Exchange 2010 Logs to find the source device that created the email.

Is there a any logs in Exchange 2010 that give me a report on a source IP for a message in question?  The reason I am asking this is because a weird email was sent by this user and he confirmed that he did not send it.

I looked at Get-MessageTracking and also used EMC tracking, but other than showing that the email was send from a certain mailbox I have not addition forensics like the source device.

I am trying to see if this came from the users Active Sync on their phone or from our system directly.

Addition findings:
I opened the sent item in the source mailbox and saw that there was information in the Internet Header.  From what I know about the Exchange servers If the Sender is on the Exchange server there should not be any information in the Internet Header.    The Header information was timestamp offset of -1000 from UTC and I know for a fact that the user is in that timezone.  He is on a iPhone connected via ActiveSync. All the recipients on the email were external.
LVL 27
yo_beeDirector of Information TechnologyAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

xtermieCommented:
In an Exchange 2007 and Exchange 2010 environment, message tracking is enabled by default on servers having the Edge Transport, Hub Transport, or Mailbox roles installed. It is important to understand the Exchange configuration before proceeding. Consequently, the first step in the process is to determine if logging was enabled on the Exchange server(s) on which the mailbox(es) of interest is (are) stored.

The locations of the log files are configurable, but by default, message tracking logs are stored in the Exchange server installation location; specifically:
C:\Program Files\Microsoft\Exchange Server\TransportRoles\ Logs\MessageTracking

The message metadata recorded in the Exchange message tracking log files include(s) several data including:
  1. The date and time of the message event.
  2. The IP address of the messaging server or client that submitted the message.
  3. The name of the messaging server or messaging client that submitted the message.
  4. The IP address of the source or destination server running Microsoft Exchange

I think #4 is what you are looking for.

You can use LogParser, which utilizes a SQL engine to query the log files and therefore has considerable power to return information about the tracking log contents to find what you exactly want.
0
yo_beeDirector of Information TechnologyAuthor Commented:
are these the same logs from Get-MessageTracking?
0
timgreen7077Exchange EngineerCommented:
I have never used this below script but it looks to be promising. I will also be trying this to see how it works. This will be nice as a tool if it works the way it shows.

http://markgossa.blogspot.com/2015/11/exchange-what-type-of-client-sent-email.html
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

yo_beeDirector of Information TechnologyAuthor Commented:
Do the script does not work I think because the SourceContext does not have the information illustrated in that blog.
I will see if I can correlate the info with a device.

Pretty cool find if it worked.
0
timgreen7077Exchange EngineerCommented:
I just tested this and it worked like a charm and it shows each client type. The client type can be a little confusing but I sent a test email from Outlook with a subject line "Outlook", OWA with a subject line "OWA", and Mobile device with a subject "ActiveSync Mobile", and the client type is as follows:

Outlook - client type is MOMT
OWA - client type is OWA
Activesync or mobile - client type is Airsync

All you have to do is copy and paste the following:

function Get-MessageClientType
    {
        $MessageTrackingLog = @($input) | ? {$_.SourceContext -match "ClientType"}
        $Output = @()
        foreach ($Message in $MessageTrackingLog)
            {
                $ClientType = $Message.SourceContext -split "," | ? {$_ -match "ClientType"}
                $ClientType = $ClientType -replace (" ClientType:","")              
                $OutputLine = New-Object System.Object
                $OutputLine | Add-Member -Type NoteProperty -Name TimeStamp -Value $Message.TimeStamp
                $OutputLine | Add-Member -Type NoteProperty -Name Sender -Value $Message.Sender
                $OutputLine | Add-Member -Type NoteProperty -Name Recipients -Value $Message.Recipients
                $OutputLine | Add-Member -Type NoteProperty -Name MessageSubject -Value $Message.MessageSubject
                $OutputLine | Add-Member -Type NoteProperty -Name ClientType -Value $ClientType
                $Output += $OutputLine
            }
        $Output
    }

that will not output anything, and you should not have any errors from this.

After that run your get-messagetrackinglog and pipe | Get-MessageClientType | ft at the end for example:

Get-MessageTrackingLog -Start 8/23/2018 -Sender tim@domain.com | Get-MessageClientType | ft

And it will output exactly the correct info about the client type. Of course you can create your message tracking log however you choose but just be sure to pipe Get-MessageClientType | ft and the output will work.
0
yo_beeDirector of Information TechnologyAuthor Commented:
My issue is that the SourceContext does not even have any of these:
Outlook - client type is MOMT
OWA - client type is OWA
Activesync or mobile - client type is Airsync
0
timgreen7077Exchange EngineerCommented:
what version of exchange are you using?
0
timgreen7077Exchange EngineerCommented:
sorry i see you are using exchange 2010.
so when you copy and paste that function do you instantly get an error or something?
0
timgreen7077Exchange EngineerCommented:
send a screenshot
0
yo_beeDirector of Information TechnologyAuthor Commented:
Blank values.

[PS] C:\WINDOWS\system32>Get-MessageTrackingLog -Start "08/22/2018 15:00:00" -End "08/22/2018 16:00:00" -Recipients "jsmith@contoso.com" | Get-MessageClientType


TimeStamp      :
Sender         :
Recipients     :
MessageSubject :
ClientType     :
0
timgreen7077Exchange EngineerCommented:
Try it with just the date and no time because it shows to be supported in exchange 2010 also. just test with a sender parameter and start and end date and see if it works.
0
yo_beeDirector of Information TechnologyAuthor Commented:
Here is what the logs have

Timestamp     : 8/22/2018 3:32:08 PM
SourceContext : 08D51B696DAF87F6

Timestamp     : 8/22/2018 3:32:08 PM
SourceContext : Transport Rule Agent

Timestamp     : 8/22/2018 3:32:08 PM
SourceContext : ContentConversion

Timestamp     : 8/22/2018 3:32:09 PM
SourceContext : 08D51B696DAF87F8;250 SmtpThread-607356-1534966329769@somehtingdomain.lan Received OK
0
timgreen7077Exchange EngineerCommented:
Well it works for me. I'm not sure how or what you are doing but if you say it doesn't work for you then ok. Other than this script, there is no other way to pull client device type. This script is golden and will be added to my tool set.

Again all i did was copy the entire function, then ran the get-messagetracking cmdlets and piped the get-clientmessagetype and it worked.
0
yo_beeDirector of Information TechnologyAuthor Commented:
The issue is not that it does not work.  It is that the SourceContext does not even contain the ClientType information at all.
0
timgreen7077Exchange EngineerCommented:
Not sure it you are running the query against the Hub server or MBX server. Try to run it against the mailbox server and see what the result would be.
0
yo_beeDirector of Information TechnologyAuthor Commented:
Ok. I will try that on Monday.
I am pretty sure it's against they Hub,Cas and not my MBX
0
timgreen7077Exchange EngineerCommented:
yep that's normally what its ran against, so yeah try running against mailbox server.
1
yo_beeDirector of Information TechnologyAuthor Commented:
So the issue I had was exactly what you send about running it against my MBX.
Now the Clienttype came back as AIRSYNC.

Thank you for the link.  
It was every helpful
0
timgreen7077Exchange EngineerCommented:
Good deal. happy that worked. that is a good little script.
0
yo_beeDirector of Information TechnologyAuthor Commented:
it really is.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Exchange

From novice to tech pro — start learning today.