Search WWW Search

Monday, August 21, 2006

Exchange: Forwarding Copy of User's Email or Public Folder to Another Account Via Event Sink


Exchange offers Journaling which allows you to designate a mailbox to receive all emails sent and received from a particular store that you designate. However, Exchange does not give you the granularity to journal only one mailbox. In order to achieve this you will need to install a custom event sink provided below. Before I delve into the implementation of the event sink. I'll go over what event sinks are what they do.

Event sinks are basically a sub-routine that is fired at specific points in the message flow such as during transport. Most event sinks fire just before the message categorizer and right after. However, there are also sinks that run during message transfer. Many Exchange aware AV products register event sinks within Exchange. For example, before a message is sent to the categorizer, it is sent to the pre-submission queue where it is scanned for viruses or verified against the GAL.

Registering The Per User Journaling Event Sink. This event sink provided will forward a copy of all messages sent to your designated recipient to another mailbox such as your admin.

Download the files below (google)
1. SMTPReg.vbs
2. smtpjrnl.vbs

1. Create a directory on your C: drive called Journal. (Or anywhere you wish)

2. You will need the SMTPReg.vbs. Although I downloaded the Exchange SDK, this file was not included. However, I was able to locate it here. In the link, you will need to copy all the code in the [smtpreg.vbs Event Management Script] and paste it into notepad. Name this file as smtpreg.vbs and paste it into your C:\Journal directory.

3. Open notepad and copy the entire contents below and name this file smtpjrnl.vbs

script language="VBScript"

Sub ISMTPOnArrival_OnArrival(ByVal Msg, EventStatus ) on error resume next Dim RecpList recplist = LCase(Msg.EnvelopeFields("")) recplist = recplist & ";" Msg.EnvelopeFields("") = recplist Msg.EnvelopeFields.update

End Sub


4. In the recplist = recplist & ";"
Enter the SMTP address in which you would like all of the forwarded emails to go to. (Include the quotes)

5. Open command prompt. Go to Start --> Run, type cmd, ok
CD CD journal

cscript smtpreg.vbs /add 1 onarrival smtpjrnl CDO.SS_SMTPOnArrivalSink "Rcpt"

(Note: This will forward any emails sent to your internal user or public folder SMTP address here to the SMTP address you specified in step 4)

6. If you wish to customize it so that mail from a particular domain say anything from hotmail sent to internaluser@yourdomain gets forwarded to, change the code in step 5 to: "Rcpt to:internaluser@yourdomain mail")

Now you will need to associate smtpreg.vbs to your smtpjrnl.vbs sinkcscript. Type the following command below in your command prompt.

smtpreg.vbs /setprop 1 onarrival smtpjrnl Sink ScriptName c:\journal\smtpjrnl.vbs

Note: If you receive Binding Dispaly Name Specified: smtpjrnlFailed to find binding with dispaly name: smtpjrnl, re-enter the command below. Note the smtpjrnl.vbs in the first line. It appears that there is a bug, sometimes it registers with out the .vbs other times it doesn't.

cscript smtpreg.vbs /setprop 1 onarrival smtpjrnl.vbs Sink ScriptName c:\journal\smtpjrnl.vbs

7. Test by emailing to from an outside account. It should be forwarded to There is a limitation to this. When sending internally, if the and exists on the same Exchange server, it will not work even with public folders. This is by design. You can circumvent this if you use a frontend server that handles all your inbound mail and forwards to your backend Exchange servers.

8. To remove the event sink. Go to your command prompt. From your C:\Journal directory type the following command:

cscript smtpreg.vbs /remove 1 onarrival smtpjrnl

1 = SMTP Virtual Service
onarrival = sink class
smtpjrnl = sink name

James Chong
MCSE M+, S+, MCTS, Security+

How useful was this article? Want to see a tip not listed? Please leave a comment.


Anonymous Chris Shipley said...

This is great... but in Step 6 you say: change the code in step 5 to: "Rcpt to:internaluser@yourdomain mail")

How do I do ANY user... i.e., what's the wildcard value I can use in for it to end up being * What's the full context for replacement? Is it Rcpt from:*

9:28 AM  
Blogger jamestechman said...

What are you trying to do? If you want it so that if your internal users send to hotmail it gets forwarded to your admin put

cscript smtpreg.vbs /add 1 onarrival smtpjrnl CDO.SS_SMTPOnArrivalSink "mail from=*"

Sorry for the typo, I will fix it in the blog!

6:31 PM  
Blogger DeuceIT said...

I'm in the same boat as Chris. I'm looking to send a copy to a public folder (smtp address is, but I want this rule set up so that if it is sent to anybody and everybody, originating from anybody and everybody, this rule will be applied. For instance, (anyone) sends an email to (anyone), I want a copy sent to

I hope I said that right...

9:15 AM  
Blogger Mark said...

Hi Guys,

I have to do a similar thing here where I need to add a diclaimer using VB Script to the end of any external emails. I'm comfortable with using the smtpreg.vbs file (although I didn't get it in ths SDK!). Can someone run through how I can add the same disclaimer text to more than one domain, all are controlled by the same exchange server (if at all).

I have something like this

cscript smtpreg.vbs /add 1 onarrival SMTPScriptingHost CDO.SS_SMTPOnArrivalSink "mail from=*"

Can I add this:

cscript smtpreg.vbs /add 1 onarrival SMTPScriptingHost CDO.SS_SMTPOnArrivalSink "mail from=*,*"


Thanks in advance


1:49 AM  
Anonymous Anonymous said...

Hi James,

I am in a bit of a jam and I need to strip off copies of email messages and forward to a specific user in a IIS SMTP server (no exchange). I know this is an old blog, but could you tell me if this would work with IIS SMTP?

12:43 PM  
Anonymous Anonymous said...

replica handbags , the prestigious fashion house came up with a new purse, named Sunset Boulevard. replica handbags is the ideal accessory for a special occasion. Coated in embossed Monogram Vernis patent leather, replica bags presents us a shiny and brilliant handbag. Besides designer replica handbags features tone on tone leather trimmings and textile and calf leather lining.

5:20 PM  
Anonymous Women Leather Blazers said...

Great post. I really like it. Keep it up.

Buy Leather Jackets,
Leather Skirts

5:01 AM  
Blogger lala said...

Thanks for your post and welcome to check: here

7:50 PM  
Blogger Simple Luxury said...

Burberry Outlet Store Online
Handbags Outlet Store Online
Louis Vuitton Handbags Sale

7:34 AM  
Anonymous Women leather blazer said...

nice post love itWomens Leather Skirts

10:26 PM  

Post a Comment

<< Home

xml:lang="en" lang="en"> MS Exchange Tips: Exchange: Forwarding Copy of User's Email or Public Folder to Another Account Via Event Sink