Search WWW Search

Monday, August 21, 2006

Exchange: Forwarding Copy of User's Email or Public Folder to Another Account Via Event Sink


Exchange offers Journaling which allows you to designate a mailbox to receive all emails sent and received from a particular store that you designate. However, Exchange does not give you the granularity to journal only one mailbox. In order to achieve this you will need to install a custom event sink provided below. Before I delve into the implementation of the event sink. I'll go over what event sinks are what they do.

Event sinks are basically a sub-routine that is fired at specific points in the message flow such as during transport. Most event sinks fire just before the message categorizer and right after. However, there are also sinks that run during message transfer. Many Exchange aware AV products register event sinks within Exchange. For example, before a message is sent to the categorizer, it is sent to the pre-submission queue where it is scanned for viruses or verified against the GAL.

Registering The Per User Journaling Event Sink. This event sink provided will forward a copy of all messages sent to your designated recipient to another mailbox such as your admin.

Download the files below (google)
1. SMTPReg.vbs
2. smtpjrnl.vbs

1. Create a directory on your C: drive called Journal. (Or anywhere you wish)

2. You will need the SMTPReg.vbs. Although I downloaded the Exchange SDK, this file was not included. However, I was able to locate it here. In the link, you will need to copy all the code in the [smtpreg.vbs Event Management Script] and paste it into notepad. Name this file as smtpreg.vbs and paste it into your C:\Journal directory.

3. Open notepad and copy the entire contents below and name this file smtpjrnl.vbs

script language="VBScript"

Sub ISMTPOnArrival_OnArrival(ByVal Msg, EventStatus ) on error resume next Dim RecpList recplist = LCase(Msg.EnvelopeFields("")) recplist = recplist & ";" Msg.EnvelopeFields("") = recplist Msg.EnvelopeFields.update

End Sub


4. In the recplist = recplist & ";"
Enter the SMTP address in which you would like all of the forwarded emails to go to. (Include the quotes)

5. Open command prompt. Go to Start --> Run, type cmd, ok
CD CD journal

cscript smtpreg.vbs /add 1 onarrival smtpjrnl CDO.SS_SMTPOnArrivalSink "Rcpt"

(Note: This will forward any emails sent to your internal user or public folder SMTP address here to the SMTP address you specified in step 4)

6. If you wish to customize it so that mail from a particular domain say anything from hotmail sent to internaluser@yourdomain gets forwarded to, change the code in step 5 to: "Rcpt to:internaluser@yourdomain mail")

Now you will need to associate smtpreg.vbs to your smtpjrnl.vbs sinkcscript. Type the following command below in your command prompt.

smtpreg.vbs /setprop 1 onarrival smtpjrnl Sink ScriptName c:\journal\smtpjrnl.vbs

Note: If you receive Binding Dispaly Name Specified: smtpjrnlFailed to find binding with dispaly name: smtpjrnl, re-enter the command below. Note the smtpjrnl.vbs in the first line. It appears that there is a bug, sometimes it registers with out the .vbs other times it doesn't.

cscript smtpreg.vbs /setprop 1 onarrival smtpjrnl.vbs Sink ScriptName c:\journal\smtpjrnl.vbs

7. Test by emailing to from an outside account. It should be forwarded to There is a limitation to this. When sending internally, if the and exists on the same Exchange server, it will not work even with public folders. This is by design. You can circumvent this if you use a frontend server that handles all your inbound mail and forwards to your backend Exchange servers.

8. To remove the event sink. Go to your command prompt. From your C:\Journal directory type the following command:

cscript smtpreg.vbs /remove 1 onarrival smtpjrnl

1 = SMTP Virtual Service
onarrival = sink class
smtpjrnl = sink name

James Chong
MCSE M+, S+, MCTS, Security+

How useful was this article? Want to see a tip not listed? Please leave a comment.


Anonymous Chris Shipley said...

This is great... but in Step 6 you say: change the code in step 5 to: "Rcpt to:internaluser@yourdomain mail")

How do I do ANY user... i.e., what's the wildcard value I can use in for it to end up being * What's the full context for replacement? Is it Rcpt from:*

9:28 AM  
Blogger jamestechman said...

What are you trying to do? If you want it so that if your internal users send to hotmail it gets forwarded to your admin put

cscript smtpreg.vbs /add 1 onarrival smtpjrnl CDO.SS_SMTPOnArrivalSink "mail from=*"

Sorry for the typo, I will fix it in the blog!

6:31 PM  
Blogger DeuceIT said...

I'm in the same boat as Chris. I'm looking to send a copy to a public folder (smtp address is, but I want this rule set up so that if it is sent to anybody and everybody, originating from anybody and everybody, this rule will be applied. For instance, (anyone) sends an email to (anyone), I want a copy sent to

I hope I said that right...

9:15 AM  
Blogger Mark said...

Hi Guys,

I have to do a similar thing here where I need to add a diclaimer using VB Script to the end of any external emails. I'm comfortable with using the smtpreg.vbs file (although I didn't get it in ths SDK!). Can someone run through how I can add the same disclaimer text to more than one domain, all are controlled by the same exchange server (if at all).

I have something like this

cscript smtpreg.vbs /add 1 onarrival SMTPScriptingHost CDO.SS_SMTPOnArrivalSink "mail from=*"

Can I add this:

cscript smtpreg.vbs /add 1 onarrival SMTPScriptingHost CDO.SS_SMTPOnArrivalSink "mail from=*,*"


Thanks in advance


1:49 AM  
Anonymous Anonymous said...

Hi James,

I am in a bit of a jam and I need to strip off copies of email messages and forward to a specific user in a IIS SMTP server (no exchange). I know this is an old blog, but could you tell me if this would work with IIS SMTP?

12:43 PM  
Anonymous Anonymous said...

replica handbags , the prestigious fashion house came up with a new purse, named Sunset Boulevard. replica handbags is the ideal accessory for a special occasion. Coated in embossed Monogram Vernis patent leather, replica bags presents us a shiny and brilliant handbag. Besides designer replica handbags features tone on tone leather trimmings and textile and calf leather lining.

5:20 PM  
Anonymous Women Leather Blazers said...

Great post. I really like it. Keep it up.

Buy Leather Jackets,
Leather Skirts

5:01 AM  
Blogger lala said...

Thanks for your post and welcome to check: here

7:50 PM  
Blogger Simple Luxury said...

Burberry Outlet Store Online
Handbags Outlet Store Online
Louis Vuitton Handbags Sale

7:34 AM  
Anonymous Women leather blazer said...

nice post love itWomens Leather Skirts

10:26 PM  
Blogger oakleyses said...

louis vuitton outlet, oakley sunglasses, michael kors handbags, cheap jordans, prada handbags, uggs outlet, michael kors outlet, oakley sunglasses, uggs on sale, ray ban sunglasses, burberry outlet, tiffany jewelry, uggs on sale, kate spade, gucci handbags, ray ban sunglasses, prada outlet, longchamp outlet, louboutin uk, burberry factory outlet, tory burch outlet, nike air max, tiffany jewelry, christian louboutin, louboutin shoes, oakley sunglasses, cheap oakley sunglasses, chanel handbags, michael kors outlet store, louis vuitton outlet, nike outlet, ralph lauren polo, louis vuitton, christian louboutin, michael kors outlet online, longchamp outlet, uggs outlet, michael kors outlet online, nike air max, longchamp bags, replica watches, ralph lauren outlet, oakley sunglasses, ray ban sunglasses, louis vuitton outlet online, nike free, michael kors

6:30 PM  
Blogger oakleyses said...

burberry pas cher, lunette oakley pas cher, coach outlet, kate spade outlet, true religion jeans, converse, coach outlet, longchamp soldes, north face uk, michael kors, louboutin pas cher, new balance, lululemon outlet, coach purses, nike air max, hermes pas cher, nike tn pas cher, vans pas cher, coach outlet store online, mulberry uk, lunette ray ban pas cher, nike air max uk, sac guess pas cher, nike air force, nike roshe run pas cher, longchamp pas cher, north face pas cher, nike air max pas cher, ray ban uk, true religion outlet, abercrombie and fitch, polo lacoste pas cher, true religion outlet, michael kors, jordan pas cher, nike free, polo ralph lauren uk, vanessa bruno pas cher, true religion outlet, hogan sito ufficiale, ralph lauren pas cher, michael kors outlet online, nike free pas cher, nike roshe uk, abercrombie and fitch UK, nike blazer pas cher, hollister uk

6:31 PM  
Blogger oakleyses said...

converse shoes outlet, salvatore ferragamo, timberland boots, softball bats, herve leger, ray ban, hollister, louboutin, gucci, nike roshe run, iphone cases, beats by dre, mcm handbags, oakley, p90x workout, insanity workout, wedding dresses, abercrombie and fitch, abercrombie, nike air max, mac cosmetics, babyliss pro, valentino shoes, bottega veneta, mont blanc, converse, jimmy choo outlet, hollister clothing, nike air max, north face outlet, new balance shoes, north face outlet, instyler ionic styler, soccer shoes, lululemon outlet, asics running shoes, ghd hair, giuseppe zanotti, soccer jerseys, nfl jerseys, longchamp uk, reebok outlet, nike air huarache, chi flat iron, hermes handbags, vans outlet, polo ralph lauren, celine handbags, nike trainers uk, vans scarpe

6:33 PM  
Blogger oakleyses said...

toms shoes, supra shoes, montre pas cher, ugg uk, juicy couture outlet, moncler, lancel, michael kors outlet online, ugg pas cher, michael kors handbags, barbour, doke & gabbana, michael kors outlet, coach outlet, louis vuitton uk, canada goose jackets, pandora charms, moncler, ugg,ugg australia,ugg italia, links of london uk, moncler jackets, hollister, juicy couture outlet, canada goose outlet, swarovski uk, pandora jewelry, canada goose pas cher, canada goose outlet, marc jacobs, moncler pas cher, thomas sabo uk, swarovski jewelry, karen millen uk, louis vuitton, moncler, moncler uk, sac louis vuitton, canada goose, moncler outlet, louis vuitton, canada goose, wedding dresses uk, ugg,uggs,uggs canada, canada goose uk, sac louis vuitton, moncler, replica watches, barbour jackets uk, bottes ugg pas cher, canada goose jackets

6:34 PM  
Blogger Minko Chen said...

kobe 9
nhl jerseys
nike air max
air max 90
mcm backpack
ugg outlet online
hermes belt for sale
ugg outlet store
ralph lauren outlet
louis vuitton outlet store
ralph lauren uk
juicy couture tracksuit
coach outlet
lacoste shirts
abercrombie and fitch
snow boots
true religion jeans
longchamp handbags
hermes outlet store
cheap nike shoes

6:40 PM  
Blogger dong dong23 said...

under armour shoes
ralph lauren polo
jordan shoes
manolo blahnik outlet
levis outlet
michael kors outlet clearance
nike sb stefan janoski
ray ban eyeglasses
michael kors handbags
ray ban sunglasses sale

12:00 AM  
Blogger happy 123 said...

saics running shoes
jordan 4
oakley sunglasses
michael kors handbags
michael kors uk
michael kors uk
hugo boss sale
colts jerseys
kate spade outlet
49ers jersey

3:07 AM  
Blogger Yaro Gabriel said...


kate spade outlet
mbt shoes
christian louboutin
coach outlet online
michael kors outlet
true religion jeans outlet
champion sportswear
ralph lauren polo
pandora charms
off white outlet

11:08 PM  
Blogger jjjjjjjjjjjjj said...

nike polo
irving shoes
goyard handbags
goyard bags
adidas yeezy
curry 5
air max 2018
zx flux
adidas ultra boost
air max 270

10:58 PM  

Post a Comment

<< Home

xml:lang="en" lang="en"> MS Exchange Tips: Exchange: Forwarding Copy of User's Email or Public Folder to Another Account Via Event Sink