We have discovered that all our Domain Admins can utilise the "send as" feature and send on behalf of any other user, by default. How do we go about resolving this, so that this is not the case anymore?

Hi, I feel by default Domain Admin group has Deny - Send As permission on all mailboxes so just check the permission on mailbox/server if deny is not selected. ESM -> Administrative Groups -> <Admin Group> -> Servers -> <Server Name> -> Right Click & Properties -> Security and verify the Domain Admin has Deny Send As permission if not then you can give explicitly.

I tried this already and Domain Admins is denied send as access, but this still doesnt stop us sending on behalf of others!

Clarify: Domain Admin has Send As right to all mailboxes Collect unmentioned info: Version: windows server, exchange [03/07]? Notes: domain admin has send as right by default in ex07, but based on your description, it seems to be ex2k3, right? Troubleshooting: 1. Add a registry in HKEY_CURRENT_USER\Software\Microsoft\Exchange\EXAdmin Type: REG_DWORD Name: ShowSecurityPage Data: 1 2. Check the permission in ESM a. Right-click your org icon on the top level of ESM b. Go to Security tab c. Check permission on Domain Admin is ok. d. Also check your Server and Mailbox objects, make sure the Allow the inheritable permissions to propagate.. has been checked 3. Run Domainprep to make sure that everything is ok at the permission PS: Wait until all the permissions propagate to child objects

Hi, Funder, Does you give it a try? How's the result?

Hi James, Sorry for the delay! I am running ex2k3, and did everything suggested except running Domainprep, but the issue still remains.

Have you checked in the exchange delegation wizard to make sure they don't have permission in there? Checked security on your server, your mailbox store, and your protocol server? I think the question is, how are the domain admins able to send as? Are you say creating an Outlook profile and adding someone else's mailbox to it?

Hi Dustin, It appears that Domain Admins are listed in the exchange admin delegation wizard as having Exchange full administrator rights (inherited). Should I take them out then? What I mean when I say that domain admins can send on behalf of others is as follows: when we (domain admin) open up Outlook to send an email we can send on behalf of another user by using the users name in the "from" field, which should not be allowed.

Hi Dustin, Thanks for your help. This is the reason. Well done! Fudner.

Hi All! what do you do, Fudner? I don't understand. I have same problem with exchange 2003 sp2...

It appears that Domain Admins are listed in the exchange admin delegation wizard as having Exchange full administrator rights (inherited).I believe that by taking out Domain Admins from this list will ensure that the issue is resolved.