not seeing a Send EventId in Exchange 2010

We have a user whose AD account was disabled.  Then 20 minutes later we see an email from his iphone (activesync).  I am looking in the exchange message tracking logs and I am seeing the RECEIVE and DELIVER eventId for this message nut not the SEND event ID for this message.  Is there any reason why  I would not be able to see the SEND eventID?
mmercaldiAsked:
Who is Participating?
 
Jamie McKillopIT ManagerCommented:
The reason that he was able to send an email is that the session remains active, even though the account is disabled. See my blog post for details and how to properly terminate an AD account.
https://jamiemckillop.wordpress.com/2012/10/06/properly-terminating-user-access/

-JJ
0
 
Jamie McKillopIT ManagerCommented:
Hello,

Was the message sent to an internal or external recipient? You would only see a SENT event if the message leaves your organization.

-JJ
0
 
Will SzymkowskiSenior Solution ArchitectCommented:
Does the phone continue to receive email? Might be a replication delay with Active Directory. Also a good practice to avoide this would be to disable the users mailbox activesync features with in the Mailbox Properties.

Will.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.