Storedriver And the mail in the message header only shows our external IP address as is expected.
From: Campbell, Rob [mailto:rob_campb...@centraltechnology.net] Sent: 29 September 2010 15:21 To: MS-Exchange Admin Issues Subject: RE: Exchange 2007 Message tracking - find the source machine. In the message tracking, what is the source of the first RECEIVE event for this message? Is it STOREDRIVER or SMTP? From: Fergal O'Connell [mailto:foconn...@curamsoftware.com] Sent: Wednesday, September 29, 2010 8:38 AM To: MS-Exchange Admin Issues Subject: Exchange 2007 Message tracking - find the source machine. Hi, We have a user who said that an email was sent from his account to another external user. The email looks to be some sort of virus however it's only 1 email. The user claims he never sent the email- however there is not nothing in his sent items. Using message tracking I can see the email that was sent. Is there a way to find out what PC this email was sent from? I need to gather more information about how and why this email was sent from this account? Exchange 2007 Sp1 relaying email through an Ironport device. Regards Fergal O'Connell The information in this email is confidential and may be legally privileged. It is intended solely for the addressee. Access to this email by anyone else is unauthorized. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful. If you are not the intended addressee please contact the sender and dispose of this e-mail. Thank you. --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com<mailto:listmana...@lyris.sunbeltsoftware.com> with the body: unsubscribe exchangelist ************************************************************************************************** Note: The information contained in this message may be privileged and confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by replying to the message and deleting it from your computer. ************************************************************************************************** --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com<mailto:listmana...@lyris.sunbeltsoftware.com> with the body: unsubscribe exchangelist The information in this email is confidential and may be legally privileged. It is intended solely for the addressee. Access to this email by anyone else is unauthorized. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful. If you are not the intended addressee please contact the sender and dispose of this e-mail. Thank you. --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist
