?
Solved

Exchnage 2003 - identify IP address of sender using logs

Posted on 2013-11-13
5
Medium Priority
?
396 Views
Last Modified: 2013-11-14
Dear Experts,

I have an exchange 2003 server (SBS2003) based in the UK.  A user 'Bob' went on a business trip to the USA. Whilst he was there, he sent an email to a client.

His laptop has Outlook with an RPC over HTTPS connection to his mailbox on the SBS.

Recently i have been asked to produce evidence that this email was sent whilst he was in the USA. So I figued the IIS logs or exchange logs might show the IP address that the mail communication was started from.

Bob cant remember if he sent the email using OWA or via Outlook.

Is it possible that exchange or IIS logs will record a trace of IP addresses that were used during the mail conversation?  I'm looking for an IP address that will would be designated as a USA IP address - if you get my meaning.

Thanks in advance.
0
Comment
Question by:tech53
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
5 Comments
 
LVL 9

Assisted Solution

by:Ahmed786
Ahmed786 earned 1000 total points
ID: 39644317
W3C extended logging if it is enabled and If mail was send using OWA yes you can track the IP address by scanning IIS logs.


Below is one of the tool as mentioned "LogParser Utility" to scan the IIS logs and trace the IP address



http://www.msexchange.org/articles-tutorials/exchange-server-2003/tools/Using-Logparser-Utility-Analyze-ExchangeIIS-Logs.html
0
 
LVL 63

Expert Comment

by:Simon Butler (Sembee)
ID: 39644538
Both OWA and Outlook Anywhere will show in the IIS logs. However it depends whether you were logging the correct information. If you were not then it cannot be proven.

Simon.
0
 
LVL 1

Author Comment

by:tech53
ID: 39646627
I found an entry as below:

2013-03-18 01:52:38 W3SVC1 192.168.16.2 POST /Microsoft-Server-ActiveSync User=bob&DeviceId=ApplXXXX123XXXX&DeviceType=iPhone&Cmd=Sync&Log=V4TEmSSC:0A0C0D0FS:0A0C0D8SP:1C4I223944S446320R0S0L0H0P 443 bob 123.123.123.123 Apple-iPhone5C2/1002.146 200 0 0      

What does this tell me?  It is confirmation that bob's mailbox was accessed from an IP address (which I masked) of 123.123.123.123 on an iPhone.  I have confirmed that the IP address from the USA. But it doesn't really say that an email was sent.

I don't suppose theres a way to find that out?
The email in question is still in his sent items.  Can I tell from that?

Thanks
0
 
LVL 63

Accepted Solution

by:
Simon Butler (Sembee) earned 1000 total points
ID: 39647300
You will be unable to get anything from the IIS logs to say that an email was sent, because both Outlook Anywhere (RPC over HTTPS) and ActiveSync use HTTPS as a tunnel, the individual traffic is not identified.
From Exchange, the only option is message, tracking, if it was enabled. That will prove if the message was sent. Other than that, the most you can prove is a connection was made, not what was done with the connection.

Simon.
0
 
LVL 1

Author Closing Comment

by:tech53
ID: 39649917
Thanks folks.  Didn't have advanced logging turned on so cant prove that the email was sent.

However, I was able to show from the logs that the mailbox was accessed from the USA IP using an iphone and, at the same time, the message headers showed that the email was sent using an iphone.  More than a coincidence and this would suggest an alignment of the two events.

Thanks again for your help.
0

Featured Post

Office 365 Training for Admins - 7 Day Trial

Learn how to provision tenants, synchronize on-premise Active Directory, implement Single Sign-On, customize Office deployment, and protect your organization with eDiscovery and DLP policies.  Only from Platform Scholar.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

A list of top three free exchange EDB viewers that helps the user to extract a mailbox from an unmounted .edb file and get a clear preview of all emails & other items with just a single click on mailboxes.
New style of hardware planning for Microsoft Exchange server.
In this video we show how to create a Resource Mailbox in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: Navigate to the Recipients >> Resources tab.: "Recipients" is our default selection …
To add imagery to an HTML email signature, you have two options available to you. You can either add a logo/image by embedding it directly into the signature or hosting it externally and linking to it. The vast majority of email clients display l…
Suggested Courses

764 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question