Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a machine sending out spam on my network. Message tracking in Exchange shows the source IP as the IP of my Exchange Cluster rather than the source workstation. The user's PC was off during the time when the messages were sent so it appears to have come from a different workstation, OWA or mobile device. I've checked OWA logs and the only thing to connect with his credentials has been his IPhone.

I now want to find the logs that will show me which devices (IP address) have connected to Exchange via Outlook (MAPI) but I can't seem to find this log file. I have googled and also searched through this forum before posting and have only found others with my same question - no answer.


share|improve this question
Did you end up locating the source of the messages? – Evan Anderson Jan 24 '12 at 20:13
Yes but unfortunately I cannot disclose anything more about this at this time. Thank you though for preventing me from spinning my wheels looking for MAPI logs. – Paul Ackerman Jan 24 '12 at 20:33
Good to hear you found the source, even if you're not able to provide details. – Evan Anderson Jan 24 '12 at 21:29
up vote 2 down vote accepted

There is no feature in Exchange 2007 to do what you're looking for, specifically. Mailbox Audit Logging was added in Exchange 2010 to "beef up" the auditing capabilities on mailbox access through MAPI.

It would be unique, in my experience, to have a client submitting spam via MAPI. It's much more likely that you've allowed open relaying from either your LAN or the Internet and the messages are being relayed via SMTP. It's also possible that they're originating on the Exchange Server computer itself.

I'd setup a port-mirror of the Exchange Server computer's network interface and sniff all SMTP traffic until some of the offending traffic was recorded. I suspect you'll find the source of the messages doing that.

If you can actually get your hands on one of the offending messages look for a header similar to the following:

Received: from ([]) by ([]) with mapi; Mon, 16 Jan 2012
    14:47:40 -0500

Messages submitted w/ MAPI would have that header in an Exchange 2007 environment.

share|improve this answer
1) I don't think it's that odd for a windows box to get malware that takes advantage of Outlook to send spam. 2) Server is not an open relay and is clean. 3) Messages were sent in an 8 hour window Sunday and have since stopped so sniffing isn't an option. 4) The only place I can get at the message is in the sent items in the mailbox which has no header. Do you know where I can find the message that would include the source workstation not the server? -Thanks – Paul Ackerman Jan 17 '12 at 15:06
@PaulAckerman: I haven't personally seen malware that uses MAPI to send email. I'm not saying it's not possible, but I've never seen such a thing. There would be no place to see that header except at the recipient's mailbox on the remote server, but since you're seeing them in the "Sent Items" folder of the mailbox I tend to think they were submitted via MAPI, though, and seeing the header is irrelevant (to me). To my knowledge there isn't anywhere in Exchange 2007 where you're going to find the IP address of the submitting client (assuming it was an Outlook / MAPI client). – Evan Anderson Jan 17 '12 at 15:12
I was hoping there would be a header that included MAPI info internally but I'm starting to think not. I have one of the messages queued on my anti-spam box but the header only shows the internal mail server from which it received the message - not the workstation and even that header is stripped before leaving the door. Thanks for the help. I'm pretty sure I will not be able to leave this one in a state of "if it happens again, I'll do this" but it seems that I may not have any other choice... – Paul Ackerman Jan 17 '12 at 15:39
1) I don't think it's that odd for a windows box to get malware that takes advantage of Outlook to send spam. - I do. It's not impossible but I'd say it was uncommon these days. It's not like Outlook is installed by default in Windows and that there's only one version of it, and I doubt that the code to handle all of that would end up more effective than the usual "open port 25, begin dumping crud" spam malware model. Spammers are nothing if not efficient. – RobM Jan 17 '12 at 16:02
Connection via exchange active sync protocol with someone's username and password would be how I'd do it, if I were in their line of business. – RobM Jan 17 '12 at 17:49

As Evan points out, MAPI-submitted is less likely than say open anonymous relayed SMTP.

If you have multiple receive connectors and have trouble figuring out where it came from, use the MessageId in the header to search for all events pertaining to this message in the Message Tracking Logs.

Either use the Get-MessageTrackingLogs cmdlet from EMS or open the Management Console, select Toolbox and then the Message Tracking Viewer. Clear the "events" checkbox and past in the MessageId to search for and see if any more information turns up.

You could also just search for messages sent by the apparently spoofed user in the time frame the SPAM was sent

share|improve this answer
The message Tracking logs do not show me which receive connector that received the message. The connector ID field is blank except for the outgoing connector that was used to deliver the message. Again, I don't think the messages were spoofed as 1) my receive connectors require auth and 2) the messages exist in sent items. Also, the SMTP protocol receive logs (the only connector that doesn't require auth but which does not allow relay anyway) on the mailhubs do not show the inbound connections. – Paul Ackerman Jan 17 '12 at 15:32

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.