Re: Tracking down anonymous user

My 2 cents:

Did you check your Microsoft Windows security event logs to see who was
login with that account when the e-mail was sent?

Did the user send the message through Outlook? If so, have you checked
everyones outbox?

Did the user use the web interface for Outlook, if so did you check the
IIS logs for that day?

My advice concerning this issue is NOT to share passwords for a domain
user account!!


mikef@xxxxxxxxxxxx wrote:
I’m trying to track down an internal user who is sending email under a different user account to hide his/her identity.
Scenario:
I have a domain user account that about 15 people know the password to. Someone logged on using this account and sent a message to a manager and because of the content of the message I'm 100% certain that it's an internal user; not someone spoofing. As a matter of fact it’s definitely someone in the IT department.
Is there a way to track down what computer (IP address) was used to send the messages?
The incident occurred a couple of days ago so I'm hoping I can still track down the user. I'm using exchange server 2003.

I’ve check the exchange log files, SMTP files from my SQL servers, and checked the recipient header (there was no header info), but I’m not getting anywhere. If I can’t get them this time what can I do to catch them the next time.



Relevant Pages

  • Outlook 2003 username cache
    ... weeks ago, I needed to test out another account, thus I logged into ... Outlook with a different username. ... login to my account it pulls up the old users username, ...
    (microsoft.public.outlook)
  • Re: Can send email using 2002 Outlook
    ... The logs should show whether or not Outlook is trying to use SPA. ... >>> your login with Secure Password Authentication. ... >>> your account properties, Under Tools, Click E-mail ...
    (microsoft.public.outlook.general)
  • Unable to log on to Hotmail in Outlook Express
    ... For a long time I’ve had no problem logging in to my Hotmail.com account ... to login on Outlook Express. ... I can login using the Microsoft website without a problem but it’s Outlook ...
    (microsoft.public.internet.outlookexpress.mac)
  • Multiple user accounts not working properly
    ... three email accounts (each on their own login).. ... ISP said that proves the account is valid. ... I just upgraded to Outlook 2003. ...
    (microsoft.public.outlook)
  • Re: Assoicate with External account Question
    ... With Associated External Account, users authenticate with the Domain A account and the Domain B account can and should be disabled. ... Our exchange server is in a different WIN2003 forest/domain)B) ... Now my users were challanged (login authentication) to login to B ... when they launched Outlook. ...
    (microsoft.public.exchange.admin)