6

I'm trying use Task Scheduler to run a powershell script and emails the output of a few commands. I'm using "Send-MailMessage" to do this. When I run the scheduled task with a domain admin account, I receive the emails just fine, but when I use a service account, the emails do not come through.

The service account I am using has both "Logon as a Service" and "Log on as Batch Job". It also has local admin rights on the server I am running this from.

Something to note: I have used telnet to send email through the SMTP server I am using and was able to send an unauthenticated email, so the problem is not an authentication problem with the SMTP server.

What credentials am I missing on this service account? Is there anything else I could be missing?

Thanks for the help!

1 Answer 1

10

When you submit an email through telnet and choose not to authenticate, the server assumes that you are anonymous (aka the well-known NT AUTHORITY\Anonymous logon or S-1-5-7).

When Send-MailMessage submits an email, it will ALWAYS try to authenticate the session. If a set of credentials is not specified, it will assume that the current users network credentials is to be used, and authenticates as the service account running the PowerShell script.

The service account is neither anonymous, an Exchange User nor an Exchange Organization Administrator and will not be permitted to submit the email.

The work around this, you'll need a PSCredential object:

$anonUsername = "anonymous"
$anonPassword = ConvertTo-SecureString -String "anonymous" -AsPlainText -Force
$anonCredentials = New-Object System.Management.Automation.PSCredential($anonUsername,$anonPassword)

Send-MailMessage -to "Big Boss <[email protected]>" -from "Me <[email protected]>" -subject "It's working! EOM" -credential $anonCredentials

Now your script is sending mails anonymously as well :-)


Another (and more secure) option is to give the service account in question the required permissions on a receive connector:

$RC = Get-ReceiveConnector "ConnectorNameGoesHere" 
$RC | Add-ADPermission -User "DOMAIN\ServiceAcc01" -ExtendedRights ms-Exch-SMTP-Submit,ms-Exch-SMTP-Accept-Authoritative-Domain-Sender

If you need to transfer files that will potentially be removed by content filtering or the likes you can also allow it to bypass anti-spam mechanisms:

$RC | Add-ADPermission -User "DOMAIN\ServiceAcc01" -ExtendedRights ms-Exch-Bypass-Anti-Spam

If you want it to send emails to recipients outside your own Exchange Organization you'll need to allow that as well:

$RC | Add-ADPermission -User "DOMAIN\ServiceAcc01" -ExtendedRights ms-Exch-SMTP-Accept-Any-Recipient
3
  • This should work. Typically I will setup a relay connector for these kinds of internal servers/services that is "externally secured", via locked down incoming IPs on the relay receive connector. I typically just link to this 2010 guide because it is easy to follow: exchangeserverpro.com/…
    – TheCleaner
    Oct 2, 2013 at 12:56
  • It does, I've used both methods with great success (both with Externaly Secured, and with custom Extended Rights for Anonymous Logon) ... But you would have to either create a new receive connector for each relaying host, or live with the fact that any MTA has at least as many rights on the connector as all the others combined Oct 2, 2013 at 13:21
  • Perfect explanation. Exactly what I was looking for and it works. Thanks for the super detailed and excellent explanation.
    – adivis12
    Oct 2, 2013 at 15:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .