Sign in with
Sign up | Sign in
Your question

Deleted (AD) user appears in emails mysteriously.

Last response: in Windows XP
Share
January 27, 2005 9:29:07 AM

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

A deleted user (AD) is being sent emails, even though their address does not
appear in any of the "to" ,"cc", or "bcc" fields.

Help!

Where do i start?
February 14, 2005 11:15:06 AM

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

Any help guys? I am really at a loose end with this..

"desktop" wrote:

> A deleted user (AD) is being sent emails, even though their address does not
> appear in any of the "to" ,"cc", or "bcc" fields.
>
> Help!
>
> Where do i start?
February 15, 2005 9:53:19 AM

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

desktop wrote:

> Any help guys? I am really at a loose end with this..
>
> "desktop" wrote:
>
>> A deleted user (AD) is being sent emails, even though their address
>> does not appear in any of the "to" ,"cc", or "bcc" fields.
>>
>> Help!
>>
>> Where do i start?

From where are the emails coming? Random places? It may be that the
deleted user's email address is on some infected computer outside of
the domain. In that case, there really isn't anything you can do about
it except to just set your mail filter to bounce or delete these.

Malke
--
MS MVP - Windows Shell/User
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"
Related resources
February 15, 2005 2:29:13 PM

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

The mails are being sent by other users in the company i.e domain wide. I
dont think infection is the problem, have you any other ideas?

"Malke" wrote:

> desktop wrote:
>
> > Any help guys? I am really at a loose end with this..
> >
> > "desktop" wrote:
> >
> >> A deleted user (AD) is being sent emails, even though their address
> >> does not appear in any of the "to" ,"cc", or "bcc" fields.
> >>
> >> Help!
> >>
> >> Where do i start?
>
> From where are the emails coming? Random places? It may be that the
> deleted user's email address is on some infected computer outside of
> the domain. In that case, there really isn't anything you can do about
> it except to just set your mail filter to bounce or delete these.
>
> Malke
> --
> MS MVP - Windows Shell/User
> Elephant Boy Computers
> www.elephantboycomputers.com
> "Don't Panic!"
>
February 15, 2005 7:51:39 PM

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

desktop wrote:

> The mails are being sent by other users in the company i.e domain
> wide. I dont think infection is the problem, have you any other ideas?
>
> "Malke" wrote:
>
>> desktop wrote:
>>
>> > Any help guys? I am really at a loose end with this..
>> >
>> > "desktop" wrote:
>> >
>> >> A deleted user (AD) is being sent emails, even though their
>> >> address does not appear in any of the "to" ,"cc", or "bcc" fields.
>> >>
>> >> Help!
>> >>
>> >> Where do i start?

Maybe you can explain a little more clearly what is going on here. Are
these internal emails being sent to an internal mailing list or the
like? Something like Mailman and perhaps you didn't remove the deleted
username from the mailing list? What kind of mail server system is in
place in terms of filtering?

Malke
--
MS MVP - Windows Shell/User
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"
February 16, 2005 10:15:11 AM

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

Ok. Here is the exact problem. It is very simple. Imagine we work in the same
company, I send an email to you ( and you only ) addresed in the "to" field.
I then get an email from the administrative account saying that the email
could not be delivered to another user ( who I did not send the email to ).
That is it in a nutshell.

There are no mailing lists involved, all of the emails are being sent to
individual addresses, and the correspondance occurs internally only. The user
is not in AD (i.e. the account has been previously deleted). Th email server
is exchange 2000, and we use the default filtering in ESM, aswell as a third
party SW "XAMINE".

"Malke" wrote:

> desktop wrote:
>
> > The mails are being sent by other users in the company i.e domain
> > wide. I dont think infection is the problem, have you any other ideas?
> >
> > "Malke" wrote:
> >
> >> desktop wrote:
> >>
> >> > Any help guys? I am really at a loose end with this..
> >> >
> >> > "desktop" wrote:
> >> >
> >> >> A deleted user (AD) is being sent emails, even though their
> >> >> address does not appear in any of the "to" ,"cc", or "bcc" fields.
> >> >>
> >> >> Help!
> >> >>
> >> >> Where do i start?
>
> Maybe you can explain a little more clearly what is going on here. Are
> these internal emails being sent to an internal mailing list or the
> like? Something like Mailman and perhaps you didn't remove the deleted
> username from the mailing list? What kind of mail server system is in
> place in terms of filtering?
>
> Malke
> --
> MS MVP - Windows Shell/User
> Elephant Boy Computers
> www.elephantboycomputers.com
> "Don't Panic!"
>
February 16, 2005 11:45:53 AM

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

desktop wrote:

> Ok. Here is the exact problem. It is very simple. Imagine we work in
> the same company, I send an email to you ( and you only ) addresed in
> the "to" field. I then get an email from the administrative account
> saying that the email could not be delivered to another user ( who I
> did not send the email to ). That is it in a nutshell.
>
> There are no mailing lists involved, all of the emails are being sent
> to individual addresses, and the correspondance occurs internally
> only. The user is not in AD (i.e. the account has been previously
> deleted). Th email server is exchange 2000, and we use the default
> filtering in ESM, aswell as a third party SW "XAMINE".

Thanks for the great explanation. That does make the situation crystal.
So you now know that the error is either somewhere in the Exchange
server's settings or in Xamine's settings. Since I don't have any
experience with Exchange or Xamine, I'll need to bow out. There are
quite a few Exchange MVP's who post in this newsgroup, but you might
want to go directly to a group specifically for Exchange. Here's a link
to a list of all the MS newsgroups:

http://aumha.org/nntp.htm

I'd look at your Xamine manual or its Help file for how to contact their
tech support.

I'm sorry I was unable to help you. Best of luck,

Malke
--
MS MVP - Windows Shell/User
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"
!