Solved

Email sent from Outlook, OWA or iPhone - Exchange 2010

Posted on 2016-08-30
7
60 Views
Last Modified: 2016-09-19
Hi all,

is there any way to tell if a particular email was sent from Outlook, OWA or an iPhone.

We have a user from whose account an email was being sent but the user is denying that he sent that email. Now I need to figure out which device it went from so that we can focus on that area. iPhones are controlled through Airwatch.

Thanks.
0
Comment
Question by:Exchange User
7 Comments
 
LVL 17

Assisted Solution

by:Gaurav Singh
Gaurav Singh earned 125 total points
ID: 41776724
you can check the Email headers, that gives some information, check lime MIME type in email header
0
 
LVL 26

Expert Comment

by:pony10us
ID: 41776728
Also look at the sender's IP in the header.
0
 
LVL 3

Author Comment

by:Exchange User
ID: 41776767
I analyzed the 2 headers, one sent from my iPhone and the other from Outlook. The MIME version says 1.0 for both.

But when email is being sent from Outlook, the message ID has 'some ID'@serverFQDN.domain.local

When sending from iPhone, message ID is showing 'some ID'@domain.local

Any ideas ?
0
What Is Threat Intelligence?

Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

 
LVL 38

Accepted Solution

by:
Adam Brown earned 250 total points
ID: 41776809
The client data is contained in the message tracking log under the SourceContext variable. http://www.msexchange.org/kbase/ExchangeServerTips/ExchangeServer2013/ManagementAdministration/determine-clients-used-send-emails.html has some information on how to examine information in the tracking log. The following command is edited to show you the source data for all emails since august first:
Get-TransportService | Get-MessageTrackingLog -ResultSize Unlimited -Start 08/11/2016 -EventID SUBMIT | select sender,recipient,subject,sourcecontext

Open in new window

0
 
LVL 3

Author Comment

by:Exchange User
ID: 41776854
Get-TransportService is not recognized by Exchange 2010's EMS ?
0
 
LVL 3

Author Comment

by:Exchange User
ID: 41776987
@Adam I tried doing that with the toolbox option Tracking Log Explorer in the EMC. I have the data in front of me. Source Context here has different types of information. How do we read it ? Any ideas.
0
 
LVL 26

Assisted Solution

by:pony10us
pony10us earned 125 total points
ID: 41796821
The client type in the log created using Adam's solution should show you what you want to know.

MOMT = Outlook
OWA = Outlook Web Access
AirSync = Active Sync (usually a phone/pad/etc)

For more information you can look at:  http://markgossa.blogspot.com/2015/11/exchange-what-type-of-client-sent-email.html
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

Utilizing an array to gracefully append to a list of EmailAddresses
Outlook Free & Paid Tools
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
To add imagery to an HTML email signature, you have two options available to you. You can either add a logo/image by embedding it directly into the signature or hosting it externally and linking to it. The vast majority of email clients display l…

706 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now