How to get WSUS to send emails without authenticating on our mail server

I've seen this happen a few times before and here are the causes I have seen. Keep in mind these have only been seen in a large environment. If you are in a single dc, single exchange server environment these will not apply.

First off here is the MS article on this: http://support.microsoft.com/kb/895853. Under the possible cuases you can see there are a lot of things at play.

One of your exchange servers relay permissions are not setup correctly.

This is most likley the cause. The mail may be taking a different route on the first and second try, while this might sound silly run message tracking on both messages, see if they go through the same server. If you see different paths check the settings on the bad one, could be a simple allow relay for authenticated users isnt checked.

AD permissions are wrong

You must have Send As permissions on the account that has the from address from your email. If it is working sometimes, but not others then it may be different pathings on mail routing, with different permissions between them.

Authentication isn't working correctly.

In the first instance of the script it may be that authentication fails, and in this instance the mail is denied as you do not have permission. In the second run of the script authentication is successfull. Unfortunately I do not know ASP well enough to understand the code above or advise on how to fix it. smtpClient.UseDefaultCredentials may not be the correct code for your environment. This will only authenticate if requested by the server and will use the credentials of the locally logged on user. If the server isn't asking for authentication the first time around then you wont be authed and may not have permission to send. Try changing it to some code that always authenticates.

One of your DCs or global catalogs is out of date or has bad information.

This is rare but it is possible that your domain controllers have out of sync information. Double check the server information on the from and to accounts via ldap or adsi edit and ensure they are identical across all dcs.

In all instances check the logs on the exchange server and ensure SMTP logging is enabled with all fields. Use message tracking to see exactly which servers this message is hitting.

The solution is quite simple, having a password for ExchangeServiceAccount as SecureString $ExchangeServicePassword variable:

# Mail server
$SmtpServer = "mail.company.com"
# .NET object MailMessage
$Msg = New-Object Net.Mail.MailMessage
# .NET object SMTP server and SMTP authentication parameters
$Smtp = New-Object Net.Mail.SmtpClient($SmtpServer, 587)
$Smtp.Credentials = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "ExchangeServiceAccount", $ExchangeServicePassword
$Smtp.EnableSsl = $true
# Email structure
$Msg.From = "exchangeserviceaccount@company.com"
$Msg.ReplyTo = "alerts@company.com"
$Msg.To.Add("alerts@company.com")
$Msg.Subject = "Subject"
$Msg.Body = "Some text"
$Msg.SubjectEncoding = [System.Text.Encoding]::UTF8
$Msg.BodyEncoding = [System.Text.Encoding]::UTF8
# Send email
$Smtp.Send($Msg)