[ExchangeList] Re: How to track internal emails - exchnage 2007

I have had a look @ Message options, internet headers, and you do have some 
information in there, but not source IP address, but I might be getting it all 
wrong.




________________________________
From: Michael B. Smith <michael@xxxxxxxxxxxxxxxxxxxxxxxx>
To: exchangelist@xxxxxxxxxxxxx
Sent: Friday, April 24, 2009 1:16:01 PM
Subject: [ExchangeList] Re: How to track internal emails - exchnage 2007


Both “options” and “message tracking” give you a client (source) IP. How much 
value that is depends on your environment and the mechanism used to submit the 
message.
 
That’s going to be true of the SMTP logs as well.
 
If you are attempting to determine the source of a MAPI connection, well, 
that’s more challenging; and I can’t think of any quick way to do it unless you 
were already prepared for it.
 
From:exchangelist-bounce@xxxxxxxxxxxxx 
[mailto:exchangelist-bounce@xxxxxxxxxxxxx] On Behalf Of Patrick
Sent: Friday, April 24, 2009 7:22 AM
To: exchangelist@xxxxxxxxxxxxx
Subject: [ExchangeList] Re: How to track internal emails - exchnage 2007
 
Options does not tell you much when the email is internal, neither does message 
tracking. they tell you that Admin sent an email but not from what computer or 
ip address. I will have a look @ the smtp protocol log. I did find some 
information of the security log of the exchange server. It does tell you that 
admin logged into the mail server @ a certain time, but does not tell you admin 
sent emails from the computer @ a certain time.
 
But we'll see.
 
Thanks
 

________________________________

From:Michael B. Smith <michael@xxxxxxxxxxxxxxxxxxxxxxxx>
To: exchangelist@xxxxxxxxxxxxx
Sent: Friday, April 24, 2009 12:00:47 PM
Subject: [ExchangeList] Re: How to track internal emails - exchnage 2007
Open it up in Outlook. Click on Options. Examine the headers.
 
Or, use message tracking.
 
Or, use the smtp protocol logs.
 
From:exchangelist-bounce@xxxxxxxxxxxxx 
[mailto:exchangelist-bounce@xxxxxxxxxxxxx] On Behalf Of Patrick
Sent: Friday, April 24, 2009 5:55 AM
To: exchangelist@xxxxxxxxxxxxx
Subject: [ExchangeList] How to track internal emails - exchnage 2007
 
Hi guys,
 
Some user has sent an email to all staff using the Administrator account. We 
just need to know if there is a way to track what workstation the email came 
from (IP address).
 
 
Thanks
 
Patrick

Other related posts: