the domain.
username@domain_name | Specifies the user name for the corresponding mailbox and domain name in which to create the mailbox.
/createuser Creates a corresponding user in the Active Directory or local computer.

If you are using Active Directory integrated or local Windows accounts authentication, you must use this command when creating a mailbox, unless a user account exists already with the same as the mailbox you want to create.

If you are using encrypted password file authentication, /createuser is still required even though a user account is not created. If you have configured your server with this option as a default, this parameter will have no affect.
new_user's_password | Specifies the password that will be used to access the mailbox.

Important

  • If you are using Active Directory integrated authentication and have multiple POP3 e-mail domains, when creating mailboxes, you should consider whether the mailbox you are creating has the same name as an existing mailbox in another POP3 e-mail domain.

    Each mailbox is associated with an Active Directory user account, which has both a user logon name and pre-Windows 2000 user logon name. The user logon name is the name of the Active Directory user account and the POP3 mailbox. Usually, the pre-Windows 2000 user logon name is the same as the user logon name. If you try to create a mailbox and user account when an existing user account has the same pre-Windows 2000 user logon name, a naming conflict will occur.

    Active Directory does not support multiple accounts with the same pre-Windows 2000 user logon name. If there is a naming conflict, the mailbox name and e-mail address will not be affected, but the account's pre-Windows 2000 logon name will be modified to prevent any naming conflict with the existing account. If you are using Secure Password Authentication and a naming conflict has occurred, the pre-Windows 2000 logon name must be used for e-mail client authentication.

    To determine the modified logon name, go to the Active Directory Users and Computers snap-in located in the Administrative Tools menu. Go to the Users folder, right-click the user account and then click Properties. Click the Account tab and the modified account name will be displayed in User logon name (pre-Windows 2000). You must note the pre-Windows 2000 logon name and provide it to the user. For more information about configuring e-mail clients to use Secure Password Authentication, see Related Topics.

  • Depending on your authentication method, certain characters are not allowed in mailbox names. Periods are allowed, but they cannot be either leading or trailing. The following example illustrates the correct use of a period:

    john.someone@example.com

    The following table lists the characters that are prohibited for each type of authentication.

    Authentication method Prohibited characters
    Active Directory integrated authentication @ ( ) / \ [ ] : ; , “ < > * = | ? +
    Local Windows accounts authentication @ ( ) / \ [ ] : ; , “ < > * = | ? +
    Encrypted password file authentication @ ( ) / \ [ ] : ; , “ < > * = | ?

Notes

  • XOX
  • XOX
  • The maximum length for a mailbox name is 20 characters for local Windows accounts authentication and 64 characters for encrypted password file authentication or Active Directory integrated authentication. The minimum length is 1 character.
  • To view the complete syntax for this command, at a command prompt, type:

    winpop help


Delete a mailbox

To delete a mailbox

Using the Windows interface

  1. Open POP3 service.
  2. In the console tree, click the domain containing the mailbox you want to delete.

    Where?

    • POP3 Service
    • computer_name
    • domain_name
  3. In the details pane, right-click the mailbox you want to delete, and then click Delete.
  4. If the mailbox has an associated Active Directory or local Windows accounts user, a dialog box appears. To delete the user account from the Active Directory or local computer Security Accounts Manager (SAM), select Also delete the user account associated with this mailbox.

Caution

  • Deleting a mailbox deletes the mail store directory for the mailbox and all e-mail that is stored in that directory.

Notes

  • XOX
  • XOX
  • XOX

Using a command line

  1. Open Command Prompt.
  2. Type:

    winpop delete username@domain_name /deleteuser

Value | Description
winpop delete | Deletes a mailbox from a domain. If there is a corresponding user in the Active Directory or local computer Security Accounts Manager (SAM), a prompt appears, confirming the deletion of the user entry in addition to the mailbox.
username@domain_name | Specifies the mailbox name at the corresponding domain, for example, someone@example.com.
/deleteuser | Deletes the corresponding user from the Active Directory or SAM.

Caution

  • Deleting a mailbox deletes the mail store directory for the mailbox and all e-mail that is stored in that directory.

Notes

  • XOX
  • XOX
  • XOX
  • To view the complete syntax for this command, at a command prompt, type:

    winpop help


List mailboxes

To list mailboxes

Using the Windows interface

  1. Open POP3 service.
  2. In the console tree, click the appropriate domain. The list of mailboxes appears in the details pane.

    Where?

    • POP3 Service
    • computer_name
    • domain_name

Notes

  • XOX
  • XOX
  • XOX

Using a command line

  1. Open Command Prompt.
  2. Type:

    winpop list domain_name

Value | Description
winpop list | Lists all mailboxes in the domain.
domain_name | Specifies the name of the domain for which you want a mailbox list, such as: example.com.

Notes

  • XOX
  • XOX
  • XOX
  • To view the complete syntax for this command, at a command prompt, type:

    winpop help


Lock a mailbox

To lock a mailbox

Using the Windows interface

  1. Open POP3 service.
  2. To display the list of mailboxes, in the console tree, click the appropriate domain.

    Where?

    • POP3 Service
    • computer_name
    • domain_name
  3. In the details pane, right-click the mailbox you want to lock, and then click Lock.

Notes

  • XOX
  • XOX
  • When a mailbox is locked, it continues to receive incoming e-mail, which is delivered to the mail store. The user is unable to connect to the server and retrieve e-mail, however.
  • While a mailbox is locked, the only restriction is that the user cannot connect to the server. An administrator can still perform all administrative tasks, such as deleting a mailbox or changing the password for a mailbox.
  • XOX

Using a command line

  1. Open Command Prompt.
  2. Type:

    winpop lock username@domain_name

Value | Description
winpop lock | Locks the specified mailbox account to prevent the user from retrieving e-mail.
username@domain_name | The mailbox account that you want to lock; for example, someone@example.com

Notes

  • XOX
  • XOX
  • XOX
  • When a mailbox is locked, it continues to receive incoming e-mail, which is delivered to the mail store. The user is unable to connect to the server and retrieve e-mail, however.
  • While a mailbox is locked, the only restriction is that the user cannot retrieve e-mail from the mail server. An administrator can still perform all administrative tasks, such as deleting a mailbox or changing the password for a mailbox.
  • To view the complete syntax for this command, at a command prompt, type:

    winpop help


Unlock a mailbox

To unlock a mailbox

Using the Windows interface

  1. Open POP3 service.
  2. In the console tree, click the appropriate domain to display the list of mailboxes.

    Where?

    • POP3 Service
    • computer_name
    • domain_name
  3. In the details pane, right-click the mailbox you want to unlock, and then click Unlock.

Notes

  • XOX
  • XOX
  • If an individual mailbox is locked because it is part of a locked domain, you cannot unlock it.
  • XOX

Using a command line

  1. Open Command Prompt.
  2. Type:

    winpop unlock username@domain_name

Value | Description
winpop unlock | Unlocks the specified mailbox account if it has been previously locked.
username@domain_name | Specifies the mailbox account that you want to unlock.

Notes

  • XOX
  • XOX
  • If an individual mailbox is locked because it is part of a locked domain, you cannot unlock it.
  • XOX
  • To view the complete syntax for this command, at a command prompt, type:

    winpop help unlock


Change a password

To change a password

  1. Open Command Prompt.
  2. Type:

    winpop changepwd username@domain_name new_password

Value | Description
winpop changepwd | Changes the password of a mailbox account.
username@domain_name | Specifies the mailbox account for the password you want to change.
new_password | Specifies the new password for the mailbox account you want to change

Notes

  • XOX
  • XOX
  • Depending on your authentication method there are other ways you can change a user's password.

    If you are using Active Directory integrated authentication you can use the Active Directory Users and Computers snap-in to change a user's password.

    If you are using local Windows accounts authentication you can use the Computer Management snap-in to change a user's password.

    For more information, see Related Topics.

  • XOX
  • To view the complete syntax for this command, at a command prompt, type:

    winpop help


View mailbox statistics

To view mailbox statistics

Using the Windows interface

  1. Open POP3 service.
  2. In the console tree, click the appropriate domain.

    Where?

    • POP3 Service
    • computer_name
    • domain_name

    Mailbox statistics appear in the details pane.

Notes

  • XOX
  • XOX
  • XOX

Using a command line

  1. Open Command Prompt.
  2. Type:

    winpop stat domain_name

Value | Description
winpop stat | Displays statistics for the domain, including the number of messages in account, the lock/unlock status of the mailbox, size of account, and whether the user is currently connected.
domain_name | Specifies the domain that you want to view statistics for, for example, example.com.

Notes

  • XOX
  • XOX
  • XOX
  • To view the complete syntax for this command, at a command prompt, type:

    winpop help


Create a quota file

To create a quota file

  1. Open Command Prompt.
  2. Type:

    winpop createquotafile username@domain [/user:username]

Value | Description
winpop createquotafile | Specifies to create a quota file.
username@domain | Specifies the user for which a quota file should be created.
/user:username | Specifies to use an existing user account's quota file as a reference to create the quota file.

Notes

  • XOX
  • XOX
  • XOX
  • If you are using Active Directory integrated authentication or local Windows accounts authentication, a quota file is created by default when a mailbox is created.
  • To view the complete syntax for this command, at a command prompt, type:

    winpop help


Migrate an encrypted password file user account to an Active Directory user account

To migrate an encrypted password file user account to an Active Directory user account

  1. Open Command Prompt.
  2. Type:

    winpop migrateToAD UserName@DomainName

Value | Description
winpop migrateToAD | Migrates an encrypted password file user account to an Active Directory user account. The encrypted password file user account's password becomes the Active Directory user account's password.
UserName@DomainName | Specifies the existing encrypted password file user account.

Notes

  • XOX
  • XOX
  • XOX
  • The user's mailbox is not migrated. For the new Active Directory user account to be able to send and receive e-mail, you must change the authentication method to Active Directory integrated authentication and create a new mailbox for the Active Directory user account.
  • To view the complete syntax for this command, at a command prompt, type:

    winpop help


Configure the Simple Mail Transfer Protocol service

  • Start or stop the Simple Mail Transfer Protocol service
  • Configure the Simple Mail Transfer Protocol service for e-mail relaying
  • Configure e-mail clients for e-mail relaying


Start or stop the SMTP service

To start or stop the Simple Mail Transfer Protocol service

Using the Windows interface

  1. Open Services.
  2. In the details pane, right-click Simple Mail Transfer Protocol (SMTP), and then click the appropriate service state.

Note

  • XOX

Using a command line

  1. Open Command Prompt.
  2. Type:

    net {start|stop} smtpsvc

Value | Description
net {start|stop} | Starts or stops a service.
smtpsvc | Specifies the Simple Mail Transfer Protocol (SMTP) service.

Notes

  • XOX
  • To view the complete syntax for this command, at a command prompt, type:

    net {start|stop} /?


Configure the Simple Mail Transfer Protocol service for e-mail relaying

To configure the Simple Mail Transfer Protocol service for e-mail relaying

  1. To open Internet Information Services (IIS), click Start, click Run, type inetmgr, and then click OK. If the Internet Information Services (IIS) snap-in does not appear, verify that you have installed IIS.
  2. In the console tree, right-click Default SMTP Virtual Server, and then click Properties.

    Where?

    • Internet Information Services
    • computer_name
    • Default SMTP Virtual Server
  3. Click Access, click Authentication, select Integrated Windows Authentication, and then click OK.

Notes

  • XOX
  • XOX
  • This procedure is necessary only if you are using Active Directory integrated authentication or local Windows accounts authentication, and you want to enable e-mail relaying. If you are using encrypted password file authentication, see the topic on Simple Mail Transfer Protocol (SMTP) in Related Topics for information about e-mail relaying.


Configure e-mail clients e-mail relaying

To configure e-mail clients for e-mail relaying

  1. Click Start, point to All Programs, and then click Outlook Express.
  2. Click Tools, and then click Accounts.
  3. Click the Mail tab, click your POP3 service mail server, and then click Properties.
  4. In Outgoing Mail Server, click My server requires authentication, click Settings, and then select Log on using.
  5. In Account name, type the name of your POP3 mailbox without the domain. For example, if your mailbox is someone@example.com, you would type:

    someone

  6. In Password, type the password for your POP3 mailbox, and then click OK.

Notes

  • For this procedure, you must use Active Directory integrated or local Windows accounts authentication. If you are using encrypted password file authentication and want to configure e-mail relaying, see the topic on Simple Mail Transfer Protocol (SMTP) in Related Topics.
  • This procedure uses Outlook Express as an example. If you are not using Outlook Express, check the documentation for your e-mail client for information about configuring e-mail clients to authenticate to the Simple Mail Transfer Protocol (SMTP) service.


Configure e-mail clients

  • Configure Outlook Express for e-mail services
  • Configure Outlook Express for Secure Password Authentication


Configure Outlook Express for e-mail services

To configure Outlook Express for e-mail services

  1. Click Start, point to All Programs, and then click Outlook Express.
  2. On the Tools menu, click Accounts.
  3. Click Add, and then click Mail.
  4. Follow the instructions in the Internet Connection Wizard until you reach the Internet Mail Logon page.
  5. In Account name, type your POP3 service user name, followed by the domain, for example, someone@example.com.
  6. In Password, type the password associated with your POP3 service e-mail account.
  7. If your mail server is configured to require SPA, select Log on using Secure Password Authentication (SPA), and then complete the wizard.

Important

  • You must perform this procedure on e-mail clients that will use the POP3 service.

Notes

  • If you are using an e-mail client other than Outlook Express, see your product documentation for information about how to configure your e-mail client to use the user name and domain name.
  • Be sure to update your e-mail client and client operating system with the latest service pack available.
  • For additional information about configuring Outlook Express for Secure Password Authentication (SPA), see Related Topics.


Configure Outlook Express for Secure Password Authentication

To configure Outlook Express for Secure Password Authentication

  1. Click Start, point to All Programs, and then click Outlook Express.
  2. On the Tools menu, click Accounts.
  3. In Internet Accounts, click the Mail tab, click the name of your POP3 e-mail account, and then click Properties.
  4. Click the Servers tab, and then click Log on using Secure Password Authentication.
  5. In Account name, type your POP3 service user name not including the domain. For example, if your e-mail address is someone@example.com, you would type:

    someone

    and then click OK. If a naming conflict occurred when the mailbox was created, the user name is the pre-Windows 2000 logon name. For more information about the pre-Windows 2000 logon name, see Notes.

Notes

  • Secure Password Authentication (SPA) only supports Active Directory integrated authentication and local Windows accounts authentication.
  • Be sure to update your e-mail client software and client operating system with the latest service pack available.
  • If you are using an e-mail client other than Outlook Express, check your product documentation for information about how to configure your e-mail client to use Secure Password Authentication (SPA) (also known as NTLM Authentication).
  • If a dialog box prompts you for your credentials after you configure Outlook Express for SPA, enter your credentials, as described in the following table:
    Value | Description
    User Name Your user name, not including the domain. For example, if your e-mail address is someone@example.com, you would type:

    someone

    If a naming conflict occurred when the mailbox was created, the user name is the pre-Windows 2000 logon name.
    Password | Your password.
    Domain | For Active Directory integrated authentication, this is the network basic input/output system (NetBIOS) name of the domain. For local Windows accounts authentication, this is the name of the local computer.
  • If you are using Active Directory integrated authentication and Secure Password Authentication and a naming conflict occurred when the mailbox was created, the pre-Windows 2000 logon name must be used for e-mail client authentication. To determine the modified logon name, go to the Active Directory Users and Computers snap-in in Administrative Tools. Go to the Users folder, right-click the user account, and then click Properties. Click the Account tab and the modified account name will appear in User logon name (pre-Windows 2000). You must note the pre-Windows 2000 logon name and provide it to the user.


Concepts

The following topics provide background information about the POP3 service:

  • POP3 service overview
  • Understanding the POP3 service
  • Using the POP3 service


POP3 service overview

The POP3 service is an e-mail service that retrieves e-mail. Administrators can use the POP3 service to store and manage e-mail accounts on the mail server.

When the POP3 service is installed on the mail server, users can connect to the mail server and retrieve e-mail to their local computer using an e-mail client that supports the POP3 protocol (such as Microsoft Outlook). The POP3 service is used with the Simple Mail Transfer Protocol (SMTP) service, which sends outgoing e-mail.

E-mail transfer and retrieval overview

How e-mail moves from sender to recipient

The diagram illustrates how e-mail is transferred from sender to recipient, and how it is then retrieved to the recipient's local computer.

The sender's client computer connects to the Internet through an Internet Service Provider (ISP). Using an e-mail client, the sender sends an e-mail. The e-mail is picked up according to the SMTP protocol and is transferred to the sender's ISP, which then routes the e-mail out onto the Internet.

The e-mail moves through the Internet and is relayed through a varying number of intermediate servers on its way to the recipient. When the e-mail reaches the recipient's ISP, it is dropped into the recipient's mailbox.

When the recipient's computer connects to the recipient's ISP, the e-mail is then transferred from the ISP to the recipient's e-mail client on the local computer, according to the POP3 protocol. The POP3 service is the mechanism that allows users to retrieve their e-mail from the mail server.


Understanding the POP3 service

The POP3 service is an e-mail service that retrieves e-mail. Administrators can use the POP3 service to store and manage e-mail accounts on the mail server.

When the POP3 service is installed on the mail server, users can connect to the mail server and retrieve and download e-mail to their local computer. They do so by using an e-mail client that supports the POP3 protocol (such as Microsoft Outlook). The POP3 service is used with the Simple Mail Transfer Protocol (SMTP) service, which sends outgoing e-mail.

  • E-mail concepts
  • POP3 protocol
  • Simple Mail Transfer Protocol (SMTP)
  • POP3 service authentication methods
  • Mail store


E-mail concepts

Components of the POP3 e-mail system

The three components of the POP3 e-mail system are the POP3 e-mail client, the Simple Mail Transfer Protocol (SMTP) service, and the POP3 service. These are each described in the following table.

Component | Description
POP3 e-mail client | The POP3 e-mail client software that is used to read, compose, and manage e-mail. The POP3 e-mail client retrieves e-mail from the mail server and transfers it to the user's local computer so it can then be managed by the user. An example of an e-mail client that supports the POP3 protocol is Microsoft Outlook Express.
SMTP service | The e-mail transfer system that routes e-mail from the sender to the recipient using the SMTP protocol. The POP3 service uses the SMTP service as the e-mail transfer system. E-mail is composed by the user on a POP3 e-mail client. Then, after the user connects to the mail server using an Internet or network connection, the SMTP service picks up and transfers the e-mail across the Internet to the recipient's mail server.
POP3 service | The e-mail retrieval system that downloads e-mail from the mail server to the user's local computer using the POP3 protocol. The POP3 protocol controls the connection between a user's POP3 e-mail client and the server where e-mail is stored.

Administrators manage the POP3 service on three organizational levels: mail servers, e-mail domains, and mailboxes. These are described in the following table.

Category | Description
Mail server | The computer where the POP3 service is installed. Users connect to it to retrieve their e-mail.
E-mail domains | The e-mail domain must be a registered domain name and it must match the Mail eXchanger (MX) record created by your Internet Service Provider (ISP).
Mailboxes | Each mailbox corresponds to a user who is a member of the e-mail domain, such as someone@example.com. The user's mailbox corresponds to a directory in the mail store in which the user's e-mail is stored until it is retrieved.

A POP3 e-mail system

A POP3 e-mail system

In the diagram, e-mail is sent to someone@example.com, as illustrated by step 1. The e-mail is picked up by the SMTP service and is sent out on the Internet (step 2).

The e-mail domain, example.com, is then resolved to a mail server on the Internet, mailserver1.example.com (step 3). Mailserver1.example.com is a mail server running the POP3 service that receives incoming e-mail for the e-mail domain, example.com.

In step 4, the e-mail for someone@example.com is received by mailserver1.example.com and is moved into the mail store directory (step 5), where e-mail intended for someone@example.com is stored.

In step 6, the user, someone, checks for e-mail by connecting to the mail server running the POP3 service. The POP3 protocol transmits the user and password authentication credentials for the user, someone. The POP3 service verifies these credentials, and then either accepts or denies the connection.

If the connection is accepted, all of the e-mail for the user, someone, that is being stored in the mail store is downloaded from the mail server to someone's local computer (step 7). The mail is usually then deleted from the mail store.

Network security

The POP3 and SMTP protocols are not encrypted. If someone gains access to the network on which the server running the POP3 service is running, they could potentially read users' e-mail.

To increase network security, implement Internet Protocol security (IPSec).

IPSec is a framework of open standards for ensuring private, secure communications over Internet Protocol (IP) networks through the use of cryptographic security services. For more information about IPSec, see Internet Protocol security (IPsec).


POP3 protocol

The Post Office Protocol 3 (POP3) is a standard protocol for retrieving e-mail. The POP3 protocol controls the connection between a POP3 e-mail client and a server where e-mail is stored. The POP3 service uses the POP3 protocol for retrieving e-mail from a mail server to a POP3 e-mail client.

The POP3 protocol has three process states for handling the connection between the mail server and the POP3 e-mail client: the authentication state, the transaction state, and the update state.

During the authentication state, the POP3 e-mail client that is connected to the server must be authenticated before users can retrieve their e-mail. If the user name and password that are provided by the e-mail client match those on the server, the user is authenticated and proceeds to the transaction state. If not, the user receives an error message and is not allowed to connect to retrieve e-mail.

To prevent any damage to the mail store after the client has been authenticated, the POP3 service locks the user's mailbox. New e-mail that is delivered to the mailbox after the user has been authenticated (and the mailbox has been locked) is not available to download until after the connection has been terminated. Also, only one client can connect to a mailbox at a time; additional connection requests to the mailbox are rejected.

During the transaction state, the client sends POP3 commands and the server receives and responds to them according to the POP3 protocol. Any client requests the server receives that do not comply with POP3 protocol are ignored, and an error message is sent back.

The update state closes the connection between the client and server. It is the last command the client transmits.

After the connection is closed, the mail store is updated to reflect the changes made while the user was connected to the mail server. For example, after the user successfully retrieves e-mail, the retrieved e-mail is marked for deletion and then deleted from the mail store, unless the user's e-mail client is configured to do otherwise.


Simple Mail Transfer Protocol

Simple Mail Transfer Protocol (SMTP)

Simple Mail Transfer Protocol (SMTP) controls the way e-mail is transported and delivered across the Internet to the destination server. SMTP receives and sends e-mail between servers. The SMTP service is installed by default with the POP3 service to provide complete e-mail services.

The SMTP service is automatically installed on the computer where the POP3 service is installed to allow users to send outgoing e-mail. When you create a domain using the POP3 service, the domain is also added to the SMTP service to allow mailboxes in that domain to send outgoing e-mail. The SMTP service on the mail server receives incoming mail and transfers the e-mail to the mail store.

E-mail relay

E-mail relay occurs when users who are not members of the e-mail domain use a mail server with SMTP to send e-mail. SMTP mail servers that are not configured to prevent open relay are often abused by those who want to send large volumes of unsolicited commercial e-mail. The Microsoft SMTP service is configured by default to prevent e-mail relaying.

If you want to enable e-mail relay, however, you have the following two options, depending on which authentication method you are using:

  • If you are using Active Directory integrated authentication or local Windows accounts authentication, you can configure the mail server to require authentication before accepting outgoing e-mail.

    For more information on configuring the mail server, see To configure the Simple Mail Transfer Protocol service for e-mail relaying. If you configure the SMTP service to authenticate users trying to send outgoing mail, you must also configure the users' e-mail clients. For more information about configuring e-mail clients to allow relaying, see To configure e-mail clients for e-mail relaying.

  • If you are using encrypted password file and want to configure e-mail relaying, you must configure the mail server to allow relay based on either Internet Protocol (IP) address or e-mail domain name.

    For more information about configuring e-mail relay on the mail server, see Setting or Removing Relay Restrictions from a Virtual Server.

Note

  • When an e-mail is undeliverable, the Simple Mail Transfer Protocol (SMTP) service returns it to the sender with a non-delivery report (NDR). If the NDR cannot be delivered to the sender, a copy of the message is put in the Badmail directory. To prevent the possibility of the operating system running out of disk space (if the Badmail directory becomes too large), you must move the SMTP Badmail directory to a volume other than the one on which the operating system is installed. For more information on how to specify a location for the Badmail directory, see Storing NDRs.


POP3 service authentication methods

The POP3 service provides three different authentication methods for verifying users connecting to the mail server.

You must choose an authentication method before creating any e-mail domains on the mail server. You can change the authentication method only if there are no existing e-mail domains on the mail server.

The following table describes when to use each authentication method:

Authentication method When to use this authentication method
Local Windows accounts authentication
  • Your mail server is not a member of an Active Directory domain;

    • -AND-

  • You want to store user accounts on the server on which the POP3 service is installed.
Active Directory integrated authentication
  • Your mail server is a domain controller or a member of an Active Directory domain.
Encrypted password file authentication
  • Your mail server is not using Active Directory;

    • -OR-

  • You do not want to have user accounts for the POP3 service on the local computer.

For more information about the POP3 service authentication methods, see the following topics:

  • Local Windows accounts authentication
  • Active Directory integrated authentication
  • Encrypted password file authentication

Notes

  • If the computer on which the POP3 service is running is either a member of an Active Directory domain or a domain controller, the default authentication method is Active Directory integrated authentication. Otherwise, the default is local Windows accounts authentication.
  • If the computer where the POP3 service is running is a domain controller, the available authentication methods are Active Directory integrated authentication and encrypted password file authentication. If the computer where the POP3 service is running is a member server in an Active Directory domain, all three authentication methods are available. Otherwise, the available authentication methods are local Windows accounts authentication and encrypted password file authentication.


Local Windows accounts authentication

If you are not using Active Directory, but you want to create user accounts on the local computer where the POP3 service is installed, you can use local Windows accounts authentication to link the POP3 service into the local system user accounts.

Use local Windows accounts authentication if:

  • Your mail server is not a member of an Active Directory domain.

    • -and-

  • You want to have user accounts on the same local computer as the POP3 service.

Local Windows accounts authentication integrates the POP3 service into the local computer's Security Accounts Manager (SAM). With Security Accounts Manager, users who have user accounts on the local computer can use the same user name and password to be authenticated by both the POP3 service and the local computer.

You can use local Windows accounts authentication to support multiple domains on the server, but user names across domains must be unique. For example, you cannot have a user named someone@example.com and a user named someone@northwindtraders.com.

POP3 Users Security Accounts Manager group

If a mailbox is created with a corresponding user account, the user account is added to the "POP3 Users" local group. Members of the "POP3 Users" group cannot log on locally to the server even though they have a user account on the server.

The restriction on local logon is enforced through the computer's local security policy. It increases server security by restricting local logon rights only to authorized users. Being unable to log on locally to the server does not affect the users' ability to use the POP3 service.

For more information on local groups and modifying local group membership, see Local Users and Groups.

For more information on local security policy, see Local Security Policy.

E-mail client authentication

Local Windows accounts authentication supports both plaintext and Secure Password Authentication (SPA) e-mail client authentication.

Because plaintext transmits the user's credentials in an unsecured, unencrypted format, the use of plaintext is not recommended. SPA, however, does require that e-mail clients transmit both the user name and password using secure authentication; it is therefore recommended over plaintext authentication. For more information, see To configure the mail server to require Secure Password Authentication.

Note

  • To install Active Directory on the computer where the POP3 service is installed, see the section on upgrading from local Windows accounts to Active Directory integrated authentication in Active Directory integrated authentication. Installing Active Directory on a member server without following the recommended procedure might cause the POP3 service to work incorrectly.


Active Directory integrated authentication

You can use Active Directory integrated authentication to incorporate the POP3 service into your existing Active Directory domain. If mailboxes are created that correspond to existing Active Directory user accounts, users can use their existing Active Directory domain user name and password to send and receive e-mail. For more information about Active Directory, see Active Directory.

Use Active Directory integrated authentication if:

  • The server on which you want to install POP3 service is a member of an Active Directory domain or is an Active Directory domain controller.

You can use Active Directory integrated authentication to support multiple POP3 e-mail domains, and you can use the same user name across different POP3 e-mail domains. For example, you can have a user named someone@example.com and a user named someone@northwindtraders.com.

If you use Active Directory integrated authentication and have multiple POP3 e-mail domains, when you create a mailbox, be sure to consider whether the new mailbox has the same name as an existing mailbox in another POP3 e-mail domain. Each mailbox is associated with an Active Directory user account that has both a user logon name and pre-Windows 2000 user logon name. The user logon name is the name of the Active Directory user account and the POP3 mailbox.

Usually, the pre-Windows 2000 user logon name is the same as the user logon name. If, however, you try to create a mailbox and user account when there is an existing user account with the same pre-Windows 2000 user logon name, a naming conflict will occur. Active Directory does not support multiple accounts with the same pre-Windows 2000 user logon name.

If a naming conflict occurs, the mailbox name and e-mail address are not affected, but the account's pre-Windows 2000 logon name is modified to prevent any naming conflict with the existing account.

If you use Secure Password Authentication and a naming conflict has occurred, the pre-Windows 2000 logon name must be used for e-mail client authentication. To determine the modified logon name, go to the Active Directory Users and Computers snap-in located in the Administrative Tools menu. Go to the Users folder, right-click the user account, and then click Properties. Click the Account tab. The modified account name will appear in User logon name (pre-Windows 2000).

You must note the pre-Windows 2000 logon name and provide it to the user. For more information about configuring e-mail clients to use Secure Password Authentication, see To configure Outlook Express for Secure Password Authentication.

E-mail client authentication

Active Directory integrated authentication supports both plaintext and Secure Password Authentication (SPA) e-mail client authentication. Because plaintext transmits the user's credentials in an unsecured, unencrypted format, however, the use of plaintext authentication is not recommended. SPA does require e-mail clients to transmit both the user name and password using secure authentication; it is therefore recommended over plaintext authentication. For more information, see To configure the mail server to require Secure Password Authentication.

Upgrading from local Windows accounts to Active Directory integrated authentication

If you are upgrading your mail server to a domain controller, and you were using local Windows accounts authentication, you must complete the steps described in the following table before you can configure the POP3 service for Active Directory integrated authentication.

Step | Reference
Delete all existing e-mail domains in the POP3 service. | For more information on deleting e-mail domains, see To delete a domain.
Change the authentication method to Active Directory integrated. | For more information on changing the authentication method, see To set the authentication method.
Recreate the domains and associated mailboxes.
  • For more information on creating e-mail domains, see To create a domain
  • For more information on creating mailboxes, see To create a mailbox.

Notes

  • Installing Active Directory on a member server without following the recommended procedure can prevent the POP3 service from working correctly.
  • If you are using Active Directory integrated authentication, you must log on to the Active Directory domain, not the local computer, to administer the POP3 service.


Encrypted password file authentication

Encrypted password file authentication is ideal for large scale deployments where there is not an existing Active Directory deployment, and there will potentially be too many accounts to manage easily from a single local computer.

Use encrypted password file authentication if:

  • You are not using Active Directory.

    • -Or-

  • You do not want to create users on the local computer.

With encrypted password file authentication, you can use an identical user name across different domains, but you cannot assign the same user name to multiple mailboxes within a domain. For example, you cannot have two mailboxes named someone@example.com, but you can have someone@example.com and someone@northwindtraders.com.

Encrypted Password file authentication creates an encrypted file with the user's password, which is then stored in the user's mailbox directory on the server. During authentication, the password the user supplies is encrypted and compared to the encrypted file stored on the server. If the encrypted password matches the encrypted password stored on the server, the user is authenticated.

Migrating encrypted password file user accounts to Active Directory user accounts

You can migrate user accounts created under encrypted password file authentication to Active Directory user accounts using the winpop.exe command-line tool. For more information, see To migrate an encrypted password file user account to an Active Directory user account.

E-mail client authentication

Encrypted Password file authentication supports both plaintext and Authenticated POP (APOP) e-mail client authentication. Plaintext transmits the user's credentials in an unsecured, unencrypted format. Therefore, the use of plaintext authentication is not recommended.

Because APOP e-mail client authentication requires e-mail clients to transmit both the user name and password using secure authentication, it is recommended over plaintext authentication. For more information, see To configure the mail server to require Secure Password Authentication.


Mail store

The mail store is a directory or Universal Naming Convention (UNC) path where the POP3 service stores all e-mail until users retrieve it to their client computer.

The basic structure of the mail store, or mail root, is a directory on the local hard disk where all e-mail is stored.

When a domain is created, the POP3 service creates a corresponding directory in the directory that has been designated for the mail store. For each user with a mailbox in that domain, POP3 creates a directory in the domain directory. E-mail that a user receives is stored as an individual file within the user's directory until the user retrieves it using a POP3 e-mail client.

The following is an example of the path to an e-mail message in the mail store:

C:\inetpub\mailroot\mailbox\example.com\P3_someone.mbx\P347865.eml

where mailroot corresponds to the mail store directory, example.com to the domain directory, P3_somone.mbx to the directory for a mailbox named someone and P347865.eml to a single saved e-mail message.

The directory and file permissions for each directory in the mail store are identical. When you configure the mail store, the permissions are set so that only local or domain administrators and the local network service, which the POP3 service is configured to run under, are assigned permissions to the directories. No other user is assigned read/write permissions.

The mail store's functionality depends on having adequate hard disk space available. To ensure the mail store's functionality, you should develop a disk-space requirement estimate based on the number of users on the server, the volume of e-mail that they will receive, and the average size of the e-mail they will receive.

In addition, you can protect the server from situations where the mail store's disk usage might increase unexpectedly by implementing disk quotas. Disk quotas monitor and control disk space that is used on NTFS file system volumes. For more information, see Configuring disk quotas for the POP3 service.

Notes

  • Because the mail store can potentially use large amounts of disk space, you should either set a disk quota limit on the volume of the mail store (to control its disk space usage) or set it to use a volume other than the one where the operating system is installed. This will prevent the possibility of the operating system running out of disk space if the mail store becomes too large. For more information, see To set the mail store. For more information on disk quotas, see Configuring disk quotas for the POP3 service.
  • The mail store must be configured to use either a directory on the local hard disk or a UNC path; other storage options, such as mapped drives, are not supported.
  • You cannot set the mail store to the root directory of the hard disk, for example C:\, or to a directory in which files are currently in use.
  • If you restore the mail store from a backup or move it to a new location, you must reset the permissions on the mail store directory using the command-line procedure described in To set the mail store.
  • If you transfer the mail store to a new directory, you must move the mail store directory to ensure the directory retains the correct ownership; copying the mail store will not work.
  • Physical access to a server is a high security risk. To maintain a more secure environment, restrict physical access to the server where the mail store resides.


Using POP3 service

This section provides information on how to use the POP3 service:

  • Contacting your Internet Service Provider
  • POP3 service administration tools
  • POP3 service commands overview
  • Configuring disk quotas for the POP3 service
  • Remote administration


Contacting your Internet Service Provider

Before installing and configuring the POP3 service, you must contact your Internet Service Provider (ISP) and complete the steps described in the following table.

Step | Description | Additional reference
Register an e-mail domain name. | The e-mail domain name must be a registered domain name, and it must match the MX record created by your ISP. If you do not have have an e-mail domain name, contact your ISP for assistance registering a domain name. |
Have your ISP create a Mail eXchanger (MX) record for your e-mail domain that matches the name of your mail server running the POP3 service. | An MX record provides e-mail routing to a mail exchanger host for e-mail sent to the domain name. For example, in the domain example.com, the mail server might be mailserver1.example.com. The ISP would create an MX record for example.com that points to mailserver1.example.com. An e-mail that is sent to someone@example.com is routed to mailserver1.example.com. This is the server where the POP3 service is running and to which users connect to retrieve e-mail. | To change the name of your server to a title that reflects its role (for example, mailserver1), see To rename a computer.
Obtain information to configure your mail server for static addressing. | Your ISP must provide a separate static IP address for each mail server on which you intend to install the POP3 service. To obtain a static Internet Protocol (IP) address, you must also obtain the subnet mask, default gateway, and preferred Domain Name System (DNS) server from your ISP. Each mail server must then be configured to use an individual static IP address. | For more information on how to configure your mail server with a static IP address, see To configure TCP/IP for static addressing.


POP3 service administration tools

The POP3 service provides three methods for local administration and two methods for remote administration.

Local administration

You can administer the POP3 service on the local computer from the Microsoft Management Console (MMC) snap-in, the command line, or the Web Interface for Remote Administration. For more information, see Using Web Interface for Remote Administration.

Remote administration

You can administer the POP3 service on a remote computer from the Microsoft Management Console (MMC) snap-in or the Web Interface for Remote Administration. You can also set up Terminal Services on the remote computer, which would then make the same local computer administration options available. For more information, see Remote administration.

Configuring and managing the POP3 service

The following tables describe the administrative options you can use to configure and manage the POP3 service.

General service settings

For information on how to configure these settings, see Set up the POP3 service and Change service settings.

Service parameter | Description
Port | Specifies the port on which the POP3 service monitors for POP3 e-mail clients and responds to connection requests. Do not change the port from its default of 110 unless you have a specific need to do so. You must also inform all users if you are using a nonstandard port because most POP3 e-mail clients configure port 110 as the default for a POP3 connection.
Event logging level Specifies how much information is stored by the POP3 service in Event Viewer. Logging information is useful for auditing and troubleshooting. The logging levels are:
  • None - No logging.
  • Low - Only critical events are logged.
  • Medium - Critical and warning events are logged.
  • High - Critical, warning, and informational events are logged.
Authentication Specifies the authentication method used to verify users who connect to the mail server. The POP3 service supports three authentication methods:
  • Local Windows accounts authentication
  • Active Directory integrated authentication
  • Encrypted password file authentication
For more information, see POP3 service authentication methods.
Mailroot | Specifies the directory on the local hard disk where e-mail is stored. For more information, see Mail store.
Sockets Specifies the number of sockets.

A socket receives the network request from the e-mail client and then handles the transaction. Each time a POP3 e-mail client connects to the mail server, a socket is used. The POP3 service has four configurable settings that control the sockets: maxsockets, minsockets, backlogsockets, and thresholdsockets.

For example, on a system where maxsockets has been set to 20, up to 20 simultaneous connections can be made. If minsockets has been set to 10, when the POP3 service starts, 10 sockets are created immediately. The minsocket value determines how many connection requests the service can respond to on startup, and, based upon the number of sockets to create on startup, how much memory is initially allocated to the service.

New sockets are created based upon the value of thresholdsockets. If thresholdsockets is 5, when the number of available sockets on the server is less than 5, 5 new sockets are created. This increases the total sockets on the system to 15. When the 5 new sockets are filled, 5 additional sockets are created.

This process continues until maxsockets is reached. If maxsockets is 20, when 20 sockets are created and filled, the value of backlogsockets determines how many subsequent connections are accepted, but not responded to. If backlogsockets is 5, the server will accept a total of 25 connections: the 20 connections that fill the available sockets and 5 additional connections that are queued until a socket is available. Connection attempts subsequent to maxsockets + backlogsockets are denied.
Threads Specifies the number of threads.

A thread is a sequence of program code that is scheduled to run on the processor. A process can have several threads running simultaneously. The operating system coordinates this process by assigning each thread a scheduling priority. With the POP3 service, you can change the number of threads created per processor by configuring the thread count setting. The number of threads per processor multiplied by the number of processors equals the number of simultaneous requests the POP3 service can process.

The number of threads per processor can affect performance when traffic is high. Adding more threads can increase throughput, but adding too many threads will decrease server performance. The default settings are appropriate for most typical environments. For high-load environments, such as dedicated mail servers, the administrator should experiment with the number of threads for best results.
Quotas Specifies disk quotas that are implemented.

You can implement disk quotas to control the amount of hard disk space allocated for each user's mailbox. Disk quotas are important because they ensure that the server is protected from situations where the mail store might suddenly and rapidly increase in size. For more information, see Configuring disk quotas for the POP3 service.

Domain administration options

For information on how to set these options to manage a domain, see Manage domains.

Domain administration | Description
Lock/Unlock Locks or unlocks a domain. Unlocking the domain allows all users in the domain to retrieve their e-mail; locking the domain prevents them from doing so.

When a domain is locked, incoming e-mail for the domain is still received and delivered to the appropriate user directory in the mail store, and outgoing mail is still sent. All users attempting to download mail from the server are denied a connection, however.

While a domain is locked, you can still perform administrative tasks such as deleting a domain. If a user is connected to the mail server when the domain is locked, the mailbox remains unlocked until the user disconnects, after which the mailbox is locked.

Stat | Displays mailbox statistics, including number of messages in a mailbox, lock/unlock status, size of directory, and whether a user is currently connected
List | Lists all mailboxes in the domain.
New domain | Creates a new domain and adds it to the existing POP3 directory structure.
Delete a domain | Deletes an existing domain. If you delete an existing domain, you also delete all mailboxes and stored e-mail for that domain from the mail store.

Mailbox administration options

For information on how to set these options to manage mailboxes, see Manage mailboxes.

Mailbox administration | Description
New mailbox | Creates a new mailbox in an existing domain. To receive e-mail, every user in the domain must have a unique mailbox. Both Active Directory integrated authentication and local Windows accounts authentication support creating an associated user for each mailbox to link POP3 authentication with the existing domain or local computer.
Delete a mailbox | Deletes a mailbox and removes the mailbox from the domain. After a mailbox has been deleted, all e-mail sent to that mailbox is returned to the sender as nondeliverable receipt. When you delete a mailbox, you can specify that the corresponding user account also be deleted.
Lock or unlock a mailbox Locks or unlocks a mailbox.

When the mailbox is unlocked, the user can connect to the server and retrieve e-mail. When it is locked, the mailbox continues to receive incoming e-mail, which is delivered to the mail store, but the user is not allowed to connect to the server and retrieve e-mail. The administrator can still perform administrative tasks, however, such as deleting a mailbox or changing a mailbox's password.

If a user is connected to the mail server when the mailbox is locked, the mailbox remains unlocked until the user disconnects, after which the mailbox is locked.
Change a mailbox password | Resets the mailbox password. If a user loses or forgets his or her password, you must reset the mailbox password to something new; it is impossible to reveal an existing password.

Service state settings

The POP3 service is a Windows service with full support for Start, Stop, Pause, Resume, and Restart commands. For more information on how to change the POP3 service state, see To change the POP3 service state.

Service state | Description
Start | Starts the POP3 service from a stopped or paused state and allows POP3 clients to connect to the server and retrieve e-mail.
Stop | Stops the POP3 service. All current connections are terminated.
Pause | Pauses the POP3 service so that no new connections are accepted. Existing connections are not affected.
Resume | Starts the POP3 service from a paused state to allow POP3 clients to connect to the server and retrieve e-mail.
Restart | Restarts the POP3 service. All current connections are terminated.


POP3 service commands overview

You can use the POP3 service command application, Winpop.exe, to manage the POP service and modify parameter settings. With Winpop.exe, you can use all the POP3 service parameters available in the POP3 service Microsoft Management Console (MMC) snap-in, as well as additional administrative settings that are only configurable using Winpop.exe.

For more information, see:

  • Winpop


Configuring disk quotas

Configuring disk quotas for the POP3 service

Important

  • You can configure disk quotas only on NTFS file system partitions.

You can use disk quotas to control and limit the amount of disk space individual mailboxes on the mail server can use. This ensures that individual mailboxes, and the mail store in general, do not use excessive or unanticipated amounts of disk space and adversely affect the performance of the server where the POP3 service is running.

For example, if the mail server suddenly receives a large volume of unsolicited e-mail, the mail store expands rapidly and might use all of the available disk space on the hard disk. If you implement quotas, the mail store only expands to the quota limit that you specified. As a result, no more mail is accepted by the server, and the rest of the server still functions normally.

If you are using Active Directory integrated authentication or local Windows accounts authentication, the e-mail delivered to a POP3 service mailbox will have file ownership assigned to the mailbox user by default. A quota file is created in the mailbox directory that contains the security identifier (SID) of the user account associated with the mailbox. File ownership is then assigned to the user account that corresponds to the SID contained in the quota file. The SID is also used by the NTFS file system disk quota system to enforce the quota limits specified on the user account matching the SID. All e-mail transferred to the mailbox's mail store directory is marked with the SID contained in the quota file; this marks the e-mail so it can be monitored by the quota system.

For more information, see Disk quotas.

createquotafile command

If you are using encrypted password file authentication, there is no valid user account for the mailbox that the quota system can use. You can use the createquotafile /user command, however, to manually associate a given mailbox with a valid user account that is configured to have a disk quota. This association is for disk quota purposes only and is separate from mailbox authentication. If you are using Active Directory integrated authentication or local Windows accounts authentication, a quota file is created by default when you create a mailbox.

For more information about the createquotafile command, see To create a quota file.

Configuring domain disk quotas

Although quotas are designed to be implemented on a per-mailbox basis, you can create a domain-wide disk quota.

To create a disk quota for a domain, you must create a new mailbox and user account with an associated quota. The quota file for the new mailbox functions as a template that you can then copy into all of the other mailbox directories in the domain to create a domain-wide quota policy.

The following table describes the steps for creating a domain disk quota.

Step | Reference
Create a new mailbox and user account. When you create the new mailbox, you must also create an associated user account for the mailbox. This account will be used to create a domain-wide quota. Other accounts in the domain can be configured to reference this account and its associated quota. All accounts associated with this account will have their disk usage aggregated under a single quota limit, which will create a domain-wide quota limit. | To create a mailbox
Enable disk quotas for the partition on which the mail store is configured. | To enable disk quotas
Create a quota to be used as the domain quota and assign it to the domain quota account. | To add new quota entries
Do one of the following:
  • Copy the quota file from the mail store directory of the domain account to the corresponding mail store directory of all the mailboxes in the domain.
  • Or, using the winpop createquotafile command and the /user: switch, associate one or more accounts in the domain with the domain account and its quota. For more information on the createquotafile command, see To create a quota file.
 N/A

Notes

  • When a mailbox quota is exceeded, the user is not notified. E-mail intended for the user is not accepted, and a Non-Delivery Report (NDR), a notice that the e-mail was not delivered to the recipient, is returned to the sender.
  • Be sure that users configure their e-mail client to delete from the server any e-mail that has been successfully retrieved. If users leave successfully retrieved e-mail on the server, they can quickly exceed their quota. Users are likely to be unaware of the disk usage and impact of old e-mail stored on the server.
  • You cannot set quota limits on the accounts of Administrators or members of the Administrators group.


Remote administration

There are three approaches you can use to administer the POP3 service remotely: remote Web administration, Terminal Services, and Microsoft Management Console.

  • Remote Web administration

    • You can use the Web to connect remotely to a server running the POP3 service. The POP3 service is integrated into the Web Interface for Remote Administration. You can use a Web browser to exert full administrative control of a computer over the Internet. For more information, see Using Web Interface for Remote Administration.

    Note

    • XOX
  • Remote administration using Terminal Services

    • You can use a Terminal Services client to connect remotely to a server that is running the POP3 service. With Terminal Services, you have full administrative control over the computer and the POP3 service. For more information, see Remote Administration using Terminal Services.

  • Remote administration using Microsoft Management Console (MMC)

    • Using the POP3 service MMC snap-in, you can connect to another computer that is running the POP3 service. For security reasons, to manage the POP3 service on a remote computer, you must be a member of the Administrators group on the remote computer, or you must have been delegated the appropriate authority. For more information about connecting to a remote server, see To connect to a remote server running the POP3 service.

Note

  • To perform this procedure on a remote computer, you must be a member of the Administrators group on the remote computer, or you must have been delegated the appropriate authority.


Troubleshooting

What problem are you having?

Users are unable to connect to the POP3 server to retrieve or send e-mail

Cause: The user's e-mail client has not been configured correctly, or the user has incorrect logon credentials.

Solution: Review the procedures to configure e-mail clients.

  • If you are not using Secure Password Authentication, see To configure Outlook Express for e-mail services.
  • If you are using Secure Password Authentication, see To configure Outlook Express for Secure Password Authentication.

I am using local Windows accounts authentication. The POP3 service will not start after I install Active Directory on the member server.

Cause: When Active Directory is installed on a computer, the local Security Accounts Manager (SAM) is disabled. Local Windows accounts authentication depends upon SAM, however. Without SAM, the POP3 service will not start if it is configured to use local Windows accounts authentication.

Solution: After you install Active Directory on the server, configure the POP3 service to use Active Directory integrated authentication as described in the following table:

Step | Reference
Delete all existing e-mail domains in the POP3 service. | For more information on deleting e-mail domains, see To delete a domain.
Change the authentication method to Active Directory integrated. | For more information on changing the authentication method, see To set the authentication method.
Recreate the domains and associated mailboxes.
  • For more information on creating e-mail domains, see To create a domain.
  • For more information on creating mailboxes, see To create a mailbox.

See also: Active Directory integrated authentication.

Users are unable to access their mailboxes after the mail store directory is restored from a backup or moved to a new location, or event ID 1022 appears in the event log.

Cause: The discretionary access control list (DACL) that is set on the mail store directory and all subdirectories has been lost.

Solution: Reset the DACL on the mail store directory. The DACL will then be propagated to all subdirectories.

  1. Open Command Prompt.
  2. Type:

    winpop set mailroot path_to_mail_store

    3. Note

    • The set mailroot command might take a while to complete if the mail store is large.

See also: Mail store.

I am using local Windows accounts authentication and a remote mail store. A security identifier (SID) appears instead of an account name as the owner of the files in the remote mail store.

Cause: The SID displayed corresponds to a user account on the computer on which the POP3 service is running. Because that account does not exist on the remote computer, there is no user account to be referenced, and the SID appears instead.

Solution: This is a known issue.

Deleting a user account from the Active Directory Users and Computers snap-in does not delete the user’s corresponding POP3 mailbox.

Cause: The Active Directory Users and Computers snap-in is designed to function this way.

Solution: To delete both the user account and the POP3 mailbox, use the POP3 service snap-in. For more information, see To delete a mailbox.

Or, if you delete the user account from the Active Directory Users and Computers snap-in, you can delete the POP3 mailbox manually.

To delete a mailbox manually, go to the directory that is configured to be the mail store. Delete the directory that corresponds to the POP3 mailbox.

For more information on how to determine the directory that corresponds to the POP3 mailbox, see Mail store.

When using Secure Password Authentication and Active Directory integrated authentication, users are unable to connect.

Cause: The user's logon credentials are incorrect.

Solution: Verify that the user is using the correct logon name and password. If a naming conflict occurred when the user's mailbox was created, the user must use the pre-Windows 2000 logon name as his or her user name when connecting to the server running the POP3 service. For more information about naming conflicts, see Active Directory integrated authentication.

  • To verify the user's logon name, go to the Active Directory Users and Computers snap-in located in the Administrative Tools menu. Go to the Users folder, right-click the user account and then click Properties. Click the Account tab. The user name that must be used will appear in User logon name (pre-Windows 2000).
  • If the user's password is incorrect, and the user does not remember the correct password, reset the password and provide the user with a new password. For more information, see To change a password.

I am unable to perform administrative tasks when using Active Directory integrated authentication, or the following error message appears:
"The specified domain either does not exist or could not be contacted."

Cause: You are not logged on to the Active Directory domain. If you are using Active Directory integrated authentication, you must log on to the Active Directory domain, not the local computer, to administer the POP3 service.

Solution: Log on to the Active Directory domain using your administrator credentials.


Simple Mail Transfer Protocol (SMTP) service

The Simple Mail Transfer Protocol (SMTP) service, which transfers e-mail, is installed as part of E-mail Services, along with the POP3 service.

SMTP controls how e-mail is transported and then delivered across the Internet to the destination server. The SMTP service sends and receives e-mail between servers, whereas the POP3 service retrieves e-mail from the mail server to the user's computer. For more information, see the SMTP documentation Microsoft SMTP Service.

For more information about configuring the SMTP service for use with the POP3 service, see Simple Mail Transfer Protocol (SMTP) and Configure the Simple Mail Transfer Protocol service.

Managing the SMTP service

You can manage the SMTP service from the Internet Information Services (IIS) Microsoft Management Console (MMC) snap-in. To open the IIS snap-in, click Start, and then click Run. In Open, type inetmgr, and then click OK. If the IIS snap-in does not appear, verify that you have installed IIS.

For more information about IIS, see Internet Information Services (IIS) 6.0.