Hello Team ,

Is it possible to create Exchange 2010  email notification/alert  to the admin
if a user starts sending unusually high amount of emails externally.

Thank you

Hi ,

Based on my knowledge by default in exchange we don't have an option to configure an alert for monitoring such kind of activities.

But we can make use of message tracking scripts which would help us to extract the amount of emails send by the particular user per day .However we can get the output via emails on daily basis by scheduling those scripts in task.

https://gallery.technet.microsoft.com/office/Exchange-200720102013-0ea7662b

In case if you would like to limit number of emails send by the user to external world then we can achieve that with the help of throttling policies.

http://www.slipstick.com/exchange/limit-number-of-internet-messages-user-can-send/

Please reply me if you have any queries.

Thank you

Basically we had a situation where one of the malware  affected client computers was sending large number of emails to the external recipients.

We are looking for option to get notified once this behaviour occurs. So we can prevent it and dont get blacklisted  .

What would be your recommendation ?

Exchange server 2010

Thanks in advance

in the same time we need to be able to send bulk emails (800) from time to time

Thank you

Hi ,

Thanks for your reply.

Based on my knowledge ,To avoid such kind of incidents we have to use proper Anti spamming solution on client machines ,exchange servers as well on the gateway products and also it should have to be up to date.

In addition to that Anti Malware protection is an additional feature in exchange 2013 but in our case you have exchange 2010.

I agree with Nithya suggestion.

You may use any good Anti-spam solution to prevent such issues occurs randomly.

Meanwhile, to get email-flow reports into real time, you may also give shot to this available automated solution http://www.exchangereports.net/ that seems to be a good alternative approach in your circumstance. Please check if it helps you to sort-out your problem. It helps to get the reports on the mailbox traffic of the entire network with detail information such as, all emails sent and received within a particular duration, emails sent outside and inside organization, interaction between users in a particular duration.

Hi,

We can use the Set-Mailbox command together with the ThrottlingPolicy parameter to configure a throttling policy for a mailbox.

A default throttling policy exists to provide a default set budget configuration for users who connect to Exchange. To configure customized budget settings for one or more users, create a new throttling policy. Then, apply the policy to the appropriate user or group. For example: The MessageRateLimit parameter specifies the number of messages per minute that can be submitted to transport on each Hub Transport server. We can set the MessageRateLimit for the default Throttling Policy:

$a = Get-ThrottlingPolicy | where-object {$_.IsDefault -eq $true}

$a | Set-ThrottlingPolicy -MessageRateLimit 600

Set-Mailbox -Identity UserA -ThrottlingPolicy $a

Regards,