How to stop email spoofing within org?

Question

I recently realized that the script I am using to send me emails from task scheduler can be misused like I could use the script to send an email from anyone on my Exchange to any other person.

A) How can I stop this....this is not a question about domain spoofing, this is about the script being able to use any account to send email without the password.

B)If I stop it...what changes will I need to make to my script so that I can keep receiving email about logs and other reports and stuff.

We are using Exchange 2016. The script I am using just uses $messageParameters having the mail Subject, Body, From, To & SMTP Server

Answer 1

I assume your script is in Powershell.

I would enable and configure signed-powershell scripts and then you could use secure strings and create a scheduled task with a specific user (service account?). Then only the specific user on that specific machine can authenticate and send a message.

(get-credential).password | ConvertFrom-SecureString | set-content "C:\Passwords\password.txt" //don't forget to secure this file.

$password = Get-Content "C:\Passwords\password.txt" | ConvertTo-SecureString

$credential = New-Object System.Management.Automation.PsCredential("svc_notification",$password)`

Ordinary users who try to use that script are denied by either the password file or by the security settings to execute powershell scripts.