How to identify the sender of an email from a shared account
Hi,
I am working on a implementation of a monitoring solution which may block certain emails (e.g. theft of IP) from leaving the company. One of the requirements is to know who sent an email from a shared account.
Does an email from a shared account identify who sent it? Or are there options we can switch on that will tell us. I read about Message Tracking but not sure this will do the trick.
Thanks for any pointers.
March 1st, 2011 5:52am
Hi,
I assume that you are using exchange 2010/2007. You can achive this by using event log level in server with parameter
Extended Send As which lets you log events that correspond to sending a message as a mailbox-enabled user.
Understanding Mailbox Access Auditing with Exchange Server 2007:
http://technet.microsoft.com/en-us/library/ee221156(EXCHG.80).aspx
Anil
Free Windows Admin Tool Kit Click here and download it now
March 1st, 2011 12:06pm
Hi
Can this application might help you?
http://www.quest.com/changeauditor-for-exchange/
Jonas Andersson | Microsoft Community Contributor Award 2011 | MCITP: EMA 2007/2010 | Blog:
http://www.testlabs.se/blog | Follow me on twitter:
jonand82
March 2nd, 2011 7:16am
Hi,
Anil is right.
The following cmd can accomplish this:
set-eventloglevel "msexchangeis\9000 private\send as" -level expert
This cmd has to be run on the Mailbox Server, and in case there's a cluster, it should be run on every node.
The following article is related to this issue and provided us the solution to the case:
http://support.microsoft.com/kb/956573
TechNet
Free Windows Admin Tool Kit Click here and download it now
March 2nd, 2011 8:14pm