Real Sender in Exchange 2010

95 pts.
Tags:
Exchange 2010
Exchange 2010 Administration
Exchange administration
Windows Server 2008
When someone gives another user the necessary permissions to send an email on behalf of him/her, for instance a manager giving his/her secretary the permissions to do so. It’s not possible to find out the identity of the real sender. We tried this scenario, but in the exchange logs we couldn’t find any trace to the real sender whether it was a MAC address, IP address or anything related. The logs would only contain the IP address of the Exchange server which in this case isn’t relevant. This is a serious issue if someone could abuse this feature, would you please advise us on how we could identify the real sender. Any related information to this would be really helpful.

Software/Hardware used:
Exchange 2010 , windows 2008
ASKED: June 7, 2011  7:11 AM
UPDATED: September 4, 2011  7:32 AM

Answer Wiki

Thanks. We'll let you know when a new response is added.
Send me notifications when members answer or reply to this question.

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy

Discuss This Question: 7  Replies

 
There was an error processing your information. Please try again later.
Thanks. We'll let you know when a new response is added.
Send me notifications when members answer or reply to this question.

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
  • Koohiisan
    I seem to recall getting emails that said "Sent by Joe on behalf of John". But, I can't recall right now how we had those users set up. I think we gave them the permissions you mentioned and added John's mailbox as an additional Exchange mailbox to Joe's account in Outlook. I never played around with it any further than that, though. But, for it to state that it was sent "on behalf" of the other user, there should have to be something in the header that can tip you off to the fact on your own.
    5,020 pointsBadges:
    report
  • Atabani
    thanks Koohiisan, this answers part of my question which is "on behalf of someone" but my other half of the problem is that as you know these days people have access to their email (exchange i am talking) through outlook, OWA, and mobile. now i would like to know the IP address of the machine/phone that was used to send the email. for some reason i can not locate it in the email header (as it always shows the exchange - server ip address) and i can not locate it from the exchange server as this information is not there, i need the ip address and/or the MAC address.
    95 pointsBadges:
    report
  • IceCubbe
    Identify who has access to send on behalf of that user?
    1,385 pointsBadges:
    report
  • Atabani
    it is more to say which machine (or phone) was used to send the email ... the only way this can be done if the MAC address is linked to the email.
    95 pointsBadges:
    report
  • Koohiisan
    Hmm...that's a tough one. The IP address used to connect to OWA/mobile would be logged in your normal web access log, but you'd have a tough time tying any of those connections to any one email.
    5,020 pointsBadges:
    report
  • Technochic
    Not only that, but don't forget if I am sitting at my house sending emails it is not going to register the IP of my specific machine as that is a private IP within my house. The IP of my house's router is the closest you will get and that can change as it is not something that is static unless you pay extra for it. I would expect the same is true of a phone IP. Lame CIS episodes that track emails to a specific address and then to the specific desk are truly laughable as the desk pc has a private IP behind the company router's IP. DOH!
    57,010 pointsBadges:
    report
  • Atabani
    After researching my issue, i still did not get my answer to my issue, does anyone know of a fix or a solution to this issue?
    95 pointsBadges:
    report

Forgot Password

No problem! Submit your e-mail address below. We'll send you an e-mail containing your password.

Your password has been sent to:

To follow this tag...

There was an error processing your information. Please try again later.

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy

Thanks! We'll email you when relevant content is added and updated.

Following