IP Address or Host name on the email header

[mejiaks]

Recently we faced an issue of somebody impersonating another users and sending emails using their accounts.

We tried to investigate using the email header and we found out that when coming from outside the header includes this info, but when is internal communication, the exchange doesn't include any info regarding the computer name or ip address.

is there any built in way to include the host name or ip address using exchange?

if not, is there any third party tool to achieve this? i remember once i use Visnetic mail server and this email server did include the ip address and other stuff.

However i have been trying to find some way to do this with exchange

TIA

 

[Zelandakh]

If it is coming from the outside then you are accepting emails for your own domain - change that.
If it is coming from inside then you have Exchange misconfigured - change that.

 

[58sniper]

And if it's the first one, see

http://exchangepedia.com/2008/09/how-to-prevent-annoying-spam-from-your-own-domain.html

Do you have your Tek-Tips.com Swag? I've got mine!

Stop by the new Tek-Tips group at LinkedIn.

 

[ShackDaddy]

I think you guys are missing the question:

What if someone knows the sender's creds? How do you pinpoint the computer from which the email was sent, if that user used Outlook or OWA? If it was OWA, you can look in the IIS logs and find the session and the IP address that it originated from, but if it was a MAPI client, there is no easy way to establish which computer was used without examining each workstation for profile debris that may have been left behind.

The OP seems to be asking if there is an an add-on that can be used to add additional information about the internal originating IP to the header.

Dave Shackelford
ThirdTier.net
TrainSignal.com

 

[Zelandakh]

Not in front of Exchange at the moment, does MTL show the client IP?

 

[ShackDaddy]

Nope, for MAPI submissions it only shows the IP of the CAS if 2010 or the MBX if 2007.

Dave Shackelford
ThirdTier.net
TrainSignal.com

 

[mejiaks]

ShackDaddy

you understood perfeclty, thnaks for the clarification