How to identify the sender of an email from a shared account
Hi, I am working on a implementation of a monitoring solution which may block certain emails (e.g. theft of IP) from leaving the company. One of the requirements is to know who sent an email from a shared account. Does an email from a shared account identify who sent it? Or are there options we can switch on that will tell us. I read about Message Tracking but not sure this will do the trick. Thanks for any pointers.
March 1st, 2011 5:52am

Hi, I assume that you are using exchange 2010/2007. You can achive this by using event log level in server with parameter Extended Send As which lets you log events that correspond to sending a message as a mailbox-enabled user. Understanding Mailbox Access Auditing with Exchange Server 2007: http://technet.microsoft.com/en-us/library/ee221156(EXCHG.80).aspx Anil
Free Windows Admin Tool Kit Click here and download it now
March 1st, 2011 12:06pm

Hi Can this application might help you? http://www.quest.com/changeauditor-for-exchange/ Jonas Andersson | Microsoft Community Contributor Award 2011 | MCITP: EMA 2007/2010 | Blog: http://www.testlabs.se/blog | Follow me on twitter: jonand82
March 2nd, 2011 7:16am

Hi, Anil is right. The following cmd can accomplish this: set-eventloglevel "msexchangeis\9000 private\send as" -level expert This cmd has to be run on the Mailbox Server, and in case there's a cluster, it should be run on every node. The following article is related to this issue and provided us the solution to the case: http://support.microsoft.com/kb/956573 TechNet
Free Windows Admin Tool Kit Click here and download it now
March 2nd, 2011 8:14pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics