• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 129
  • Last Modified:

AD Auditing showing owner of the mailbox as Exchange server instead of actual owner.

AD Auditing showing owner of the mailbox  as Exchange server instead of actual owner.
0
Gaurav Singh
Asked:
Gaurav Singh
  • 5
  • 3
1 Solution
 
George SasIT EngineerCommented:
What command you fire to get you that result ?
Normally the following accounts would have full permisions on the mailbox :
NT Auth\self
NT Auth\System
Domain\Exchange Servers
Domain\Exchange Services
Domain\Exchange Trusted Subsystems

But NOT the user himself.
0
 
Gaurav SinghSolution ArchitectAuthor Commented:
in ADUC console, when i check user - Security - Advance settings - owner - it shows the Exchange server name instead of the user who created the user. See the attached.

Why it changed to the name of the exchange server.
Issue.jpg
0
 
George SasIT EngineerCommented:
In the topic you talk about a mailbox, now you say an user... not the same thing.

Might be a migration that happen sometime ?
Else someone had manually changed the ownership of the user.
0
Get your Conversational Ransomware Defense e‑book

This e-book gives you an insight into the ransomware threat and reviews the fundamentals of top-notch ransomware preparedness and recovery. To help you protect yourself and your organization. The initial infection may be inevitable, so the best protection is to be fully prepared.

 
Gaurav SinghSolution ArchitectAuthor Commented:
The user is associated with Mailbox. It was created recently.  It was not done manually thats what I am sure.
0
 
George SasIT EngineerCommented:
Then maybe you can look in the log files / events and see who created the user and what permission has the person that created the user. But this is kinda hard if you do not have enabled auditing and also have the log files / events saved.
Without this is pretty hard to see who and when changed the ownership.
Try to look for event 4670 if you have auditing enabled.
0
 
Gaurav SinghSolution ArchitectAuthor Commented:
I found it, account created from Exchange 2010, their owner shows Exchange server names in AD.
0
 
Gaurav SinghSolution ArchitectAuthor Commented:
I found it, account created from Exchange 2010, their owner shows Exchange server names in AD.
0
 
Gaurav SinghSolution ArchitectAuthor Commented:
I found it, account created from Exchange 2010, their owner shows Exchange server names in AD.
0

Featured Post

 [eBook] Windows Nano Server

Download this FREE eBook and learn all you need to get started with Windows Nano Server, including deployment options, remote management
and troubleshooting tips and tricks

  • 5
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now