[Last Call] Learn how to a build a cloud-first strategyRegister Now

  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1275
  • Last Modified:

Message Tracking in Systems Manager

  I have SBS2003 network with several PCs with Outlook 2003 and Outlook 2010.
  One user complained that she received two emails from 'John' (on the same network) about one or two hours later than actual sent time.
  So I opened Message Tracking in System Manager. First, I selected the user 'John' and entered her name. When I clicked "Find Now", it showed NOTHING.
 So I removed "Recipients" and ran it again. Then it showed only 11 emails (please see screenshot). As seen above, when I looked at John's Outlook SENT folder, there are more than 11 emails. Those emails with blue arrows in his Outlook do match those in Message Tracking Center.
With that I have two questions.
(1) When I entered 'John' as Sender and her user name in Recipients, why no email was found in Message Tracking Center even though there were at least two emails sent to her as evidenced in his SENT folder.
(2) When I entered 'John' as Sender and leave Recipients blank, then it shows 11 emails, but there are more than 11 emails in the SENT folder in his Outlook.
  • 3
  • 3
1 Solution
Sanga CollinsSystems AdminCommented:
Is it possible you have someone masquerading as John?

In the emails recieved, try and view the headers to see more details about who actually sent the message and what path it followed to get to the users inbox. Here is an example of a header for an email I received, that did not actual come from the address in question.

Return-Path: <americanexpress@welcome.aexp.com>
Received: from static-mum-X.X.X.X.mtnl.net.in (static-mum-X.X.X.X.mtnl.net.in [X.X.X.X]) by maila.webcenter.com with SMTP;
   Fri, 15 Aug 2014 07:10:46 -0700
Received: from 2857.MYDOMAIN.COM ( by MYDOMAIN.COM ( with Microsoft SMTP Server id 0GGRHG1A; Fri, 15 Aug 2014 19:45:11 +0530
Date: Fri, 15 Aug 2014 19:45:11 +0530
From: "Local Scan" <scan.497@MYDOMAIN.COM>
X-MS-Has-Attach: yes
X-MS-Exchange-Organization-SCL: -1
X-MS-TNEF-Correlator: <SEV6T7HS1DW671EHBT85O78Z12742EC08K1Z23@MYDOMAIN.COM>
X-MS-Exchange-Organization-AuthSource: 1BIV6U33EV3JUI0@MYDOMAIN.COM
X-MS-Exchange-Organization-AuthAs: Internal
X-MS-Exchange-Organization-AuthMechanism: 04
X-MS-Exchange-Organization-AVStamp-Mailbox: MSFTFF;2;0;0 0 0
X-Priority: 3 (Normal)
To: shannon.t@MYDOMAIN.COM
Subject: Scanned Image from a Xerox WorkCentre
MIME-Version: 1.0
Content-Type: multipart/mixed;
X-Rcpt-To: <sanga.c@MYDOMAIN.COM>
X-SmarterMail-Spam: Commtouch 35 [value: Confirmed], SPF_Fail, DK_None, DKIM_None, Barracuda BRBL
X-CTCH-RefId: str=0001.0A010207.53EE150C.0041,ss=3,re=0.000,recu=0.000,reip=0.000,pt=R_391629,cl=4,cld=1,fgs=0
X-SmarterMail-TotalSpamWeight: 0 (Trusted Sender - Domain)

Open in new window

sgleeAuthor Commented:
This is an email communication between two users on the same network.
I do not believe we need to worry about "someone masquerading as John".
I am simply questioning the functionality of Systems Manager Message Tracking.
It only showed a limited number of emails instead of all that he sent out that day and I like to know whether Message Tracking show have displayed  ALL the messages or it is typical that not all messages are displayed.
Sanga CollinsSystems AdminCommented:
Message tracking will show all messages sent out that day if the messages went through the exchange server.

That is why looking at email headers helps shed more light on the issue. whether someone is masquerading or not, it would at least give you a clearer picture of what happened.
Creating Active Directory Users from a Text File

If your organization has a need to mass-create AD user accounts, watch this video to see how its done without the need for scripting or other unnecessary complexities.

sgleeAuthor Commented:
Outlook ProfileI forgot to mention this: They are not using exchange server to send/receive emails.
Each user's Outlook has two accounts: Exchange mailbox and POP account. Every minute, POP account retrieves new emails from POP server. At this point, Exchange is being used to store Outlook data on the server.
As seen in the screenshot, since Exchange is Default account, I thought every email that is sent from this computer would show up in Message Tracking.
Is it not?
Sanga CollinsSystems AdminCommented:
i see what you are saying.

Only brand new messages will showing up in message tracking center. If the user is responding to a message that was downloaded via POP3, then the response will go out via the same POP3 service unless the user specifically choose to send using their exchange account.

This would explain some messages not showing up in sent items properly as well.
sgleeAuthor Commented:
" If the user is responding to a message that was downloaded via POP3, then the response will go out via the same POP3 service " --->
That makes perfect sense and it explains why some messages in SENT folder in Outlook were not showing up in Message Tracking.

Thanks for your help and I appreciate it.

Featured Post

Upgrade your Question Security!

Add Premium security features to your question to ensure its privacy or anonymity. Learn more about your ability to control Question Security today.

  • 3
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now