unknow email address in address book RRS feed

  • Question

  • using exchange server 2007, client outlook 2007


    I found the distribution list – “ABC distribution group” consisting of one member called “ABC2” with address causing the rebound and / or delay message since is not a valid address in our list.

    wonder if any hacker or security issue, is not created by ourselve.

    Wednesday, July 13, 2011 2:33 AM

All replies

  • This is a tough question and hard to investigate.

    if you have Auditing enabled on AD then you could figure when and who created it. 

    Other than that..i don't think if there is any way to investigate this issue!

    M.P.K ~ ( Exchange | 2003/2007/2010/E15(2013)) ~~ Please remember to click “Vote As Helpful" if it really helps and "Mark as Answer” if it answers your question, “Unmark as Answer” if a marked post does not actually answer your question. ~~ This Information is provided is "AS IS" and confers NO Rights!!

    • Proposed as answer by PK M Monday, October 6, 2014 2:35 PM
    Tuesday, September 23, 2014 12:24 PM
  • Yes, hard to tell from a simple description.

    A simple address (contact) does not grant access to any resources and is probably not a risk in that respect.

    Is it only a contact and not a user also (in Active Directory)?

    If it is a user, of which groups is it a member?

    You can get a timestamp of the creation date even without auditing enabled. It will be a property of the object.

    How can you see this? Well, if it's a user...

    PS C:\> Get-ADUser sonia.smith -properties * | fl


    whenChanged                       : 9/22/2014 11:00:59 AM
    whenCreated                        : 9/16/2014 10:54:01 AM

    That works with a Windows 2008 R2 SP1 domain (PowerShell version 4.0). Not sure what you have. Otherwise, there are other ways

    Please mark as helpful if you find my contribution useful or as an answer if it does answer your question. That will encourage me - and others - to take time out to help you.

    Tuesday, September 23, 2014 4:59 PM