diesel1218
asked on
Exchange Logon Statistics
Hi, I have a employee that swears she did not send and email out. This was an internal email and we are running exchange 2010. I have verified from her outlook it was not sent from her pc, and also message tracking in exchange doesnt show a source IP address.
I tried using Get-LogonStatistics however I am not familiar enough to know how to use this feature to track this. Can anyone suggest any options I may have to find out who internally sent this message?
I tried using Get-LogonStatistics however I am not familiar enough to know how to use this feature to track this. Can anyone suggest any options I may have to find out who internally sent this message?
She didn't send the email but it said it was sent from her mailbox? Does anyone else have permission to her mailbox?
ASKER
No one else has permission but that's why I think someone may know her password and sent it through webmail or something.
You can try these:
Get-LogonStatistics -Identity <username> | ft applicationid,logontime,cl
The Get-LogonStatistics cmdlet can be useful for doing some basic checks on client logons, but the information returned from the previous command can be a little confusing and might seem inaccurate.
For example, the ClientVersion property returned for each logon will always be reported as the same version number for end-user logons. This is due to the fact that client connections go through the Client Access role in Exchange 2010.
The ApplicationId property will indicate whether clients are connected via RPC or through Outlook Web App. Keep in mind that, depending on the client, multiple connections could be reported.
Client's applications initiate multiple connections, so you will likely notice that this cmdlet will return anywhere from three to five records for each user connected to a mailbox
Hope it will help you a bit,
*Edit*: if someone might know her password, you should try to change her password first.
Get-LogonStatistics -Identity <username> | ft applicationid,logontime,cl
The Get-LogonStatistics cmdlet can be useful for doing some basic checks on client logons, but the information returned from the previous command can be a little confusing and might seem inaccurate.
For example, the ClientVersion property returned for each logon will always be reported as the same version number for end-user logons. This is due to the fact that client connections go through the Client Access role in Exchange 2010.
The ApplicationId property will indicate whether clients are connected via RPC or through Outlook Web App. Keep in mind that, depending on the client, multiple connections could be reported.
Client's applications initiate multiple connections, so you will likely notice that this cmdlet will return anywhere from three to five records for each user connected to a mailbox
Hope it will help you a bit,
*Edit*: if someone might know her password, you should try to change her password first.
ASKER
Thank you, Is there any way to see IP info?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Thank you