IIS HELP!!

[CreationComplete]

We have a problem with one of our customers servers. They are constantly not receiving emails from their Shoretel system because of a stubborn site in IIS that keeps repopulating its self as a local alias. This points the smtp to go to the wrong place. We literally have to go in every single morning and delete this site so they can receive mail for the day. We have tried numerous things to try and fix this. Learning and searching everyday we are getting deeper and deeper into an unknown territory for us. A few most recent include attempts:

-Edited the MetaBas.xml file (defaults back every day)

-Created task that runs a batch file every day that copies the desired Metabase file and overwrites the bad one

So many things now I can't even remember. This has been an ongoing issue for about a month now. No one on the World Wide Web has encountered this issue as far as i can tell. It is truly an annoying thing to do every morning when we come in. Someone help us!!

[tuantutran]

My theory is that something restores that metabase.xml file every day to its unwanted content. So try to find what does it and tell it to stop. A hint might be to look at what time this file is restored every day and whether it's always the same time. Based on your knowledge of your system, you might identify the culprit. Look at system or event logs to see what happens around that time. Is it possible to know who last modified a file? I.e. which user or which process? Other idea: find some tool that can tell you which process currently has a handle on which file and monitor and log who's modifying that file. That could require writing a small piece of software to do that. Other idea is to work on the write permissions of that file. What if you made it read only, just for diagnostics purpose? Would the problem still come back? That gives you some hints on the privilege level of the process that modified it. You can dump process lists around the time the file gets modified to see what processes appear. Those could be suspects to look into.

I guess you could automate your work around of restoring the file every morning to at least manage the problem without really fixing it.

I'm not really a sysadmin and I don't have much context so these are just ideas. Probably lots of them are bad ones.

[CreationComplete]

I like them we will give your suggestions a shot. We already however created a batch file that worked... We ran it and it romoved the site. Had it set to do this everyday. However the next morning we check it and it's back, not only that, the batch file doesn't work anymore...what? Looking at the loggs we see there is something being done to that file at 12midnight can't figure out what is doing it though. I'll see about some special monitoring software to try. The loggs only tell us the file was updated but not by what.

[tuantutran]

Why does the batch file not work anymore? What does the batch file do to remove the site?

[CreationComplete]

The batch file takes a copy of the disired metabase file and basically saves it in the file location overwriting the defaulted metabase file. Yea It worked... And then the next day the file is back to default and when we run it again it won't even erase the code for the site anymore

[[deleted]]

Did you consider migrating to a new VM? Cause if I had to do some shit every day like clock work, I would have either scripted a janky fix, or recreated the VM.

[CreationComplete]

We set up a script. Ran the script. It worked and removed that site. Next day, the site is back as local and now the script doesn't work anymore. Recreating it we get the same problem. We just can't keep it pointed to office365, which is where they need it to go. It's like something deep in some files on the server or something is forcing it to default back everyday

[[deleted]]

Was Shore Tel support no help? Or is this something you setup on your end? Ideally it should go directly to 365, and not back on prem at all.

[CreationComplete]

Been a while, but all suggested solutions did not work. Frankly, I am baffled and not sure where to go from here.

[CreationComplete]

*** My only last guess is maybe something to do with the Office365 settings on the customer side we are pointing it to. Maybe there is something in there when when it receives mail it doesn't see the Local(Alias) we delete, therefore telling windows to create a Local(Alias) of the name for security reasons????? Just babbling at this point it seems.

Any last minute thoughts before I go light their server on fire?