We have recently deployed exchange 2013 in our environment with WAP, previously we were using Exchange 2010 with ISA. Users still want to use POP3, IMAP4 to retrieve mail, and SMTP to send. We have configured our firewall and a netscaler for this, however external users cannot use SMTP on 587 or 25, and exchange logs show event 1018- message is:
The account 'mydomain\user' provided valid credentials, but it does not have submit permissions on SMTP Receive connector 'Default Frontend exchangeserver1'; failing authentication.
I've researched this error and the solution states:
Explanation
This Warning event indicates that the security principal that is trying to use the specified Receive connector does not have the Ms-Exch-SMTP-Submit permission assigned to it on the Receive connector. Security principals are user accounts, computer accounts, or security groups.
The Ms-Exch-SMTP-Submit permission allows the Receive connector to accept the SMTP MAIL FROM: command from the connecting messaging server.
Receive connectors grant permissions to security principals or to permission groups. Permission group members and their assigned permissions cannot be modified. All permission groups grant the Ms-Exch-SMTP-Submit permission on the Receive connector.
![]()
User Action
To resolve this problem, do one of the following:
- Use the Set-ReceiveConnector cmdlet in the Exchange Management Shell to assign the appropriate permission group to the Receive connector. For more information, seeSet-ReceiveConnector.
- Use the Add-ADPermission cmdlet in the Exchange Management Shell to grant the Ms-Exch-SMTP-Submit permission to an appropriate security principal, and then assign that security principal to the Receive connector. For more information, seeAdd-ADPermission.
HOWEVER,
there is only one example of this command in powershell/technet, so I am not sure what the command for my particular case should look like- and I would like to know a little more about what is actually happening- basically, I am giving this user permissions to send through the receive connector, instead of just the exchange servers, is that the gist of it?