RE: Originating workstation

  • From: <ChongJa@xxxxxxxxxxxxxxxx>
  • To: <exchangelist@xxxxxxxxxxxxx>
  • Date: Wed, 15 Mar 2006 18:35:31 -0500

"The behavior you are seeing is normal. The headers you describe are SMTP 
headers meaning that every SMTP host that a message passes through will 
stamp it's IP address. This includes the originating machine if the client 
sends via SMTP. However when you are sending with a MAPI client to somone 
the same server MAPI doesn't add anything to the SMTP header. There is no 
option to make MAPI write SMTP headers as they are two entirely different 
entities (it doesn't make an SMTP 'hop').  In a MAPI environment (Corporate 
mode) you rely on the NT permissions to lock down who can send as who. If 
the messages are being sent with Outlook in MAPI mode, which it sounds like 
they are, then someone would have to either know the mailbox owners NT 
password or perhaps the user left there workstation unlocked. I would 
review your password complexity/duration policy and remind folks not to 
leave workstations unlocked while away, paying special priority on those 
that have been already compromised. One other possiblility is someone with 
"Send-As" permission is sending-as these users, so check mailbox rights. 
Also anyone with send-as/receive-as permission on the mailbox database in 
question would be able to open the mailbox of anyone in that store (no such 
accounts by default). You can turn up Mailbox Logons under diagnostic 
logging to give you more information on someone logging in to someone 
else's mailbox because they have been give permission to. "


From: Craig Weil [mailto:craig_weil@xxxxxxxxxxx]
Sent: Wed 3/15/2006 6:24 PM
To: [ExchangeList]
Subject: [exchangelist] Originating workstation

Hi all,
Is there a way you can set Exchange to include the LAN IP address in an email's 
attributes?  Ever since we've been using Exchange 2000, I don't see the details 
behind emails sent from within our organization when I right click and choose 
properties on an email.  I see a lot of detail when I look at the properties of 
an email from domains outside of ours.
Thanks everyone,
List Archives:
Exchange Newsletters: 
Visit for more information about our other sites:
You are currently subscribed to this Discussion List as: 
To unsubscribe visit
Report abuse to info@xxxxxxxxxxxxxx 

Other related posts: