Solved

Exchnage 2003 - identify IP address of sender using logs

Posted on 2013-11-13
5
383 Views
Last Modified: 2013-11-14
Dear Experts,

I have an exchange 2003 server (SBS2003) based in the UK.  A user 'Bob' went on a business trip to the USA. Whilst he was there, he sent an email to a client.

His laptop has Outlook with an RPC over HTTPS connection to his mailbox on the SBS.

Recently i have been asked to produce evidence that this email was sent whilst he was in the USA. So I figued the IIS logs or exchange logs might show the IP address that the mail communication was started from.

Bob cant remember if he sent the email using OWA or via Outlook.

Is it possible that exchange or IIS logs will record a trace of IP addresses that were used during the mail conversation?  I'm looking for an IP address that will would be designated as a USA IP address - if you get my meaning.

Thanks in advance.
0
Comment
Question by:tech53
  • 2
  • 2
5 Comments
 
LVL 9

Assisted Solution

by:Ahmed786
Ahmed786 earned 250 total points
Comment Utility
W3C extended logging if it is enabled and If mail was send using OWA yes you can track the IP address by scanning IIS logs.


Below is one of the tool as mentioned "LogParser Utility" to scan the IIS logs and trace the IP address



http://www.msexchange.org/articles-tutorials/exchange-server-2003/tools/Using-Logparser-Utility-Analyze-ExchangeIIS-Logs.html
0
 
LVL 63

Expert Comment

by:Simon Butler (Sembee)
Comment Utility
Both OWA and Outlook Anywhere will show in the IIS logs. However it depends whether you were logging the correct information. If you were not then it cannot be proven.

Simon.
0
 

Author Comment

by:tech53
Comment Utility
I found an entry as below:

2013-03-18 01:52:38 W3SVC1 192.168.16.2 POST /Microsoft-Server-ActiveSync User=bob&DeviceId=ApplXXXX123XXXX&DeviceType=iPhone&Cmd=Sync&Log=V4TEmSSC:0A0C0D0FS:0A0C0D8SP:1C4I223944S446320R0S0L0H0P 443 bob 123.123.123.123 Apple-iPhone5C2/1002.146 200 0 0      

What does this tell me?  It is confirmation that bob's mailbox was accessed from an IP address (which I masked) of 123.123.123.123 on an iPhone.  I have confirmed that the IP address from the USA. But it doesn't really say that an email was sent.

I don't suppose theres a way to find that out?
The email in question is still in his sent items.  Can I tell from that?

Thanks
0
 
LVL 63

Accepted Solution

by:
Simon Butler (Sembee) earned 250 total points
Comment Utility
You will be unable to get anything from the IIS logs to say that an email was sent, because both Outlook Anywhere (RPC over HTTPS) and ActiveSync use HTTPS as a tunnel, the individual traffic is not identified.
From Exchange, the only option is message, tracking, if it was enabled. That will prove if the message was sent. Other than that, the most you can prove is a connection was made, not what was done with the connection.

Simon.
0
 

Author Closing Comment

by:tech53
Comment Utility
Thanks folks.  Didn't have advanced logging turned on so cant prove that the email was sent.

However, I was able to show from the logs that the mailbox was accessed from the USA IP using an iphone and, at the same time, the message headers showed that the email was sent using an iphone.  More than a coincidence and this would suggest an alignment of the two events.

Thanks again for your help.
0

Featured Post

Promote certifications in your email signature

Has your company recently won an award or achieved a certification? They'll no doubt want to show it off. Email signature images used to promote certifications & awards can instantly establish credibility with a recipient and provide you with numerous benefits.

Join & Write a Comment

ADCs have gained traction within the last decade, largely due to increased demand for legacy load balancing appliances to handle more advanced application delivery requirements and improve application performance.
This article explains in simple steps how to renew expiring Exchange Server Internal Transport Certificate.
In this video we show how to create a User Mailbox in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >> Mailb…
The basic steps you have just learned will be implemented in this video. The basic steps are shown to configure an Exchange DAG in a live working Exchange Server Environment and manage the same (Exchange Server 2010 Software is used in a Windows Ser…

763 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now