AD replication is set for 30 minutes since the DC we would have disabled the account is at a different site than the DC local to exchange. We've ruled out people enabling her account that had access. We checked msg trackign log and it shows delivery right at the time it was in her sent items.
it just boggles the mind, wish we had our DCs logging archived and set more granular to see if that gives any clues, but they already overlapped. -BenN On Tue, Nov 8, 2011 at 7:40 PM, Michael B. Smith <mich...@smithcons.com>wrote: > Yeah, it appears to be a web.config file change now (2008 / 2008 R2); > but as far as I can see – it should still default to 15 minutes. Dunno why > they would see 8+ hours.**** > > ** ** > > Regards,**** > > ** ** > > Michael B. Smith**** > > Consultant and Exchange MVP**** > > http://TheEssentialExchange.com**** > > ** ** > > *From:* Brian Desmond [mailto:br...@briandesmond.com] > *Sent:* Tuesday, November 08, 2011 9:40 PM > > *To:* NT System Admin Issues > *Subject:* RE: iPhone user can still send emails after being disabled in > AD**** > > ** ** > > *There used to be a reg hack to control this too on the IIS side. *** > > * * > > *Thanks,* > > *Brian Desmond* > > *br...@briandesmond.com* > > * * > > *w – 312.625.1438 | c – 312.731.3132* > > * * > > *From:* Michael B. Smith [mailto:mich...@smithcons.com] > *Sent:* Tuesday, November 08, 2011 6:02 PM > *To:* NT System Admin Issues > *Subject:* RE: iPhone user can still send emails after being disabled in > AD**** > > ** ** > > Tst it.**** > > ** ** > > Then learn to recycle the appPool.**** > > ** ** > > Regards,**** > > ** ** > > Michael B. Smith**** > > Consultant and Exchange MVP**** > > http://TheEssentialExchange.com**** > > ** ** > > *From:* Ben N [mailto:bennordlan...@gmail.com] > *Sent:* Tuesday, November 08, 2011 6:55 PM > *To:* NT System Admin Issues > *Subject:* Re: iPhone user can still send emails after being disabled in > AD**** > > ** ** > > We are just stumped.. and we have our security people freak'n out on us > about it... even with user token caching.. it sounds like it is only for > 15 minutes? i don't get how they could send an email 16 hours later (the > last email we saw).**** > > ** ** > > -BenN**** > > On Tue, Nov 8, 2011 at 3:35 PM, Brian Desmond <br...@briandesmond.com> > wrote:**** > > *That’s most likely exactly it. ***** > > * ***** > > *Thanks,***** > > *Brian Desmond***** > > *br...@briandesmond.com***** > > * ***** > > *w – 312.625.1438 | c – 312.731.3132***** > > * ***** > > *From:* Ben N [mailto:bennordlan...@gmail.com] > *Sent:* Tuesday, November 08, 2011 5:33 PM > *To:* NT System Admin Issues > *Subject:* iPhone user can still send emails after being disabled in AD*** > * > > **** > > You guys have this issue ever come up? I think this user was disabled in > AD at about 4pm, and the last email we got from the user's phone was around > 8am the next morning. iPhone setup with EAS and we have Exchange 2007.**** > > **** > > Could it be due to user token caching like from this forum post?**** > > > http://social.technet.microsoft.com/Forums/en-US/exchangesvrclients/thread/3da53460-ef76-4f01-94c9-f7b96fdaf99d > **** > > ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ > > ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ > > --- > To manage subscriptions click here: > http://lyris.sunbelt-software.com/read/my_forums/ > or send an email to listmana...@lyris.sunbeltsoftware.com > with the body: unsubscribe ntsysadmin > > ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin
