"The behavior you are seeing is normal. The headers you describe are SMTP headers meaning that every SMTP host that a message passes through will stamp it's IP address. This includes the originating machine if the client sends via SMTP. However when you are sending with a MAPI client to somone the same server MAPI doesn't add anything to the SMTP header. There is no option to make MAPI write SMTP headers as they are two entirely different entities (it doesn't make an SMTP 'hop'). In a MAPI environment (Corporate mode) you rely on the NT permissions to lock down who can send as who. If the messages are being sent with Outlook in MAPI mode, which it sounds like they are, then someone would have to either know the mailbox owners NT password or perhaps the user left there workstation unlocked. I would review your password complexity/duration policy and remind folks not to leave workstations unlocked while away, paying special priority on those that have been already compromised. One other possiblility is someone with "Send-As" permission is sending-as these users, so check mailbox rights. Also anyone with send-as/receive-as permission on the mailbox database in question would be able to open the mailbox of anyone in that store (no such accounts by default). You can turn up Mailbox Logons under diagnostic logging to give you more information on someone logging in to someone else's mailbox because they have been give permission to. " ________________________________ From: Craig Weil [mailto:craig_weil@xxxxxxxxxxx] Sent: Wed 3/15/2006 6:24 PM To: [ExchangeList] Subject: [exchangelist] Originating workstation http://www.MSExchange.org/ Hi all, Is there a way you can set Exchange to include the LAN IP address in an email's attributes? Ever since we've been using Exchange 2000, I don't see the details behind emails sent from within our organization when I right click and choose properties on an email. I see a lot of detail when I look at the properties of an email from domains outside of ours. Thanks everyone, Craig ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=exchangelist Exchange Newsletters: http://www.msexchange.org/pages/newsletter.asp ------------------------------------------------------ Visit TechGenix.com for more information about our other sites: http://www.techgenix.com ------------------------------------------------------ You are currently subscribed to this MSExchange.org Discussion List as: chongja@xxxxxxxxxxxxxxxx To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=exchangelist Report abuse to info@xxxxxxxxxxxxxx