MS Engineer working on this problem.
I have checked the TMG trace that you sent us and I do see the sequence related to the event 31506:
[1]17F8.10A4::02/18/2010-11:48:00.650 [SMTPPROTECTION]Override unexpected configuration, signalling an event: E-Mail Policy - Configuration Reapplied
The Email policy configuration seems to be reapplied because the below Exchange Cmdlet is executed a few seconds before (this Cmdlet removes the receive connector named External_Mail_Servers).
[1]17F8.10A4::02/18/2010-11:47:54.817 [SMTPPROTECTION]( 00000000005ECF52 )Invoke Command:Remove-ReceiveConnector -Identity External_Mail_Servers -Confirm $false
Im trying to understand why this Cmdlet is called and if it is the cause of every 31506 event occurrences.
MCSE:S, MCSE:M, MCITP, MCTS, CCNA, CCDA Infrastructure expert