Ghost Account

Tags:
Active Directory
Desktops
Management
Microsoft Exchange
Microsoft Windows
OS
Security
Servers
SQL Server
Hello Everybody, I have been having some problems in my network, I have ghost users. The thing is that we have one user in Active Directory (let's say "user1") who's emails are forwarded to another user (let's say "receiver") who is also part of Active Directory (AD). "user1" and "receiver" have not received any emails to exchange's knowledge (and the users's) but when you go to "Message Tracking Center" in Exchange System Manager and you search for the recipient "user1" under the exchange server, it shows two "user1"s when it is checking the name. One of them has the new email address of "receiver" and the other the old. I tried looking for the second user in AD but no luck. I deleted the "user1" I found (which was the one with the new email) and the "receiver" yet the old one still exists. Can anybody help me? I am thinking of creating a contact in exchange but that sound to me as just a workaround, not a solution. Any suggestions/ideas are welcomed. Thank you all for your time and effort,

Answer Wiki

Thanks. We'll let you know when a new response is added.

Hello,

Your analogy is a slight bit confusing, but what it sounds like your seeing are the mailboxes in Exchange. When you delete a mail enabled user from AD, Exchange retains the mailbox for 30 days by default. As for message tracking, your seeing the path the message took i.e. user1 is the primary recipient and user2 will receive forwards from user1. Note that once you have deleted a user from AD, re-adding that user does not automatically link the original mailbox to that user account even if you rename the user exactly as it was originally. You can however manually link a mailbox to an account through Exchange System Manager.

Good Luck!

Discuss This Question: 7  Replies

 
There was an error processing your information. Please try again later.
Thanks. We'll let you know when a new response is added.
Send me notifications when members answer or reply to this question.

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
  • Humbleapprentice
    Thank you petroleumman, I did delete the mailbox from Exchange and purged it together with the AD account. See, what it should do when an email comes to "user1" it gets forwarded to a external user account (it's like any email that goes to user1@my-domain.com gets forwarded to user2@hotmail.com, where "user2" is an AD user with an external email account). So what I did is deleted and purged "user1"'s account and mailbox and deleted "user2"'s (or "receiver"'s) account from AD. Now, the old "user1" was created a long time ago and is impossible to find and delete. You can see it when using "Message Tracking Center" but you won't see it under any mailbox store in the server. Is there a way to find it and delete it? Or at least, is there a way to clean up Exchange from accounts that are not tight up to AD? Thank you all again,
    0 pointsBadges:
    report
  • Brontvain
    maybe if you enable the advanced properties in AD, you will see the hidden containers where these users might be hosted. also, you can manually the mailbox management process in the exchange mmc...
    0 pointsBadges:
    report
  • Ouobacrsbf
    What your are seeing from Exchange Sytem manager are your two Users mailboxes,not users themselves...this kind of things often occurs in Exchange database, u can use a tool provide by microsoft to compact and remove these ghost users...use google, you will find the tool.
    0 pointsBadges:
    report
  • Humbleapprentice
    Thanks for your help guys. Dear ouobacrsbf, what tool do you mean? Could you please provide me the name or the link where it can be found? I looked in Microsoft's website but I couldn't find anything that will resemble what you where talking about. Thank you again. It does not make much sense for this thing to happen.
    0 pointsBadges:
    report
  • Serendipity
    The Message Tracking Center reads and reports from log files of messages sent and received. It sounds like you have changed the e-mail address for user1 at some point in time. Depending on the dates you have entered in the message tracking search, you could be seeing messages that were received by user1 for both of his e-mail addresses.
    100 pointsBadges:
    report
  • Humbleapprentice
    Thank you for the information Serendipity but even when I look for one day a popup will ask me to specify which accout I want. In that popup to "user1"s are listed The one who's email was changed in the past (as you said and that is the so called "ghost" account) and the new one. In the last reply to my question there was sometihng about a tool, do anybody know what this tool is or what is its name? I just want to get rid of all the accounts and specially the ghost one, please help me!!. Thank you all, humbleapprentice
    0 pointsBadges:
    report
  • Ouobacrsbf
    Don't use Message Tracking center because it mainly allow you to find messages, i dont think it can significanty show us which user exist or not.But let use AD and the Container Mailboxes in Your Storage Group(by default First Storage Group under the name of you Server) from Exchange System manager to solve problem, it should may simplify the problem. When you go to Mailboxes container, do you see the user1's mailbox?user2's mailbox? have you many Organisations Units(OU) in your AD? if this case, it's possible that the user have been moved to another OU in wich it is hidden. Second thing, remenber that you can delete an user without his mailbox from AD and create an user without a mailbox...read correctly options when you are creating or deleting an user. Also remenber that you can do all the exchange tasks from AD. if you are unable to find a user from AD and the mailbox from Mailboxes container,it possible that this objet is hidden or there is a problem with you exchange database. In this case, the tool that im taking about is ESEUTIL and ISINTEG. ESEUTIL is a tool to defragment your exchange database,to check their integity and to repair a damaged database. BUT you have to be sur that your database has a problem and make a full backup before to execute the command. ESEUTIL is located in the EXCHSRVR|BIN directory. For more information go to MSEXCHANGE.ORG. I'm sure that if you use correctly AD and the Maiboxes container, you'll solve the problem.
    0 pointsBadges:
    report

Forgot Password

No problem! Submit your e-mail address below. We'll send you an e-mail containing your password.

Your password has been sent to:

To follow this tag...

There was an error processing your information. Please try again later.

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy

Thanks! We'll email you when relevant content is added and updated.

Following