Solved

How to find what IP a user is accessing Exchange from remotly?

Posted on 2014-11-05
7
40 Views
Last Modified: 2015-01-26
I have a user that has left the company, but due to an employee contract he has e-mail access until the end of the year. The problem is that whatever computer he is using is probably infected with some kind of botnet.

Every night his e-mail sends out about 30 e-mails in German with trojan attachments. GFI has blocked all of these e-mails, but since I have no access to the computer he may be using at his new job, I cannot ensure those computers are clean. I need to find out what IP this is coming from. Is there a way to do this? If I find out it is the IP of his new company, I can shut down access until that computer has been cleaned.
0
Comment
Question by:j_crow1
  • 4
  • 3
7 Comments
 
LVL 19

Expert Comment

by:Adam Farage
ID: 40424476
You should be able to find the source of the email in the message tracking logs:

Get-TransportServer | Get-MessageTrackingLog -MessageSubject "enter Trojan message subject here" | Select Timestamp, {$_.Recipients}, Sender, SenderIP, ClientHostname | Export-CSV C:\Log.csv

Open in new window


From there make the table in Excel, and then search for the client IP that is not an Exchange server.
0
 

Author Comment

by:j_crow1
ID: 40424523
It is not displaying an IP address, but it does display a client host name...how accurate is this?
0
 
LVL 19

Expert Comment

by:Adam Farage
ID: 40424583
The ClientHostname should be accurate, but I am surprised you are not getting a client address. Most likely coming from someones mailbox or an open relay.

Do you see the sender address and can you log into that mailbox?
0
Do email signature updates give you a headache?

Do you feel like all of your time is spent managing email signatures? Too busy to visit every user’s desk to make updates? Want high-quality HTML signatures on all devices, including on mobiles and Macs? Then, let Exclaimer solve all your email signature problems today!

 

Author Comment

by:j_crow1
ID: 40424635
Yes, but those items are not in his sent folder. I do not have an open relay...where else should I check for where this could be coming from?
0
 
LVL 19

Accepted Solution

by:
Adam Farage earned 500 total points
ID: 40424754
Its most likely his mailbox, but using a raw MAPI connection on his machine.

Try disabling MAPI connectivity to the mailbox and see if that works for you (Set-CASMailbox username@company.com -MapiEnabled:$FALSE)

It will disable his outlook access (along with any other MAPI access) but it should help figure out if it his client machine or not.
0
 

Author Comment

by:j_crow1
ID: 40424870
I will try that tonight and see if those e-mails get sent out.
0
 
LVL 19

Expert Comment

by:Adam Farage
ID: 40426302
Any luck?
0

Featured Post

Shouldn't all users have the same email signature?

You wouldn't let your users design their own business cards, would you? So, why do you let them design their own email signatures? Think of the damage they could be doing to your brand reputation! Choose the easy way to manage set up and add email signatures for all users.

Join & Write a Comment

This article explains in simple steps how to renew expiring Exchange Server Internal Transport Certificate.
Learn to move / copy / export exchange contacts to iPhone without using any software. Also see the issues in configuration of exchange with iPhone to migrate contacts.
In this video we show how to create a Contact in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >> Contact ta…
In this video we show how to create a mailbox database in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Servers >> Data…

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now