As we already know there is no default method to find out the original sender when Send-As access used to send email. Sometimes for some legal requirement or to find out the culprit we should be able to have this information. To enable this feature we need to use the default Exchange Diagnostic Logging.
Let’s see how to enable the Diagnostic Logging for Send-As:
Set—EVentLogLeVel —Identity “MSExchangeIS\9 Private\Send As” —Level 1
Open EMC –> Server Configuration –> Click on your Mailbox Server
Right Click on your Mailbox Server à Select Manage Diagnostic Logging Properties
Expand MsExchangeIS à 9000 Private
Send As àLow à Configure à Finish
9000 Private – For mailboxes
9001 Public – For Public Folders
We have successfully enabled the logging for Send As access, from now we will be able to figure out the original sender.
Let’s try to send an email on behalf of other and find out the result, already my administrator account has Send As access over the “Shared-Mbx” mailbox.
Once you sent the email, go to Event Viewer and look for the Event ID 1032 which will give you the original sender details.
Here is the Event which says Administrator has sent an email on behalf of “Shared-Mbx” mailbox.