Remove Forwarder Set By A User

[NotBatman]

Hi all,

 

Question time. I'll try to keep the details succinct.

 

- Mailbox set up with multiple delegate users with permission to Read and Manage the mailbox

- One user has logged in via Outlook on the web and set up an inbox rule and/or forwarder to forward all email to their personal account and not retain a copy in the original mailbox

- Other users cannot see this forwarder or rule when they switch to the mailbox, so it appears these can be set locally and independently of other users

- Checked on the Office365 Admin Panel / Exchange Admin Panel, reports no forwarders etc set up at the highest level and I'm unable to see any rules etc set on the account by users

- Removed the user's Read/Manage permission in the hope this would also kill the forwarder / rule they had setup.

 

Note: Due to the way this was set up before my time, this 'shared account' exists as a user, not a Shared Mailbox oddly.

 

My question is thus. Is there a way to remove this forwarder / rule that has been set on the account locally by a user that I'm missing? I'm coming from a Google Apps background so the hot mess that is the Office365 admin panel seems to repeat itself and generally just be very unfriendly to navigate, so I'm hoping there is a way that I've just not seen yet.

[NotBatman]

As an update to this, I couldn't get the damn thing removed for the life of me, but I found a workaround which may help someone, or I may still be ridiculed for missing something obvious.

 

I managed to set up a Mail Flow which stated if the recipient was the offending user AND the to field contained the account I wanted to capture, BCC it to a list of users.

 

A bit dirty, but if it works, it works. It'll buy me time anyway until the user is back off annual leave so we can have them remove the forwarder themselves. I may have to look into creating a profile for this account which bans forwards from being set up, I did read an article about it, but it seemed pretty involved for getting it up and running when this worked just as well in a pinch.

[Norphy]

It might be worth trying the PowerShell module for Exchange online. There is a cmdlet called Get-InboxRule

 

https://docs.microsoft.com/en-us/powershell/module/exchange/mailboxes/get-inboxrule?view=exchange-ps

 

However, if it's only visible to one user and no-one else, this might suggest that it's a client-side rule rather than a server-side one. Is there an instance of Outlook connected to this mailbox anywhere?

[DJ-1701]

I believe if you give yourself access to their mailbox, then after a few minutes login to Office 365 via a web browser, you can then open their mailbox and then click on the Settings button, followed by Mail, and go to Accounts, Forwarding, you can disable it there.

 

You can also just prevent auto forwarding outside your organisation by creating the following rule, and then when someone complains, point them to the fact it's a Data Protection issue and has been implemented due to the crack down with GDRP, and they need to remove their forwarder.

 

[MYK-IT]

As @Norphy mentioned, there are (numerous!) PowerShell scripts that generate the information you need. Confused me too, when I did similar as there are client-side and server-side options and one report listed forwarded email address, but the other didn't!

 

Within your Office 365 Admin centre, select Security and Compliance and then Secure Score. Under the vast list of suggestions, to make your Office 365 Tenancy secure, there's one called "Review mailbox forwarding rules weekly"

 

You should review mailbox forwarding rules to external domains at least every week. There are several ways you can do this, including simply reviewing the list of mail forwarding rules to external domains on all of your mailboxes using a PowerShell script, or by reviewing mail forwarding rule creation activity in the last week from the Audit Log Search. While there are lots of legitimate uses of mail forwarding rules to other locations, it is also a very popular data exfiltration tactic for attackers. You should review them regularly to ensure your users' email is not being exfiltrated. We found that the last time you reviewed this report was not within the suggested timeframe. If you review this report, your score will go up 5 points.

 

What am I about to change?

Running the PowerShell script linked below will generate two csv files, "MailboxDelegatePermissions" and "MailForwardingRulesToExternalDomains", in your System32 folder. You should run this script and review the reports created on a weekly basis to ensure your users' email is not being exfiltrated.

 

How will this affect my users?

This change will have no effect on your users.

 

The link to the PowerShell scripts (https://github.com/OfficeDev/O365-InvestigationTooling/blob/master/DumpDelegatesandForwardingRules.ps1)

 

I also enabled "Do not use mail forwarding to external domains" too

[NotBatman]

Thanks guys. I should point out I used the term 'personal account', but I meant their own personal internal email account. So essentially forwarding from a departmental email address to their own user specific account.

 

The Powershell scripts linked look interesting. I'll check them out.