Audit Outlook forwarding rules
I need to find all of the mailboxes that have e-mail forwarding rules configured. Does anybody know how to pull this from the mailboxes? I need the rules that have been configured by the end users, not the EMC configured accounts. We are running Exchange 2007 SP2 and a mix of Outlook 2003/2007 clients.
September 19th, 2011 4:25pm

You can only enable or disable the automatic forwarding by exchange 2007. Reporting all outlook client that have custom rules configured is impossible. Best regardsBest Regards Don't forget to mark it as answer if it helps
Free Windows Admin Tool Kit Click here and download it now
September 19th, 2011 4:43pm

Forwarding rules do not require Outlook to be open to run which leads me to believe they are server-side rules. I find it hard to believe that there is no way to gather server-side rules off of the mailboxes (perhaps difficult, but not impossible?). If there really isn't any way to do this, MS should consider adding it to later versions (if they haven't already). I have 11000 mailboxes, so potentially 11000 users who could be forwarding. If I just turn it off without knowing who I am effecting, I may have a lynch mob on my hands... LOL.
September 19th, 2011 4:54pm

There might be away using EWS but I am not aware of it... The only way I can think of, is sending an e-mail to everyone in the middle of the night and then delete it from everyone's mailbox with something like: [DateTime] $date1Hour = [DateTime]::Now.AddHours(-1) ForEach ($mbx in (Get-Mailbox -ResultSize Unlimited)) { $strDeleted = Export-Mailbox $mbx -SenderKeywords you@company.com -SubjectKeywords "Test E-mail" -EndDate $date1Hour -ExcludeFolders "\Deleted Items" -DeleteContent -Confirm:$False $intTotalDel = $strDeleted.StandardMessagesDeleted Write-Host "Searched $mbx and deleted $intTotalDel" } After that, all you have to do is check the Transport Logs and see for which users your e-mail got forwarded! Of course, they will actually receive your e-mail but at least you will know for sure who has a forwarding rule in place. Hope this helps!http://LetsExchange.blogspot.com
Free Windows Admin Tool Kit Click here and download it now
September 19th, 2011 5:46pm

Use the script below, it worked well for me for ex 2003. Still works for 2007. Reporting on forwarding rules in mailboxes and public folders via a script http://gsexdev.blogspot.com/2005/10/reporting-on-forwarding-rules-in.htmlJames Chong MCITP | EA | EMA; MCSE | M+, S+ Security+, Project+, ITIL msexchangetips.blogspot.com
September 19th, 2011 6:32pm

Sometimes the answer is staring you right in the face but you don't see it.... Your suggestion would have been a great way to get that information. Though, even better, it reminded me that our Spam filter tracks all outbound messages. I just filtered on the subject of an e-mail that went out to everyone and there was my list. Thanks a bunch!
Free Windows Admin Tool Kit Click here and download it now
September 20th, 2011 10:03am

I could not get this script to work for me but I found a much easier way by filtering the audit logs on our Spam filter for outbound mail with the subject of our last e-mail sent to everyone. Thanks anyway!
September 20th, 2011 10:05am

Glad I could help! I was going to suggest that. However, the problem with using a normal e-mail sent to everyone during the day is that some users might manually forward it to an external account. When you check your logs, it will look like they have a forwarding rule in place when they don't... But if you narrow your log search to immediately after the e-mail is sent or if you have such an e-mail sent outside business hours, then I guess it is ok. In any case, you will end up with a pretty good estimate, which is what you want I guess.http://LetsExchange.blogspot.com
Free Windows Admin Tool Kit Click here and download it now
September 20th, 2011 10:13am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics