Dears, We have here and email account which is anonymous@domain.local. This account is configured so anyone can "Send as" this account. The receivers will see that "Anonymous@domain.local" sent the email. But how could i know as an administrator who is the original sender of the mail "Sending as anonymous".. Thanks in advance,

Check the Exchange erver for Event 1032 Source MSExchangeIS Mailbox Store Event Type Information

You can also generate and parse log of SMTP Virtual server if you are using Exchange 2003. For Exchange 2007 :: To enable protocol logging from the Exchange console, go to Server Configuration | Hub Transport | select the Hub Transport server you want to configure | select the Receive Connector -> properties | General tab | change Protcol logging level to Verbose. http://exchangepedia.com/blog/2007/05/exchange-server-2007-logging-smtp.html You can match subject with send as and client detail to get your requirement, Its something require to automate. Also you can check Event 1032 as suggested above.Anil

Hi, In exchange 2007 SP2 or higher version, you are able to track the "Send as" events by enabling Mailbox Access Auditing: 1. Open EMC->Server Configuration->Mailbox. 2. Right click your mailbox server and choose Manage Diagnostic logging Properties. 3. Expand the MSExchangeIS category and then expand the 9000 Private category. 4. Select the following category in the configuration screen and then choose the diagnostics logging level to "High": Extended Send As, General, Send As and Send On Behalf Of 5. Click Configure to apply the change. 6. Open services.msc and restart MS Exchange Information Store service. The information is logged into the 'Exchange Auditing' event log category. If the 'Exchange Auditing' event log is still empty after enabling Mailbox Access Auditing, looking for the events in ‘Application’ category . This is a sample of a exchange auditing log: Scenario : Thomas sent a message as Anonymous. =========================== Event Type: Information Event Source: MSExchangeIS Mailbox Store Event Category: Send As Event ID: 1032 Date: 5/19/2010 Time: 1:44:25 PM User: N/A Computer: 194125M2 Description: /o=First Organization/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=Thomas sent a message as /o=First Organization/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=Anonymous. =========================== More information, referring the following article: Exchange 2007 Mailbox Access Auditing Http://www.msexchange.org/articles_tutorials/exchange-server-2007/compliance-policies-archiving/exchange-2007-mailbox-access-auditing-part1.html

Yes, Also you need to ensure that you have given enough size when enable logging level "High", Because ity will eat audit log size very fast.Anil

Thanks you very much guys, this is very helpfull. I used the answer of Gen Lin. Regards,