Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to determine which end users to contact, and ask them to fix their configuration or upgrade to something that supports SSL.

I don't want to send a broad email and shut off the service without knowing who is affected.

How do I determine who is using non SSL enabled POP3, IMAP, and SMTP?

share|improve this question
up vote 2 down vote accepted

Not familiar with Exchange but can you check the logs?

I assume that this is for your local corporate environment.

Alternatively, you can setup a man-in-the-middle attack (say using proxsmtp or similar) to listen on the non-SSL ports and forward those connections onto the main server. You can log the users IP/login and use that information to find out who is not using SSL.

Alternatively, you can setup a sniffer (using wireshark or similar) just before the mail server to capture the packets and inspect it to see who is connecting via these protocols.

Alternatively, depending on the size of your organisation, how about just asking people how they are checking mail? Via outlook client or webmail application, etc.

Just some random thoughts.

share|improve this answer
I've checked the Event Logs and only get IP address and username. I've looked at Exchange 2003 Diagnostics tab and enabled all logging. Yes this is for my corporate environment (5,000 users) and potentially an application I'll program and distribute to other Exchange administrators. Packet sniffers may be impractical for my purposes... – LamonteCristo Jan 29 '11 at 2:48
If you have the IP and username in the logs, wouldn't it be a matter of just parsing the logs and say, sending out warning emails to those affected users? – sybreon Jan 29 '11 at 3:00
I would suggest just setting up wireshark listening on ports 110 and 143. Collect the user names from the packet dump. – bahamat Jan 29 '11 at 3:01
If you happen to have either ISA or TMG server as your firewall, you can enable logging on the firewall service. I would then analyse the logs for the type of traffic in question. – redknight Jan 29 '11 at 9:14

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.