Is there a way to be able to tell who sent a message as another user. For example: A message comes from the "Security mailbox", we need to know who sent that message.

Hi, I would like to explain that you can grant user Send On Behalf of Permission to the "Security mailbox" instead of Send As permission. Then, you should be able to see who actually send the message. If you grant Send As permission to users, I would like to explain that it is hard to check who actually send the message. Mike

I am aware of the send on behalf of. When you say hard what is the process?

Hi, Would you please let me know: 1. Exchange Server Version 2. Outlook Version which used to submitted the message and how the Outlook connects to Exchange Server (Exchange Mode/SMTP). 3. Whether the user send as the security mailbox to another internal recipient or external recipient. If the message is sent to internal recipient, whether the recipient and senders mailboxes on the same server? I would like to explain that for Exchange 2003, if you submit the message through MAPI, you should be able to get the real sender of the message by checking the PR_CREATOR_NAME property of the message by using MFCMapi to logon the recipients mailbox. Mike

1. Exchange 2007 SP1 Rollup 5 2. Outlook 2007 sp1 3. All of the above.

try set event log levelset-EventLogLevel "mailbox server name"\MSExchangeIS\9000 Private\Send As -level highand look application login mailbox server event source: MSExchangeIS Mailbox Storeevent id:1032

I think this is the right method, i will evaluate, thanks,