Exchnage 2003 - identify IP address of sender using logs
Dear Experts,
I have an exchange 2003 server (SBS2003) based in the UK. A user 'Bob' went on a business trip to the USA. Whilst he was there, he sent an email to a client.
His laptop has Outlook with an RPC over HTTPS connection to his mailbox on the SBS.
Recently i have been asked to produce evidence that this email was sent whilst he was in the USA. So I figued the IIS logs or exchange logs might show the IP address that the mail communication was started from.
Bob cant remember if he sent the email using OWA or via Outlook.
Is it possible that exchange or IIS logs will record a trace of IP addresses that were used during the mail conversation? I'm looking for an IP address that will would be designated as a USA IP address - if you get my meaning.
Thanks in advance.
I have an exchange 2003 server (SBS2003) based in the UK. A user 'Bob' went on a business trip to the USA. Whilst he was there, he sent an email to a client.
His laptop has Outlook with an RPC over HTTPS connection to his mailbox on the SBS.
Recently i have been asked to produce evidence that this email was sent whilst he was in the USA. So I figued the IIS logs or exchange logs might show the IP address that the mail communication was started from.
Bob cant remember if he sent the email using OWA or via Outlook.
Is it possible that exchange or IIS logs will record a trace of IP addresses that were used during the mail conversation? I'm looking for an IP address that will would be designated as a USA IP address - if you get my meaning.
Thanks in advance.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
I found an entry as below:
2013-03-18 01:52:38 W3SVC1 192.168.16.2 POST /Microsoft-Server-ActiveSy
What does this tell me? It is confirmation that bob's mailbox was accessed from an IP address (which I masked) of 123.123.123.123 on an iPhone. I have confirmed that the IP address from the USA. But it doesn't really say that an email was sent.
I don't suppose theres a way to find that out?
The email in question is still in his sent items. Can I tell from that?
Thanks
2013-03-18 01:52:38 W3SVC1 192.168.16.2 POST /Microsoft-Server-ActiveSy
What does this tell me? It is confirmation that bob's mailbox was accessed from an IP address (which I masked) of 123.123.123.123 on an iPhone. I have confirmed that the IP address from the USA. But it doesn't really say that an email was sent.
I don't suppose theres a way to find that out?
The email in question is still in his sent items. Can I tell from that?
Thanks
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Thanks folks. Didn't have advanced logging turned on so cant prove that the email was sent.
However, I was able to show from the logs that the mailbox was accessed from the USA IP using an iphone and, at the same time, the message headers showed that the email was sent using an iphone. More than a coincidence and this would suggest an alignment of the two events.
Thanks again for your help.
However, I was able to show from the logs that the mailbox was accessed from the USA IP using an iphone and, at the same time, the message headers showed that the email was sent using an iphone. More than a coincidence and this would suggest an alignment of the two events.
Thanks again for your help.
Simon.