How to Check and Stop External Forwarding (O365)

virtualxistance · 2018-03-05T20:25:06.000Z

With a lot of phishing and email scams budding all over the internet, people out there are trying to steal your credentials or trying to lure you into clicking links or opening docs to quietly run scripts to enable auto forwarding rules for your email so that they can send well crafted and more directed phishing emails to individuals. (Spear Phishing)

you might want to use this handy power shell command to check that org wide and see if the ForwardingSmtpAddress has anything to be concerned about.

GFU-2.png800×103 30.2 KB

Set-ExecutionPolicy RemoteSigned
$UserCredential = Get-Credential
$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $UserCredential -Authentication Basic -AllowRedirection
Import-PSSession $Session
Get-Mailbox -ResultSize Unlimited | Where {($_.ForwardingAddress -ne $Null) -or ($_.ForwardingsmtpAddress -ne $Null)} | Select Name, ForwardingAddress, ForwardingsmtpAddress, DeliverToMailboxAndForward

To Disable forwarding from PowerShell, use:

Set-Mailbox user@domain.com -ForwardingSmtpAddress $Null

There are ways to disable auto forwarding to external domains and i wont provide all details on that but would instead link it to an existing thread on spiceworks .

Neally · 2018-03-05T20:28:25.000Z

If you post code, please use the ‘Insert Code’ button. Please and thank you! ( read here )

What you posted is nothing new really, but thank you for sharing.

virtualxistance · 2018-03-06T16:05:16.000Z

Neally, thanks for pointing the code snippet out, i have fixed that.