Message Tracking in Systems Manager

  I have SBS2003 network with several PCs with Outlook 2003 and Outlook 2010.
  One user complained that she received two emails from 'John' (on the same network) about one or two hours later than actual sent time.
  So I opened Message Tracking in System Manager. First, I selected the user 'John' and entered her name. When I clicked "Find Now", it showed NOTHING.
 So I removed "Recipients" and ran it again. Then it showed only 11 emails (please see screenshot). As seen above, when I looked at John's Outlook SENT folder, there are more than 11 emails. Those emails with blue arrows in his Outlook do match those in Message Tracking Center.
With that I have two questions.
(1) When I entered 'John' as Sender and her user name in Recipients, why no email was found in Message Tracking Center even though there were at least two emails sent to her as evidenced in his SENT folder.
(2) When I entered 'John' as Sender and leave Recipients blank, then it shows 11 emails, but there are more than 11 emails in the SENT folder in his Outlook.
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Sanga CollinsSystems AdminCommented:
Is it possible you have someone masquerading as John?

In the emails recieved, try and view the headers to see more details about who actually sent the message and what path it followed to get to the users inbox. Here is an example of a header for an email I received, that did not actual come from the address in question.

Return-Path: <>
Received: from ( [X.X.X.X]) by with SMTP;
   Fri, 15 Aug 2014 07:10:46 -0700
Received: from 2857.MYDOMAIN.COM ( by MYDOMAIN.COM ( with Microsoft SMTP Server id 0GGRHG1A; Fri, 15 Aug 2014 19:45:11 +0530
Date: Fri, 15 Aug 2014 19:45:11 +0530
From: "Local Scan" <scan.497@MYDOMAIN.COM>
X-MS-Has-Attach: yes
X-MS-Exchange-Organization-SCL: -1
X-MS-TNEF-Correlator: <SEV6T7HS1DW671EHBT85O78Z12742EC08K1Z23@MYDOMAIN.COM>
X-MS-Exchange-Organization-AuthSource: 1BIV6U33EV3JUI0@MYDOMAIN.COM
X-MS-Exchange-Organization-AuthAs: Internal
X-MS-Exchange-Organization-AuthMechanism: 04
X-MS-Exchange-Organization-AVStamp-Mailbox: MSFTFF;2;0;0 0 0
X-Priority: 3 (Normal)
To: shannon.t@MYDOMAIN.COM
Subject: Scanned Image from a Xerox WorkCentre
MIME-Version: 1.0
Content-Type: multipart/mixed;
X-Rcpt-To: <sanga.c@MYDOMAIN.COM>
X-SmarterMail-Spam: Commtouch 35 [value: Confirmed], SPF_Fail, DK_None, DKIM_None, Barracuda BRBL
X-CTCH-RefId: str=0001.0A010207.53EE150C.0041,ss=3,re=0.000,recu=0.000,reip=0.000,pt=R_391629,cl=4,cld=1,fgs=0
X-SmarterMail-TotalSpamWeight: 0 (Trusted Sender - Domain)

Open in new window

sgleeAuthor Commented:
This is an email communication between two users on the same network.
I do not believe we need to worry about "someone masquerading as John".
I am simply questioning the functionality of Systems Manager Message Tracking.
It only showed a limited number of emails instead of all that he sent out that day and I like to know whether Message Tracking show have displayed  ALL the messages or it is typical that not all messages are displayed.
Sanga CollinsSystems AdminCommented:
Message tracking will show all messages sent out that day if the messages went through the exchange server.

That is why looking at email headers helps shed more light on the issue. whether someone is masquerading or not, it would at least give you a clearer picture of what happened.
Ultimate Tool Kit for Technology Solution Provider

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy now.

sgleeAuthor Commented:
Outlook ProfileI forgot to mention this: They are not using exchange server to send/receive emails.
Each user's Outlook has two accounts: Exchange mailbox and POP account. Every minute, POP account retrieves new emails from POP server. At this point, Exchange is being used to store Outlook data on the server.
As seen in the screenshot, since Exchange is Default account, I thought every email that is sent from this computer would show up in Message Tracking.
Is it not?
Sanga CollinsSystems AdminCommented:
i see what you are saying.

Only brand new messages will showing up in message tracking center. If the user is responding to a message that was downloaded via POP3, then the response will go out via the same POP3 service unless the user specifically choose to send using their exchange account.

This would explain some messages not showing up in sent items properly as well.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
sgleeAuthor Commented:
" If the user is responding to a message that was downloaded via POP3, then the response will go out via the same POP3 service " --->
That makes perfect sense and it explains why some messages in SENT folder in Outlook were not showing up in Message Tracking.

Thanks for your help and I appreciate it.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.