HOW TO ... view forwarding change

Question asked by Rod Strumbel - 8/19/2024 at 7:46 AM

Unanswered

Is there some log that I can see what forwarding a user setup (and when)?

Just about 100% sure that their password was cracked and someone logged in and added an email into the forwarding list to get a copy of all the users email. But... I cannot find any reference in the logs to a forwarding change, nor am I seeing in any searchable fashion any of the emails going to the cracked account going to the address added into the forwarding list.

Any ideas ?

4 Replies

Reply to Thread

Kyle Kerst Replied

8/19/2024 at 9:37 AM

Employee Post

Hey Rod! :-) The log entry you'd be looking for would be something like this example below, with the x.x.x.x being the IP of the user changing those setttings.

[2024.08.19] 09:34:59.773 [x.x.x.x] User webmail@example.com calling set mailbox forward list

Kyle Kerst Acting IT Manager SmarterTools Inc. www.smartertools.com

Rod Strumbel Replied

8/19/2024 at 10:24 AM

Thanks Kyle, is that in the Administration log, SMTP, or ???

Kyle Kerst Replied

8/19/2024 at 2:27 PM

Employee Post

Administrative logs, sorry Rod I thought I mentioned that but I didn't.

Kyle Kerst Acting IT Manager SmarterTools Inc. www.smartertools.com

Rod Strumbel Replied

8/19/2024 at 2:51 PM

Thank you! That provided the info I needed.

Back to Community Threads

Please leave this box unchecked

Reply to Thread

Enter the verification text