Improve company productivity with a Business Account.Sign Up

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 413
  • Last Modified:

Exchnage 2003 - identify IP address of sender using logs

Dear Experts,

I have an exchange 2003 server (SBS2003) based in the UK.  A user 'Bob' went on a business trip to the USA. Whilst he was there, he sent an email to a client.

His laptop has Outlook with an RPC over HTTPS connection to his mailbox on the SBS.

Recently i have been asked to produce evidence that this email was sent whilst he was in the USA. So I figued the IIS logs or exchange logs might show the IP address that the mail communication was started from.

Bob cant remember if he sent the email using OWA or via Outlook.

Is it possible that exchange or IIS logs will record a trace of IP addresses that were used during the mail conversation?  I'm looking for an IP address that will would be designated as a USA IP address - if you get my meaning.

Thanks in advance.
0
tech53
Asked:
tech53
  • 2
  • 2
2 Solutions
 
Ahmed786Commented:
W3C extended logging if it is enabled and If mail was send using OWA yes you can track the IP address by scanning IIS logs.


Below is one of the tool as mentioned "LogParser Utility" to scan the IIS logs and trace the IP address



http://www.msexchange.org/articles-tutorials/exchange-server-2003/tools/Using-Logparser-Utility-Analyze-ExchangeIIS-Logs.html
0
 
Simon Butler (Sembee)ConsultantCommented:
Both OWA and Outlook Anywhere will show in the IIS logs. However it depends whether you were logging the correct information. If you were not then it cannot be proven.

Simon.
0
 
tech53Author Commented:
I found an entry as below:

2013-03-18 01:52:38 W3SVC1 192.168.16.2 POST /Microsoft-Server-ActiveSync User=bob&DeviceId=ApplXXXX123XXXX&DeviceType=iPhone&Cmd=Sync&Log=V4TEmSSC:0A0C0D0FS:0A0C0D8SP:1C4I223944S446320R0S0L0H0P 443 bob 123.123.123.123 Apple-iPhone5C2/1002.146 200 0 0      

What does this tell me?  It is confirmation that bob's mailbox was accessed from an IP address (which I masked) of 123.123.123.123 on an iPhone.  I have confirmed that the IP address from the USA. But it doesn't really say that an email was sent.

I don't suppose theres a way to find that out?
The email in question is still in his sent items.  Can I tell from that?

Thanks
0
 
Simon Butler (Sembee)ConsultantCommented:
You will be unable to get anything from the IIS logs to say that an email was sent, because both Outlook Anywhere (RPC over HTTPS) and ActiveSync use HTTPS as a tunnel, the individual traffic is not identified.
From Exchange, the only option is message, tracking, if it was enabled. That will prove if the message was sent. Other than that, the most you can prove is a connection was made, not what was done with the connection.

Simon.
0
 
tech53Author Commented:
Thanks folks.  Didn't have advanced logging turned on so cant prove that the email was sent.

However, I was able to show from the logs that the mailbox was accessed from the USA IP using an iphone and, at the same time, the message headers showed that the email was sent using an iphone.  More than a coincidence and this would suggest an alignment of the two events.

Thanks again for your help.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

  • 2
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now