Subscribe to Blog via Email

Enter your email address to subscribe to this blog and receive notifications of new posts by email.

Join 780 other subscribers


  • LinkedIn
  • RSS Feed for Posts
  • Twitter
  • StumbleUpon

[Solved] Weird outlook emails (auto forward by phishing)

This month I had 2 customers how had some weird settings in outlook.

They both received undeliverable email, stated the receiving mailbox was full. They both didn’t send any email to this mailbox. With some testing, I quickly saw the reason: all sending mail was forwarded to this email address, and this mailbox was full.

Quickly I checked the rules of this outlook, and there was no forwarding rule.

After this I checked the OWA ruleset, and there was also no forwarding rule.

Off course the solution had to be powershell 😊

Powershell check :

How to check if a forward rule exists for all users :

(a rule can exist on both ForwardingAddress and ForwardingSmtpAddress)

The users mailbox has a forward to the Gmail mailbox, and DeliverToMailboxAndForward is set to True

Solution :

After finding a forwarding rule you can delete this rule in Powershell by forwarding the mailbox to ‘nothing’, and off course disable the forwarding.

Change the forward :

You can change the forward to ‘nothing’ by forwarding it to ‘$Null’

Check the mailbox again:

The forwarding (Gmail) email address is now removed from the rule

You can now disable the forward :

Execute the command

Check the mailbox again:

The option DeliverToMailboxAndForward is now set to false, and no forward is active anymore.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.