Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

Exchnage 2003 - identify IP address of sender using logs

Posted on 2013-11-13
5
Medium Priority
?
399 Views
Last Modified: 2013-11-14
Dear Experts,

I have an exchange 2003 server (SBS2003) based in the UK.  A user 'Bob' went on a business trip to the USA. Whilst he was there, he sent an email to a client.

His laptop has Outlook with an RPC over HTTPS connection to his mailbox on the SBS.

Recently i have been asked to produce evidence that this email was sent whilst he was in the USA. So I figued the IIS logs or exchange logs might show the IP address that the mail communication was started from.

Bob cant remember if he sent the email using OWA or via Outlook.

Is it possible that exchange or IIS logs will record a trace of IP addresses that were used during the mail conversation?  I'm looking for an IP address that will would be designated as a USA IP address - if you get my meaning.

Thanks in advance.
0
Comment
Question by:tech53
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
5 Comments
 
LVL 9

Assisted Solution

by:Ahmed786
Ahmed786 earned 1000 total points
ID: 39644317
W3C extended logging if it is enabled and If mail was send using OWA yes you can track the IP address by scanning IIS logs.


Below is one of the tool as mentioned "LogParser Utility" to scan the IIS logs and trace the IP address



http://www.msexchange.org/articles-tutorials/exchange-server-2003/tools/Using-Logparser-Utility-Analyze-ExchangeIIS-Logs.html
0
 
LVL 63

Expert Comment

by:Simon Butler (Sembee)
ID: 39644538
Both OWA and Outlook Anywhere will show in the IIS logs. However it depends whether you were logging the correct information. If you were not then it cannot be proven.

Simon.
0
 
LVL 1

Author Comment

by:tech53
ID: 39646627
I found an entry as below:

2013-03-18 01:52:38 W3SVC1 192.168.16.2 POST /Microsoft-Server-ActiveSync User=bob&DeviceId=ApplXXXX123XXXX&DeviceType=iPhone&Cmd=Sync&Log=V4TEmSSC:0A0C0D0FS:0A0C0D8SP:1C4I223944S446320R0S0L0H0P 443 bob 123.123.123.123 Apple-iPhone5C2/1002.146 200 0 0      

What does this tell me?  It is confirmation that bob's mailbox was accessed from an IP address (which I masked) of 123.123.123.123 on an iPhone.  I have confirmed that the IP address from the USA. But it doesn't really say that an email was sent.

I don't suppose theres a way to find that out?
The email in question is still in his sent items.  Can I tell from that?

Thanks
0
 
LVL 63

Accepted Solution

by:
Simon Butler (Sembee) earned 1000 total points
ID: 39647300
You will be unable to get anything from the IIS logs to say that an email was sent, because both Outlook Anywhere (RPC over HTTPS) and ActiveSync use HTTPS as a tunnel, the individual traffic is not identified.
From Exchange, the only option is message, tracking, if it was enabled. That will prove if the message was sent. Other than that, the most you can prove is a connection was made, not what was done with the connection.

Simon.
0
 
LVL 1

Author Closing Comment

by:tech53
ID: 39649917
Thanks folks.  Didn't have advanced logging turned on so cant prove that the email was sent.

However, I was able to show from the logs that the mailbox was accessed from the USA IP using an iphone and, at the same time, the message headers showed that the email was sent using an iphone.  More than a coincidence and this would suggest an alignment of the two events.

Thanks again for your help.
0

Featured Post

Creating Active Directory Users from a Text File

If your organization has a need to mass-create AD user accounts, watch this video to see how its done without the need for scripting or other unnecessary complexities.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

On September 18, Experts Exchange launched the first installment of the Help Bell, a new feature for Premium Members, Team Accounts, and Qualified Experts. The Help Bell will serve as an additional tool to help teams increase question visibility.
With so many activities to perform, Exchange administrators are always busy in organizations. If everything, including Exchange Servers, Outlook clients, and Office 365 accounts work without any issues, they can sit and relax. But unfortunately, it…
In this video we show how to create an Accepted Domain in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Mail Flow >> Ac…
The basic steps you have just learned will be implemented in this video. The basic steps are shown to configure an Exchange DAG in a live working Exchange Server Environment and manage the same (Exchange Server 2010 Software is used in a Windows Ser…
Suggested Courses

636 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question