Forum Discussion
RequireSenderAuthenticationEnabled - Distribution Groups - Exchange 2016
- Can I use eDiscovery (on Exchange 2016 or something else) to check all recieveng messages or logs for a longer period?
If admin audit logging is enabled, yes. But since it was not at that time, you can't since it will only log future events.
- What was the default vaule on Exchange Server 2010 regarding "Require that all senders are authenticated")?
IIRC, default is unspecified, which corresponds to $true. Has been like that since Ex2007, same is true for Exchange Online.
- Is it possible that for some reason those settings automatically changed? Or is it more possible that the default settings for external emails was not changed when the distribution groups were created?
No, there is no policy for that. It requires configuration, either by hand, by some process. Your EXO setting is managed (synced) by AD Connect (msExchRequireAuthToSendTo).
- I tried checking event logs, tried with Powershell (Get-DistributionGroup | Where{$_.WhenChanged -gt ((Get-Date).AddMonths(-24))} and Audit log. I can´t find anything regarding changes in the mentiond setting on Exchange 2010 or Exchange 2016.
This happens always when you turn audit logging only on when it was needed before.
Now your savior might be AD Connect; if it was synced from on-premises after it was changed, AD Connect might provide details on the data it has on the object, or you can look through its logs. Cmdlets like the following might help you parse and filter instead of going through the UI 🙂
Export-ADsyncObject -DistinguishedName 'CN=GroupX,OU=Groups,DC=Contoso,DC=com' -ConnectorName 'ad.contoso.com'
You'll likely need to trawl the Audit logs (if enabled)... you can check the audit log configuration by using the Get-AdminAuditLogConfig cmdlet
If logging is enabled, you could then use Search-AdminAuditLog to search the logs
It's also worth noting that the default value of the parameter RequireSenderAuthenticationEnabled is $true, which can be seen in the documentation for the New-DistributionGroup cmdlet:
Hi kevkelly,
thanks a lot for your answer, but sadly I haven't found anything in Audit log. Just something in Event Log from the Exchange on-prem server.
I know that the last 30 days the RequireSenderAuthenticationEnabled was set to true for mostly all of our distribution groups, is it possible that something changed this settings automatically, because I can't find a log that somebody changed this setting? Is it possible to check attribute change in Active directory?
Kindest regards
Leon