Message Tracking in Systems Manager

Posted on 2014-08-12
Last Modified: 2014-08-28
  I have SBS2003 network with several PCs with Outlook 2003 and Outlook 2010.
  One user complained that she received two emails from 'John' (on the same network) about one or two hours later than actual sent time.
  So I opened Message Tracking in System Manager. First, I selected the user 'John' and entered her name. When I clicked "Find Now", it showed NOTHING.
 So I removed "Recipients" and ran it again. Then it showed only 11 emails (please see screenshot). As seen above, when I looked at John's Outlook SENT folder, there are more than 11 emails. Those emails with blue arrows in his Outlook do match those in Message Tracking Center.
With that I have two questions.
(1) When I entered 'John' as Sender and her user name in Recipients, why no email was found in Message Tracking Center even though there were at least two emails sent to her as evidenced in his SENT folder.
(2) When I entered 'John' as Sender and leave Recipients blank, then it shows 11 emails, but there are more than 11 emails in the SENT folder in his Outlook.
Question by:sglee
    LVL 18

    Expert Comment

    by:Sanga Collins
    Is it possible you have someone masquerading as John?

    In the emails recieved, try and view the headers to see more details about who actually sent the message and what path it followed to get to the users inbox. Here is an example of a header for an email I received, that did not actual come from the address in question.

    Return-Path: <>
    Received: from ( [X.X.X.X]) by with SMTP;
       Fri, 15 Aug 2014 07:10:46 -0700
    Received: from 2857.MYDOMAIN.COM ( by MYDOMAIN.COM ( with Microsoft SMTP Server id 0GGRHG1A; Fri, 15 Aug 2014 19:45:11 +0530
    Date: Fri, 15 Aug 2014 19:45:11 +0530
    From: "Local Scan" <scan.497@MYDOMAIN.COM>
    X-MS-Has-Attach: yes
    X-MS-Exchange-Organization-SCL: -1
    X-MS-TNEF-Correlator: <SEV6T7HS1DW671EHBT85O78Z12742EC08K1Z23@MYDOMAIN.COM>
    X-MS-Exchange-Organization-AuthSource: 1BIV6U33EV3JUI0@MYDOMAIN.COM
    X-MS-Exchange-Organization-AuthAs: Internal
    X-MS-Exchange-Organization-AuthMechanism: 04
    X-MS-Exchange-Organization-AVStamp-Mailbox: MSFTFF;2;0;0 0 0
    X-Priority: 3 (Normal)
    To: shannon.t@MYDOMAIN.COM
    Subject: Scanned Image from a Xerox WorkCentre
    MIME-Version: 1.0
    Content-Type: multipart/mixed;
    X-Rcpt-To: <sanga.c@MYDOMAIN.COM>
    X-SmarterMail-Spam: Commtouch 35 [value: Confirmed], SPF_Fail, DK_None, DKIM_None, Barracuda BRBL
    X-CTCH-RefId: str=0001.0A010207.53EE150C.0041,ss=3,re=0.000,recu=0.000,reip=0.000,pt=R_391629,cl=4,cld=1,fgs=0
    X-SmarterMail-TotalSpamWeight: 0 (Trusted Sender - Domain)

    Open in new window


    Author Comment

    This is an email communication between two users on the same network.
    I do not believe we need to worry about "someone masquerading as John".
    I am simply questioning the functionality of Systems Manager Message Tracking.
    It only showed a limited number of emails instead of all that he sent out that day and I like to know whether Message Tracking show have displayed  ALL the messages or it is typical that not all messages are displayed.
    LVL 18

    Expert Comment

    by:Sanga Collins
    Message tracking will show all messages sent out that day if the messages went through the exchange server.

    That is why looking at email headers helps shed more light on the issue. whether someone is masquerading or not, it would at least give you a clearer picture of what happened.

    Author Comment

    Outlook ProfileI forgot to mention this: They are not using exchange server to send/receive emails.
    Each user's Outlook has two accounts: Exchange mailbox and POP account. Every minute, POP account retrieves new emails from POP server. At this point, Exchange is being used to store Outlook data on the server.
    As seen in the screenshot, since Exchange is Default account, I thought every email that is sent from this computer would show up in Message Tracking.
    Is it not?
    LVL 18

    Accepted Solution

    i see what you are saying.

    Only brand new messages will showing up in message tracking center. If the user is responding to a message that was downloaded via POP3, then the response will go out via the same POP3 service unless the user specifically choose to send using their exchange account.

    This would explain some messages not showing up in sent items properly as well.

    Author Comment

    " If the user is responding to a message that was downloaded via POP3, then the response will go out via the same POP3 service " --->
    That makes perfect sense and it explains why some messages in SENT folder in Outlook were not showing up in Message Tracking.

    Thanks for your help and I appreciate it.

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    How your wiki can always stay up-to-date

    Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
    - Increase transparency
    - Onboard new hires faster
    - Access from mobile/offline

    Email statistics and Mailbox database quotas You might have an interest in attaining information such as mailbox details, mailbox statistics and mailbox database details from Exchange server. At that point, knowing how to retrieve this information …
    Use email signature images to promote corporate certifications and industry awards.
    In this video we show how to create an email address policy in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.:  First we need to log into the Exchange Admin Center. Navigate to the Mail Flow…
    To show how to generate a certificate request in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.:  First we need to log into the Exchange Admin Center. Navigate to the Servers >> Certificates…

    779 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    12 Experts available now in Live!

    Get 1:1 Help Now