Exchange sending strange email. Help!

Posted on 2008-06-13
Medium Priority
Last Modified: 2010-03-06
I have a user who, according to Exchange 2003, is sending some erroneous email.

When I track these messages in Exchange, they appear to be sent to server-sa@domain.com.

The strange thing is that I don't have an account for server-sa. Plus, this user only uses OWA. When I check his email, there is no trace of emails being sent to server-sa.

What could this be and how can I resolve it?
Question by:lenivan
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2

Expert Comment

ID: 21783608
Are these emails being generated on a regular basis or are they random?

You may wish to run a sniffer such as Wireshark, http://www.wireshark.org/  to capture SMTP packets and filter the results.

It could be a rogue application, malware, etc.


Expert Comment

ID: 21783806
Possible backscatter.

Author Comment

ID: 21823605
no other ideas?

Accepted Solution

Dovinshka earned 2000 total points
ID: 21827836
Have you tried to run a packet sniffer? This will tell you where traffic is being generated from. You can also filter the results to just show SMTP packets.

You may also wish to configure security auditing to see logon events at the time the email was sent.


Featured Post

Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The core idea of this article is to make you acquainted with the best way in which you can export Exchange mailbox to PST format.
On September 18, Experts Exchange launched the first installment of the Help Bell, a new feature for Premium Members, Team Accounts, and Qualified Experts. The Help Bell will serve as an additional tool to help teams increase question visibility.
The basic steps you have just learned will be implemented in this video. The basic steps are shown to configure an Exchange DAG in a live working Exchange Server Environment and manage the same (Exchange Server 2010 Software is used in a Windows Ser…
This is my first video review of Microsoft Bookings, I will be doing a part two with a bit more information, but wanted to get this out to you folks.
Suggested Courses

719 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question