As we already know there is no default method to find out the original sender when Send-As access used to send email. Sometimes for some legal requirement or to find out the culprit we should be able to have this information. To enable this feature we need to use the default Exchange Diagnostic Logging.

To get to know more about Diagnostic Logging visit here and here

Let’s see how to enable the Diagnostic Logging for Send-As:

Using EMS:
Set—EVentLogLeVel —Identity “MSExchangeIS\9 Private\Send As” —Level 1

Using EMC:
Open EMC –> Server Configuration –> Click on your Mailbox Server

Right Click on your Mailbox Server à Select Manage Diagnostic Logging Properties

Expand MsExchangeIS à 9000 Private

Send As àLow à Configure à Finish

9000 Private – For mailboxes

9001 Public – For Public Folders

We have successfully enabled the logging for Send As access, from now we will be able to figure out the original sender.

Let’s try to send an email on behalf of other and find out the result, already my administrator account has Send As access over the “Shared-Mbx” mailbox.

Once you sent the email, go to Event Viewer and look for the Event ID 1032 which will give you the original sender details.

Here is the Event which says Administrator has sent an email on behalf of “Shared-Mbx” mailbox.