AD Auditing showing owner of the mailbox as Exchange server instead of actual owner.

AD Auditing showing owner of the mailbox  as Exchange server instead of actual owner.
LVL 19
systechadminConsultantAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

George SasIT EngineerCommented:
What command you fire to get you that result ?
Normally the following accounts would have full permisions on the mailbox :
NT Auth\self
NT Auth\System
Domain\Exchange Servers
Domain\Exchange Services
Domain\Exchange Trusted Subsystems

But NOT the user himself.
0
systechadminConsultantAuthor Commented:
in ADUC console, when i check user - Security - Advance settings - owner - it shows the Exchange server name instead of the user who created the user. See the attached.

Why it changed to the name of the exchange server.
Issue.jpg
0
George SasIT EngineerCommented:
In the topic you talk about a mailbox, now you say an user... not the same thing.

Might be a migration that happen sometime ?
Else someone had manually changed the ownership of the user.
0
Ultimate Tool Kit for Technology Solution Provider

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy now.

systechadminConsultantAuthor Commented:
The user is associated with Mailbox. It was created recently.  It was not done manually thats what I am sure.
0
George SasIT EngineerCommented:
Then maybe you can look in the log files / events and see who created the user and what permission has the person that created the user. But this is kinda hard if you do not have enabled auditing and also have the log files / events saved.
Without this is pretty hard to see who and when changed the ownership.
Try to look for event 4670 if you have auditing enabled.
0
systechadminConsultantAuthor Commented:
I found it, account created from Exchange 2010, their owner shows Exchange server names in AD.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
systechadminConsultantAuthor Commented:
I found it, account created from Exchange 2010, their owner shows Exchange server names in AD.
0
systechadminConsultantAuthor Commented:
I found it, account created from Exchange 2010, their owner shows Exchange server names in AD.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Exchange

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.