Go Premium for a chance to win a PS4. Enter to Win

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 288
  • Last Modified:

Wich user sent a e-mail from a shared account in MS Outlook 07 using MAPI in Exchange Server

Hi,

We need to know the user who sent us a message from a shared exchange account :
 
TESTE (test@xpto.com) is the account name of our team member mail account. There are 20 people that have access to it and can send e-mails from it. When someone receive a mail from this team mail account, the sender´s identification name is always from "TESTE <test@xpto.com>", but as the sender´s usually signs at the end of the message the name, no big deal. The problem is when the sender (user) intentionally don´t sign the message, and the recipient  can´t know who sent it (there are 20 possibilities).  

As all of the 20 people that could send messages from test@xpto.com have to authenticate to mapi, maybe it will be possible to check which user sent it on some logs....we just need to know who was the user.

Below is the e-mail header we received from the unknow user (we got it from MS Outlook message proprieties):

Received: from SDC1RI00EVS03.xpto.local ([fe80::39cb:6a9d:fbef:aee3]) by
 SDC1RI00ECH01.xpto.local ([110.12.0.101]) with mapi; Mon, 14 Mar 2011 15:02:07
 +0000
Content-Type: application/ms-tnef; name="winmail.dat"
Content-Transfer-Encoding: binary
From: TESTE <test@xpto.com>
To: Salgado <salgado@xpto.com>
CC: Gois <gois@xpto.com>
Disposition-Notification-To: TESTE <test@xpto.com>
Date: Mon, 14 Mar 2011 15:03:03 +0000
Subject: test
Thread-Topic: test
Thread-Index: AcviWOqrGR28Z5FDQ/yXEUbBrHnagw==
Message-ID: <51CD5B63E71D6249A3A72237A954E84982DA8981B8@SDC1RI00EVS03.xpto.local>
Accept-Language: xx
Content-Language: xx
X-MS-Has-Attach:
X-MS-Exchange-Organization-SCL: -1
X-MS-TNEF-Correlator: <51CD5B63E71D6249A3A72237A954E84982DA8981B8@SDC1RI00EVS03.xpto.local>
MIME-Version: 1.0

thaks for your interest,  
0
Gr3mling
Asked:
Gr3mling
  • 3
  • 3
1 Solution
 
NavdeepCommented:
What is version of your exchange server?
0
 
Gr3mlingAuthor Commented:
I think it allready is Exchange 2010, but not short. If not, it will be 2007.

I appreciate if you could give the solution for both versions, if possible.

Thanks,
0
 
NavdeepCommented:
There is no natively logging for mapi sessions. The only way i can think of is if the email is sent via owa and on CAS server you have NCSA logging enabled for IIS server. That can record the client IP again it will only give you the client IP but not the actual user.
0
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

 
Gr3mlingAuthor Commented:
We will try that!

I was thinking that if we have the MAPI Message ID "Message-ID: <51CD5B63E71D6249A3A72237A954E84982DA8981B8@SDC1RI00EVS03.xpto.local>" and the sender user still to have it in is inbox folder,we could seek on the server database in wich user account  the message is...ist that possible?
0
 
Gr3mlingAuthor Commented:
Sorry, I wanna say "iuser still to have it in his sent items folder".   In MS Outlook 07, when we send a mail from a secondary exchange account (as test@xpto.com) the mail stays on the "sent items" of primary account (usually the personal one).

0
 
NavdeepCommented:
That would be manually checking each one sent items folder and what if the message is hard deleted
0

Featured Post

Efficient way to get backups off site to Azure

This user guide provides instructions on how to deploy and configure both a StoneFly Scale Out NAS Enterprise Cloud Drive virtual machine and Veeam Cloud Connect in the Microsoft Azure Cloud.

  • 3
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now