Solved

Internal "All" Distribution List - Replied to by an outsider?!??!!?

Posted on 2006-07-12
7
225 Views
Last Modified: 2010-03-06
Like most companies, we have an internal Ddistribution List on our Exchange 2003 server called "All".  It includes all of our internal employees, and no one else.  So.....One of our employees sent an email to this group today to schedule a company picnic.  About an hour later, she got a reply from some guy who she says she does not know, and who is not an employee of our comapny.  ??!!??HUH??!?!?  Is this possible?  How?  I'm the IT Manager (and helpdesk, and Systems Admin., etc...), so I have full control over our Exchange Server.  The reply wasn't so much Spam, as it was just saying "I'm really proud of that fantastic email you sent for the picnic, you must be proud of yourself".....

I'm thinking either one of our employees forwarded the email to another address and then replied as a joke, or someone someone left OWA open somewhere outside of the company or something.....

Any thoughts?  

Thanks.
0
Comment
Question by:tenover
7 Comments
 
LVL 32

Expert Comment

by:r-k
ID: 17097552
It does seem like something like you already mentioned, i.e. a prank, or a former employee who is on the list by mistake etc. If you can't track down who sent the mail by looking at the mail headers, then the next best thing is to review the list membership and weed out anyone who does not belong.

It doesn't seem like a serious problem...
0
 
LVL 9

Expert Comment

by:trenes
ID: 17097772
Yup try the headers to find out who has forwarded the mail to the external address.
This does not seem a real problem.
Unless someone replied from outside to your distribution list, that could cause some real havoc. you should only accept email from inside.
0
 
LVL 32

Expert Comment

by:Robberbaron (robr)
ID: 17098360
I have seen a couple of spam messages addressed to all@xyz.com

So my distribution list is named like ~all.  (or something like that ;->)  
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 

Author Comment

by:tenover
ID: 17099379
Thanks for the comments, I'll dig a little deeper today.  How can I verify that I am "Only accepting email from inside" for my Distribution Lists?  I'e.: I do not want external people to be able to send email to my internal DLs!!  
0
 
LVL 32

Expert Comment

by:r-k
ID: 17100593
In Active Directory User, right-click on the Distribution List, select Properties, then click on the Exchange General tab, and on that page you can restrict who can or cannot post to the list. A good start might be to "check" the box labeled "From Authenticated Users Only"
0
 
LVL 10

Accepted Solution

by:
ryangorman earned 500 total points
ID: 17100681
Have you previously enabled Message Tracking? The Message Tracking Center within Exchange System Manager will allow you to see where the message was sent. You should expect to see a lot of "Delivered locally" for each internal mailbox and then a message for each external recipient that received the message.
0
 

Author Comment

by:tenover
ID: 17101248
Well, like everyone figured, the email had been forwarded to one of users boyfriend.  He replied to the sender of the message instead of just his girlfriend.  Thanks.
And yes, I had tracking enabled, and that's how I figured it out.  
0

Featured Post

Best Practices: Disaster Recovery Testing

Besides backup, any IT division should have a disaster recovery plan. You will find a few tips below relating to the development of such a plan and to what issues one should pay special attention in the course of backup planning.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article aims to explain the working of CircularLogArchiver. This tool was designed to solve the buildup of log file in cases where systems do not support circular logging or where circular logging is not enabled
How to resolve IMCEAEX NDRs in Exchange or Exchange Online related to invalid X500 addresses.
In this Micro Video tutorial you will learn the basics about Database Availability Groups and How to configure one using a live Exchange Server Environment. The video tutorial explains the basics of the Exchange server Database Availability grou…
how to add IIS SMTP to handle application/Scanner relays into office 365.

792 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question