Some truths you live with for a lifetime, like Outlook users cannot send email using an alternate email address (with Outlook in MAPI mode – read previous post: “HOW TO: Send as alternate email address“). Others change as Microsoft Exchange evolves, either through new versions of Exchange server, or service packs and hotfixes.
Disabled mailboxes cannot receive email. Or rather, could not receive email. This has been true all this while, and hasn’t changed in Exchange 2000, Exchange Server 2003, including SP1 and SP2.
The reason is described in Microsoft KBA 319047 – “You receive a non-delivery report when you send a message to a disabled account”.
In addition to not being able to receive email, administrators face a few other operational issues when managing disabled mailboxes:
– A common scenario: An employee leaves. You disable the account, as part of a standard operating procedure followed in most organizations. You assign his/her manager/co-worker/replacement permissions to access the mailbox. If the mailbox is disabled, they can’t access it!
– A disabled mailbox needs to be be enabled first before it can be moved (KBA 278966: “You cannot move or log on to an Exchange resource mailbox”)
– The Application Event Log is flooded with annoying Event ID 9548s, informing you that the disabled account does not have a msExchMasterAccountSID attribute populated – something most Exchange administrators have probably gnashed their teeth at a few times a day.
Workarounds exist to populate the msExchMasterAccountSID attribute with the well-known SELF SID (KBA 322890 “How to associate an external account with an existing Exchange 2000 mailbox”), but not something you want to do on a regular interval after every account, or a bunch of them, are disabled.
The hotfix mentioned in KBA 903158: “A hotfix is available to modify the way that Exchange Server 2003 handles a disabled Active Directory user account that is associated with an Exchange Server 2003 mailbox” changes that behavior. It makes the Store act as if a disabled account with a null/empty msExchMasterAccountSID attribute actually has the SELF SID.
All the above actions (and more) complete successfully for disabled accounts. Yes, disabled accounts receive email if you have this hotfix applied – or any subsequent hotfix that updates Store.exe to version 6.5.7234.3 or later.
But what if I don’t want disabled accounts to receive email? To prevent disabled accounts from receiving any email, setup Delivery Restrictions (in ADUC | user -> properties | Exchange General tab) to:
Figure 1: Setting Delivery Restrictions on a recipient to prevent receiving mail
1. Receive mail from authenticated users only: With Recipient Filtering enabled, this will drop internet mail at the gateway or the first Exchange server that receives inbound internet mail
2.Receive mail only from: a particular Distribution Group (use a Distribution Group with no members).
{ 8 comments… read them below or add one }
To prevent a mailbox from receiving any more mail, we remove all known SMTP addresses (you have to leave one there – just make it one that no body ever used) and set that mail box to only receive mail from itself. We also hide the mailbox from GAL.
That way, most people will get a valid NDR and those that do manage to send it to this account will get a bounceback saying the user cannot receive mail.
Not the perfect solution, but the best I could come up. Anyone have any other suggestions?
This was useful. I am shifting things around having migrated to Exchange03 hosted by http://www.123together.com. We will be continuing some emails and discontinuing others. I thought that I could start a new email for myself – a private, limited access one for clients and family – to cut down on spam and interruptions. There is one from a past employee that I will block using this method.
Quote – “Disabled mailboxes cannot receive email. Or rather, could not receive email. This has been true all this while, and hasn’t changed in Exchange 2000, Exchange Server 2003, including SP1 and SP2.”
This is not true (or may not be). I have a couple of Exchange 2003 SP2 servers, and disabled users still receive email in their mailbox. I have not applied any special mods or hotfixes.
Check out http://blog.shijaz.com/2007/10/disabled-users-continue-to-receive-mail.html for something similar.
Here’s another link with more info.
http://blogs.technet.com/benw/archive/2007/07/09/exchange-2003-and-disabled-user-accounts.aspx
Nolan,
The link you posted says the same thing I’ve attempted to explain in this post. By default, disabled accounts do not receive email.
If you’re on Exchange Server 2003 SP1 and have Store.exe ver 6.5.7234.3 or higher, or on Exchange Server 2003 SP2 with Store.exe at ver 6.5.7651.14 or higher, this behaviour changes.
How does this relate to an Exchange 2007 environment?
I agree with Bharat, newer versions of store.exe handles the delivery of messages to disabled accounts differently. You will need to follow the recommedations on this article to prevent delivery.
Great post, thanks! Answered my question perfectly.