rdefino
asked on
Need to find out from what ip an email is being sent from
We run exchange 2007 and I have a user ID that I need to find out from what system or device or ip this user is sending email from. He could be using his phone, owa or even some other client. I cannot asked the user either, all back door stuff.
Any way to do this?
Any way to do this?
ASKER
We do have journaling enabled.
So how with that do I find this info out?
So how with that do I find this info out?
Ok. You will need to setup a journaling mailbox (where the journal report will get delivered), turn on the journaling agent and lastly setup a journaling rule.
The journal report will contain the original email (sent by user being monitored) as an attachment.
MS Technet does an excelllent job of walking one through all the setup and things to consider here: http://technet.microsoft.com/en-us/library/bb124382%28v=exchg.80%29.aspx
The journal report will contain the original email (sent by user being monitored) as an attachment.
MS Technet does an excelllent job of walking one through all the setup and things to consider here: http://technet.microsoft.com/en-us/library/bb124382%28v=exchg.80%29.aspx
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
It is my understanding that Exchange 2007 supports envelope journaling. With envelope journaling, the original message that matches the journal rule is included unaltered as an attachment to the journal report. The body of a journal report contains the sender e-mail address, subject, message-ID, and recipient e-mail addresses contained within the original message.
The attached original message should contain the message and message header containing IP addresses and SMTP transport information.
http://technet.microsoft.com/en-us/library/aa998649%28v=exchg.80%29.aspx
The attached original message should contain the message and message header containing IP addresses and SMTP transport information.
http://technet.microsoft.com/en-us/library/aa998649%28v=exchg.80%29.aspx
Exchange team blog : Interception and Redirection of Messages Using Transport Rules or Journaling
http://blogs.technet.com/b/exchange/archive/2010/01/28/3409250.aspx
Attaching a copy of the original message to the journal report ensures that the original headers and properties of the message are maintained, as opposed to a message copied by transport rules where some headers will be stripped and properties transformed on delivery.
http://blogs.technet.com/b/exchange/archive/2010/01/28/3409250.aspx
Attaching a copy of the original message to the journal report ensures that the original headers and properties of the message are maintained, as opposed to a message copied by transport rules where some headers will be stripped and properties transformed on delivery.
That is correct.
However if this is an INTERNAL user then there will be no IP address in the header to show where the email address originated from.
Simon.
However if this is an INTERNAL user then there will be no IP address in the header to show where the email address originated from.
Simon.
Good point. However, correct me if I am wrong (rdefino), but I am assuming this user is not internal since you are trying to figure out how and where this person is connecting from.
ASKER
user is internal. We just need to find out what device he is sending email from.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Standard journaling - Standard journaling enables the Journaling agent in Exchange 2007 to journal all messages sent to and from recipients and senders that are located on a specific mailbox database on a computer running the Mailbox server role. Standard journaling is also called per-mailbox database journaling.
Premium journaling - Premium journaling enables the Journaling agent in Exchange 2007 to use rules that you can configure to match the specific needs of your organization. You can create journal rules for a single mailbox recipient or for entire groups within your organization. Premium journaling is also called per-recipient journaling.
You must have an Exchange Enterprise Client Access License (CAL) to use premium journaling