I have had a look @ Message options, internet headers, and you do have some information in there, but not source IP address, but I might be getting it all wrong. ________________________________ From: Michael B. Smith <michael@xxxxxxxxxxxxxxxxxxxxxxxx> To: exchangelist@xxxxxxxxxxxxx Sent: Friday, April 24, 2009 1:16:01 PM Subject: [ExchangeList] Re: How to track internal emails - exchnage 2007 Both “options” and “message tracking” give you a client (source) IP. How much value that is depends on your environment and the mechanism used to submit the message. That’s going to be true of the SMTP logs as well. If you are attempting to determine the source of a MAPI connection, well, that’s more challenging; and I can’t think of any quick way to do it unless you were already prepared for it. From:exchangelist-bounce@xxxxxxxxxxxxx [mailto:exchangelist-bounce@xxxxxxxxxxxxx] On Behalf Of Patrick Sent: Friday, April 24, 2009 7:22 AM To: exchangelist@xxxxxxxxxxxxx Subject: [ExchangeList] Re: How to track internal emails - exchnage 2007 Options does not tell you much when the email is internal, neither does message tracking. they tell you that Admin sent an email but not from what computer or ip address. I will have a look @ the smtp protocol log. I did find some information of the security log of the exchange server. It does tell you that admin logged into the mail server @ a certain time, but does not tell you admin sent emails from the computer @ a certain time. But we'll see. Thanks ________________________________ From:Michael B. Smith <michael@xxxxxxxxxxxxxxxxxxxxxxxx> To: exchangelist@xxxxxxxxxxxxx Sent: Friday, April 24, 2009 12:00:47 PM Subject: [ExchangeList] Re: How to track internal emails - exchnage 2007 Open it up in Outlook. Click on Options. Examine the headers. Or, use message tracking. Or, use the smtp protocol logs. From:exchangelist-bounce@xxxxxxxxxxxxx [mailto:exchangelist-bounce@xxxxxxxxxxxxx] On Behalf Of Patrick Sent: Friday, April 24, 2009 5:55 AM To: exchangelist@xxxxxxxxxxxxx Subject: [ExchangeList] How to track internal emails - exchnage 2007 Hi guys, Some user has sent an email to all staff using the Administrator account. We just need to know if there is a way to track what workstation the email came from (IP address). Thanks Patrick