1

We have a shared mailbox in our company, now someone has forwarded a mail from the shared mailbox, but no one wants it to have been, how can i track it ? the originalclientip in exchange message tracking is empty

Remo
  • 11
  • 1
  • Please clarify your specific problem or provide additional details to highlight exactly what you need. As it's currently written, it's hard to tell exactly what you're asking. – Community Sep 12 '22 at 09:18
  • How's everything going now? – Aaron Sep 19 '22 at 07:51

1 Answers1

0

You can use the Exchange auditing features. But you need to make sure the sharedmailbox’s auditlog has been enabled.

Set-Mailbox -Identity shared1 -AuditEnabled $true

Then run the follow command to track who logs on and forwards email from the shared mailbox.

Search-MailboxAuditLog –Identity shared –LogonTypes Delegate –ShowDetails

If you didn’t enable the auditlog for the shared mailbox before, you would not be able to trace who sends email from the shared mailbox.

enter image description here

Aaron
  • 151
  • 4
  • Any update on this thread? If the issue has been solved, please do not forget to mark the helpful reply as an answer. Thanks! : ) – Aaron Sep 16 '22 at 09:29