asked on

How to find what IP a user is accessing Exchange from remotly?

I have a user that has left the company, but due to an employee contract he has e-mail access until the end of the year. The problem is that whatever computer he is using is probably infected with some kind of botnet.

Every night his e-mail sends out about 30 e-mails in German with trojan attachments. GFI has blocked all of these e-mails, but since I have no access to the computer he may be using at his new job, I cannot ensure those computers are clean. I need to find out what IP this is coming from. Is there a way to do this? If I find out it is the IP of his new company, I can shut down access until that computer has been cleaned.

Adam Farage

You should be able to find the source of the email in the message tracking logs:

Get-TransportServer | Get-MessageTrackingLog -MessageSubject "enter Trojan message subject here" | Select Timestamp, {$_.Recipients}, Sender, SenderIP, ClientHostname | Export-CSV C:\Log.csv

Open in new window

From there make the table in Excel, and then search for the client IP that is not an Exchange server.

j_crow1

ASKER

It is not displaying an IP address, but it does display a client host name...how accurate is this?

Adam Farage

The ClientHostname should be accurate, but I am surprised you are not getting a client address. Most likely coming from someones mailbox or an open relay.

Do you see the sender address and can you log into that mailbox?

j_crow1

ASKER

Yes, but those items are not in his sent folder. I do not have an open relay...where else should I check for where this could be coming from?

ASKER CERTIFIED SOLUTION

Adam Farage

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

j_crow1

ASKER

I will try that tonight and see if those e-mails get sent out.

Adam Farage

Any luck?