We help IT Professionals succeed at work.

not seeing a Send EventId in Exchange 2010

mmercaldi
mmercaldi asked
on
We have a user whose AD account was disabled.  Then 20 minutes later we see an email from his iphone (activesync).  I am looking in the exchange message tracking logs and I am seeing the RECEIVE and DELIVER eventId for this message nut not the SEND event ID for this message.  Is there any reason why  I would not be able to see the SEND eventID?
Comment
Watch Question

Hello,

Was the message sent to an internal or external recipient? You would only see a SENT event if the message leaves your organization.

-JJ
Will SzymkowskiSenior Solution Architect
Most Valuable Expert 2015
Top Expert 2015

Commented:
Does the phone continue to receive email? Might be a replication delay with Active Directory. Also a good practice to avoide this would be to disable the users mailbox activesync features with in the Mailbox Properties.

Will.
The reason that he was able to send an email is that the session remains active, even though the account is disabled. See my blog post for details and how to properly terminate an AD account.
https://jamiemckillop.wordpress.com/2012/10/06/properly-terminating-user-access/

-JJ