Trackdown user

[igolo]

I trying to track down a user who is logging on as different user to send anonymous messages.
Scenerio:
I have a domain user account that about 15 people know the password to. someone logged on using this account and sent a message to someone in a different department. because of the content of the message I'm 100% certain that it's an internal user; not someone spoofing.
Is there a way to track down what computer (IP address) was used to log on as this user?
The incident happened a couple of days ago so I'm hoping I still track down the user. I'm using exchange server 2003.

 

[PcLinuxGuru]

Unless your auditing the account I suspect no. IF you are audting (auditing the accounts login/logout) it is normally stored in the DC Event Viewer under Security.

 

[igolo]

Thanks I checked but the log stops at the Dec 19 and it happened on the 18th. But now i where to go.

 

[pansophic]

Was it a Windows Message, or something else like IM or email? You may have an opportunity to look through the server application logs for an address.

You may also want to start backing up the security event logs. If it happened once and they got away with it, it will likely happen again. At least you would be prepared for next time.


pansophic

 

[igolo]

It was sent through our exchange server.
I'm backing up the logs now.

 

[pansophic]

Did you look at the Exchange log for the message ID? You can get the message ID out of the mail header at the recepient.

The following have info on setting up and using Exchange logs:

http://www.computerperformance.co.uk/exchange2003/exchange2003_logs_SMTP.htm#Finding the Log Output

http://www.msexchange.org/tutorials/Logging_the_SMTP_Service.html

pansophic

 

[igolo]

i checked the log files however they aren't taking anywhere. It looks like the person that did this stripped out the headers.

 

[pansophic]

Did you check the mail header on the received email? It should have the source IP address in the header, and there shouldn't be any way for the sender to have stripped them.


pansophic

 

[igolo]

When I click on options nothing is displayed under Internet options and when I clic on properties all i get is message ID.
I starting to think the person created a text message and sent it SQL server. If the message was sent via an application like SQL mail would it still have all the header info?

 

[pansophic]

If it is truly an email message, then there will always be mail headers.

Try following these instructions on the original message. The forwarded message will have different headers.

http://www.ilisys.com.au/support/s_email/view-outlook-headers/

I hate that Outlook tries to hide the headers.

SQL wouldn't know what to do with the message, but it could possibly pass the message to the Exchange server, but then the mail headers would just show the SQL server as the source of the message.


pansophic