Stupid question... did you unplug the user's PC? >>> "Kelsey, John" <jckel...@drmc.org> 7/19/2011 7:21 AM >>> We have an internal authenticated user who is sending out a boatload of spam messages. I've disabled his account for the moment to stop the mail flow. Whats the best way to determine where on the LAN these emails are being generated from? I was thinking of loading Wireshark on the Exchange server, but not sure if that is the best place to start.
I see all of the messages in the message tracking center (exchange 2003), but doesn't tell me where the message was originated from. Thanks all ************************************* John C. Kelsey DuBois Regional Medical Center *: 814.375.3073 * : 814.375.4005 *: jckel...@drmc.org<mailto:jckel...@drmc.org> ************************************* This email and any attached files are confidential and intended solely for the intended recipient(s). If you are not the named recipient you should not read, distribute, copy or alter this email. Any views or opinions expressed in this email are those of the author and do not represent those of the company. Warning: Although precautions have been taken to make sure no viruses are present in this email, the company cannot accept responsibility for any loss or damage that arise from the use of this email or attachments. --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist
