Management

Subscribe to Blog via Email

Enter your email address to subscribe to this blog and receive notifications of new posts by email.

Join 773 other subscribers

Social

  • LinkedIn
  • RSS Feed for Posts
  • Twitter
  • StumbleUpon

[Solved] Weird outlook emails (auto forward by phishing)

This month I had 2 customers how had some weird settings in outlook.

They both received undeliverable email, stated the receiving mailbox was full. They both didn’t send any email to this mailbox. With some testing, I quickly saw the reason: all sending mail was forwarded to this email address, and this mailbox was full.

Quickly I checked the rules of this outlook, and there was no forwarding rule.

After this I checked the OWA ruleset, and there was also no forwarding rule.

Off course the solution had to be powershell 😊

Powershell check :

How to check if a forward rule exists for all users :

(a rule can exist on both ForwardingAddress and ForwardingSmtpAddress)

Get-Mailbox | select UserPrincipalName, ForwardingAddress, DeliverToMailboxAndForward

Get-Mailbox | select UserPrincipalName, ForwardingSmtpAddress, DeliverToMailboxAndForward

You can also check for forwarding rule on one mailbox :

Get-Mailbox <identity> | select UserPrincipalName, ForwardingAddress, DeliverToMailboxAndForward

Get-Mailbox <identity> | select UserPrincipalName, ForwardingSmtpAddress, DeliverToMailboxAndForward

The users mailbox has a forward to the Gmail mailbox, and DeliverToMailboxAndForward is set to True

Solution :

After finding a forwarding rule you can delete this rule in Powershell by forwarding the mailbox to ‘nothing’, and off course disable the forwarding.

Change the forward :

You can change the forward to ‘nothing’ by forwarding it to ‘$Null’

Set-Mailbox <MailBox> -ForwardingAddress $Null

Set-Mailbox <MailBox> -ForwardingSmtpAddress $Null

Check the mailbox again:

Get-Mailbox <MailBox> | select ForwardingSMTPAddress,DeliverToMailboxandForward

The forwarding (Gmail) email address is now removed from the rule

You can now disable the forward :

Set-Mailbox <MailBox> -DeliverToMailboxAndForward $False

Execute the command

Check the mailbox again:

Get-Mailbox <MailBox> | select ForwardingSMTPAddress,DeliverToMailboxandForward

The option DeliverToMailboxAndForward is now set to false, and no forward is active anymore.