Trace an email - Please help !

[pancake]

I need some help tracing the originating IP address of an internal email. Someone has sent a nasty email using someone elses account. I am pretty sure if I can prove which PC it came from I can trace the culprit.

We use Exchange 2003 & Outlook 2003

The headers don't display as it is internal. Can I use the System Manager to get more information ? Or am I doomed not to find out?

Many Thanks.

 

[eyec]

look in your exchange logs

 

[CorBlimeyLimey]

Try asking in the Security, hacker detection & forensics Forum forum83

[Cheers]

 

[pancake]

Thanks both of you for your response. I ended up using event manager on my DCs to track down the login event and get the IP address of the PC.

I did catch the person responsible, and they eventually admitted it. They have been duly disciplined.

Thanks again.