send as permission

Question

Hello,

one mailbox.Exchange 2016.
6 users have send as permissions for this mailbox.
One of this 6 users sent mail as this mailbox e-mail address.
How can I find who has sent mail?
Auditing is not enabled
https://practical365.com/exchange-server/using-exchange-server-mailbox-audit-logs-find-sender-email-shared-mailbox/

Answer 1

Hi @fsdg ,

Based on my test, we can run the get-messagetrackinglog cmdlet and checking the Sender field.

Get-TransportService|Get-MessageTrackingLog -MessageSubject <subject> -Start <starttime> -End <Endtime> |select timestamp,EventID,sender,recipients |sort-object Timestamp  

For example, user1 and some other users have Send As permission for user2. Now user1 sends a test message "123 " using his Send As permission for User2. Running the cmdlet below, we can see that the user1 displays in the Sender field after the first Receive and Submit event:

Get-TransportService| Get-MessageTrackingLog -MessageSubject 123  -Start "02/08/2021" |select timestamp,EventID,sender,recipients |sort-object Timestamp  

---

If an Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.