• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 334
  • Last Modified:

Email sent from Outlook, OWA or iPhone - Exchange 2010

Hi all,

is there any way to tell if a particular email was sent from Outlook, OWA or an iPhone.

We have a user from whose account an email was being sent but the user is denying that he sent that email. Now I need to figure out which device it went from so that we can focus on that area. iPhones are controlled through Airwatch.

Exchange User
Exchange User
3 Solutions
Gaurav SinghSolution ArchitectCommented:
you can check the Email headers, that gives some information, check lime MIME type in email header
Also look at the sender's IP in the header.
Exchange UserSystems AdministratorAuthor Commented:
I analyzed the 2 headers, one sent from my iPhone and the other from Outlook. The MIME version says 1.0 for both.

But when email is being sent from Outlook, the message ID has 'some ID'@serverFQDN.domain.local

When sending from iPhone, message ID is showing 'some ID'@domain.local

Any ideas ?
Easily Design & Build Your Next Website

Squarespace’s all-in-one platform gives you everything you need to express yourself creatively online, whether it is with a domain, website, or online store. Get started with your free trial today, and when ready, take 10% off your first purchase with offer code 'EXPERTS'.

Adam BrownSr Solutions ArchitectCommented:
The client data is contained in the message tracking log under the SourceContext variable. http://www.msexchange.org/kbase/ExchangeServerTips/ExchangeServer2013/ManagementAdministration/determine-clients-used-send-emails.html has some information on how to examine information in the tracking log. The following command is edited to show you the source data for all emails since august first:
Get-TransportService | Get-MessageTrackingLog -ResultSize Unlimited -Start 08/11/2016 -EventID SUBMIT | select sender,recipient,subject,sourcecontext

Open in new window

Exchange UserSystems AdministratorAuthor Commented:
Get-TransportService is not recognized by Exchange 2010's EMS ?
Exchange UserSystems AdministratorAuthor Commented:
@Adam I tried doing that with the toolbox option Tracking Log Explorer in the EMC. I have the data in front of me. Source Context here has different types of information. How do we read it ? Any ideas.
The client type in the log created using Adam's solution should show you what you want to know.

MOMT = Outlook
OWA = Outlook Web Access
AirSync = Active Sync (usually a phone/pad/etc)

For more information you can look at:  http://markgossa.blogspot.com/2015/11/exchange-what-type-of-client-sent-email.html
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now