Exchnage 2003 - identify IP address of sender using logs
Posted on 2013-11-13
I have an exchange 2003 server (SBS2003) based in the UK. A user 'Bob' went on a business trip to the USA. Whilst he was there, he sent an email to a client.
His laptop has Outlook with an RPC over HTTPS connection to his mailbox on the SBS.
Recently i have been asked to produce evidence that this email was sent whilst he was in the USA. So I figued the IIS logs or exchange logs might show the IP address that the mail communication was started from.
Bob cant remember if he sent the email using OWA or via Outlook.
Is it possible that exchange or IIS logs will record a trace of IP addresses that were used during the mail conversation? I'm looking for an IP address that will would be designated as a USA IP address - if you get my meaning.
Thanks in advance.