Solved

Exchnage 2003 - identify IP address of sender using logs

Posted on 2013-11-13
5
394 Views
Last Modified: 2013-11-14
Dear Experts,

I have an exchange 2003 server (SBS2003) based in the UK.  A user 'Bob' went on a business trip to the USA. Whilst he was there, he sent an email to a client.

His laptop has Outlook with an RPC over HTTPS connection to his mailbox on the SBS.

Recently i have been asked to produce evidence that this email was sent whilst he was in the USA. So I figued the IIS logs or exchange logs might show the IP address that the mail communication was started from.

Bob cant remember if he sent the email using OWA or via Outlook.

Is it possible that exchange or IIS logs will record a trace of IP addresses that were used during the mail conversation?  I'm looking for an IP address that will would be designated as a USA IP address - if you get my meaning.

Thanks in advance.
0
Comment
Question by:tech53
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
5 Comments
 
LVL 9

Assisted Solution

by:Ahmed786
Ahmed786 earned 250 total points
ID: 39644317
W3C extended logging if it is enabled and If mail was send using OWA yes you can track the IP address by scanning IIS logs.


Below is one of the tool as mentioned "LogParser Utility" to scan the IIS logs and trace the IP address



http://www.msexchange.org/articles-tutorials/exchange-server-2003/tools/Using-Logparser-Utility-Analyze-ExchangeIIS-Logs.html
0
 
LVL 63

Expert Comment

by:Simon Butler (Sembee)
ID: 39644538
Both OWA and Outlook Anywhere will show in the IIS logs. However it depends whether you were logging the correct information. If you were not then it cannot be proven.

Simon.
0
 
LVL 1

Author Comment

by:tech53
ID: 39646627
I found an entry as below:

2013-03-18 01:52:38 W3SVC1 192.168.16.2 POST /Microsoft-Server-ActiveSync User=bob&DeviceId=ApplXXXX123XXXX&DeviceType=iPhone&Cmd=Sync&Log=V4TEmSSC:0A0C0D0FS:0A0C0D8SP:1C4I223944S446320R0S0L0H0P 443 bob 123.123.123.123 Apple-iPhone5C2/1002.146 200 0 0      

What does this tell me?  It is confirmation that bob's mailbox was accessed from an IP address (which I masked) of 123.123.123.123 on an iPhone.  I have confirmed that the IP address from the USA. But it doesn't really say that an email was sent.

I don't suppose theres a way to find that out?
The email in question is still in his sent items.  Can I tell from that?

Thanks
0
 
LVL 63

Accepted Solution

by:
Simon Butler (Sembee) earned 250 total points
ID: 39647300
You will be unable to get anything from the IIS logs to say that an email was sent, because both Outlook Anywhere (RPC over HTTPS) and ActiveSync use HTTPS as a tunnel, the individual traffic is not identified.
From Exchange, the only option is message, tracking, if it was enabled. That will prove if the message was sent. Other than that, the most you can prove is a connection was made, not what was done with the connection.

Simon.
0
 
LVL 1

Author Closing Comment

by:tech53
ID: 39649917
Thanks folks.  Didn't have advanced logging turned on so cant prove that the email was sent.

However, I was able to show from the logs that the mailbox was accessed from the USA IP using an iphone and, at the same time, the message headers showed that the email was sent using an iphone.  More than a coincidence and this would suggest an alignment of the two events.

Thanks again for your help.
0

Featured Post

Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Find out what you should include to make the best professional email signature for your organization.
A list of top three free exchange EDB viewers that helps the user to extract a mailbox from an unmounted .edb file and get a clear preview of all emails & other items with just a single click on mailboxes.
In this video we show how to create a Contact in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >> Contact ta…
This video demonstrates how to sync Microsoft Exchange Public Folders with smartphones using CodeTwo Exchange Sync and Exchange ActiveSync. To learn more about CodeTwo Exchange Sync and download the free trial, go to: http://www.codetwo.com/excha…

691 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question