none
Odd Send As Permission

    Question

  • Greetings,

    I just ran an audit of my organization's Send As permissions for each mailbox on our Exchange 2010 server. A few of the mailboxes have a strange looking user with Send As Permission:

    S-1-5-21-4072550923-507703868-1278143643-1330

    Does anybody know what this may indicate?

    Regards,

    B. Colt

    Tuesday, November 19, 2013 9:18 PM

Answers

All replies

  • Did you once have a forest trust that you no longer have?  The SID could be from an account from a now untrusted forest.  It also could be from a user or group which wasn't deleted properly.

    Ed Crowley MVP "There are seldom good technological solutions to behavioral problems."

    Tuesday, November 19, 2013 10:02 PM
  • Hi,

    Considering your concern, I’d like to explain, Mailbox audit logs can include Mailbox owner SID, Destination mailbox owner SID and SID of user who is logged on.
    And you can refer to the following article or Ed's suggestion to check the SID :
    http://support.microsoft.com/kb/243330

    Here are more references:
    Understanding Mailbox Audit Logging
    http://technet.microsoft.com/en-us/library/ff459237(v=exchg.150).aspx
    Exchange Server 2010 SP1 Mailbox Audit Logging Step by Step Guide
    http://exchangeserverpro.com/exchange-2010-mailbox-audit-logging/
    Note: Microsoft is providing this information as a convenience to you. The sites are not controlled by Microsoft. Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or information found there. Please make sure that you completely understand the risk before retrieving any suggestions from the above link.


    Thanks,
    Angela


    Angela Shi
    TechNet Community Support

    Wednesday, November 20, 2013 9:40 AM
    Moderator