Description:

There are situations where enabling archiving on every message on a server can be overkill if you only want to monitor internet mail being sent to or from certain email address's or domains. An example may be you want to audit all the email that is being sent to hotmail.com or all email sent to a particular email address in your organization. This script is SMTP transport sink that can be fired on certain rules such as Rcpt to=*@hotmail.com which will catch any mails being sent to hotmail and then add the name of your mointer mailbox to the Smtpenvelope recipient list. The email will be then delivered as normally with a copy going to your monitor mailbox. The users at ether end will have no idea this mail has been intercepted in any way because the To field on the email in not modified and neither are the Internet headers that are available to the user. You can also do this on specific email address's eg you may want to monitor all email that is going to a certain user in this example you would fire on a rule such as Rcpt to=sususer@yourdomain.com

Installation:

Before using this script you need to put in your own domain variables to replace the yourdomain.com text in the script. To install and use an SMTP event sink you will first require the SMTPREG.vbs script that is included in the Exchange SDK. Create a directory on your servers c: drive called c:\smtpevt and copy the smtpreg.vbs and smtpjrnl.vbs scripts into this directory. To create an event sink for the smtpjrnl.vbs script that will fire when mail is sent to *.hotmail.com From a command line in the c:\smtpevt directory type

cscript smtpreg.vbs /add 1 onarrival smtpjrnl CDO.SS_SMTPOnArrivalSink "Rcpt to=*@hotmail.com"

You then need to associate the smtpevt.vbs script to this event sink you have created using

cscript smtpreg.vbs /setprop 1 onarrival smtpjrnl Sink ScriptName c:\smtpevt\smtpjrnl.vbs

To delete this event sink type:

cscript smtpreg.vbs /remove 1 onarrival smtpjrnl