Exchange 2016: E-Mail PickUp directory

The e-mail pickup directory is no longer used very often, but today was another case with a somewhat more specialized software...

The e-mail pickup directory is a normal folder in the file system that is monitored by Exchange for new e-mails; if an e-mail lands in this folder, Exchange will attempt to deliver the mail. Programs can therefore drop files that are formatted accordingly into the directory and Exchange will take care of the delivery.

By default, the pickup directory is located under the following path:

%ExchangeInstallPath%TransportRoles\PickUp

If files with the extension .EML are copied in this directory, Exchange starts processing. Here is an example of an EML file:

Shortly after the e-mail has been copied to the pickup directory, the extension is changed to .TMP, so Exchange starts processing and delivers the e-mail:

The message tracking log then looks like this, with "Pickup" specified as the source:

The pickup directory is initially only a directory on the Exchange server, so if you want to use it from other computers/servers, you have to share the directory so that other clients can store their files there.

However, it must be remembered that Exchange processes all valid files in the pickup directory, there is no recipient or sender check at this point, so in principle this is an internal OpenRelay. In this example, a mail is sent from a non-existent sender to an address outside the organization via Pickup:

So if you want to use the pickup directory via sharing, you should adapt it a little:

• Create your own directory
• Restrict access to the directory
• Configure monitoring

A separate directory, preferably on a separate small partition or mount point, can be configured with the following command:

Get-TransportService | Set-TransportService -PickupDirectoryPath "D:\Pickup"

The directory is created automatically and can now be released:

The NTFS permissions for the pickup directory can be controlled using an Active Directory group so that only users who are members of the group can use the pickup directory:

In addition, the directory should be monitored for files with the extension .BAD. Files with the extension .BAD are mails that could not be processed due to incorrect formatting. Here is an example:

If emails cannot be processed, the following event is also logged in the event display:

Source: MSExchangeTransport

Event ID: 9010,

At least one file in D:\Pickup can't be processed. These files have .bad extensions. Please look for .bad files, and make sure that their content is valid.

This is where a monitoring solution can be used. In addition, the Exchange Message Tracking Log can also be searched for the "Pickup" event to detect irregularities or excessive use.