Is there any way to find the IP of the original client that sent an internal e-mail?

  • In IIS I can see the connected clients but you cannot see which clients send e-mail.

  • In the message tracking logs / transport logs I can find the e-mail but depending on the setup I see only the IP address of the Exchange server or the ARR load balancer (weirdly enough???) in the "Original-client-IP" field.

Does anyone know another option? I have looked but haven't found anything though Mailbox Audit Logging looks promising.

  • 6
    Look at the headers. – joeqwerty Apr 11 '18 at 15:44

I would recommend using the following

    Get-TransportService | ForEach-Object {Get-MessageTrackingLog -Server $_.Name -MessageSubject "Your Email subject" -Start (Get-Date).AddDays(-1) -EventId Submit } | Select-Object -Property Sender,OriginalClientIp

This should query all Exchange servers and return the original submittal of the original email message and the IP address from whence it was submitted.

Now, if the ARR servers proxy the connection to the Exchange servers from internal clients, it would explain why you are seeing the IP of the proxy servers as - to Exchange - the connection appears to originate from the proxy servers.

Mailbox Audit Logging sounds promising - if auditing was enabled on the mailbox prior to the sending of the email - and only if the email was sent by leveraging "SendAs" or "SendOnBehalfOf" permissions, as just sending an email (i.e. an owner creating a message item) is not an auditable action.

  • 1
    I have found a module called ARR Helper which converts the "X-Forwarded-For" header to the Client IP address so that the loggings on Exchange now show the correct source IP address! – Jozef Woo Apr 16 '18 at 12:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.