Hello, We have an exchange 2007 env with 2 hub servers. We have users using outlook 2003 and have auto-forward rules to send any message to outside domain. Is there any header stamp that we can look for using the hub transport rule to see which users forward emails? I could not see any X-Forwarded-to or X-Forwarded-for in the header of the messages leaving the system. I even tried duplicating this by setting up a forward rule to forward any messages coming to my internal exchange account to my external account but still cannot see them.

Is this for auditing purposes? I've used the following script in the past to do an audit of forwarding rules on Exchange 2007. Reporting on forwarding rules in Mailboxes and Public Folders via a script http://gsexdev.blogspot.com/2005/10/reporting-on-forwarding-rules-in.htmlJames Chong MCITP | EA | EMA; MCSE | M+, S+ Security+, Project+, ITIL msexchangetips.blogspot.com

Yes for auditing but we don't want to run anything on the mailboxes themselves. We need this to be seamless and we need somehow to be able to detect this at the transport level.

I'm not sure if any way out the box way to detect in the transport pipleline. I doubt there is any flag to indicate that it was forwarded. It's a new message as far as Exchange is concerned when it gets the forwarded message. It just updates the envelope from and envelope to of the forwarded message. Probably have to write a custom transport agent that will detect when the return-path doesn't match the envelope from.James Chong MCITP | EA | EMA; MCSE | M+, S+ Security+, Project+, ITIL msexchangetips.blogspot.com

That's was my thinking too. Thanks

Hi xmis, I have gave you a suggestion in your other thread, http://social.technet.microsoft.com/Forums/en-US/exchangesvrtransport/thread/004fde96-75fe-4480-b46b-c846bb8e8ddd it is impossible to achieve your target throught transport level, because that the deliver course just like that the internal user send a email to external if the outlook end set a rule for farwording. We could follow the scripts to check which user set a forward rule. Regards! Gavin Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Thank you.