• RSS
  • Twitter
  • FaceBook

Exchange Server Forums

Forums | Register | Login | My Profile | Inbox | RSS RSS icon | My Subscription | My Forums | Address Book | Member List | Search | FAQ | Ticket List | Log Out

Security ?: Can you tell if an emal is sent from OWA?

Users viewing this topic: none

Logged in as: Guest
  Printable Version
All Forums >> [Microsoft Exchange 2000] >> Outlook Web Access >> Security ?: Can you tell if an emal is sent from OWA? Page: [1]
Login
Message << Older Topic   Newer Topic >>
Security ?: Can you tell if an emal is sent from OWA? - 10.May2005 6:42:00 PM   
Kevykev

 

Posts: 5
Joined: 2.Mar.2005
From: San Francisco
Status: offline
Security is going to be tightened in our organization and I have been posed with the question if emails can be traced to being sent from an OWA account as opposed to their Outlook Client. Is there some kind of signature in Exchange 2000 that will tell me? I need to identify the source of a sent email: OWA or Outlook.
Post #: 1
RE: Security ?: Can you tell if an emal is sent from OWA? - 10.May2005 7:19:00 PM   
ScottyFryer

 

Posts: 417
Joined: 19.May2004
From: Courtice
Status: offline
most Microsoft Exchange Server components, you can turn on diagnostic logging by using the Diagnostic Logging tab in the component's Properties dialog box. However, because Outlook Web Access (OWA) isn't an Exchange component (strictly speaking), there's no external interface exposed that you can use to log OWA-related events. However, if you know what types of events OWA generates, you can turn on logging for the Directory Service (DS) and Information Store (IS) services, then look for the kinds of events OWA generates. To get an idea of what OWA is doing, first you have to turn on some particular logging categories:

Open Exchange Administrator, and navigate to the OWA server.
Select the server, and use the File, Properties command to open its Properties dialog box.
Switch to the Diagnostics Logging tab, and select MSExchangeDS from the list of components.
Set the logging level for Security, ExDS interface, Messaging API (MAPI), Directory Access, Lightweight Directory Access Protocol (LDAP) interface, and Name Resolution to maximum.
Expand the MSExchangeIS item in the component list.
Select the System item under MSExchangeIS, and set the logging level for Connections and General to maximum.
Select the Private item under MSExchangeIS, then set the logging level for General and Logons to maximum.
Stop and restart the IS.
Once you do this, you'll see six or seven events logged each time an OWA user logs on. You'll typically see event IDs 1170, 1136, 1137, 1007, and 1009, and you might see more than one of each. These events will tell you who logged on and when. (See "XWEB: Diagnostic Logging Levels for OWA Defined in the Exchange Administrator Program," Microsoft article Q246248, for more detail on the pertinent events.)

(in reply to Kevykev)
Post #: 2

Page:   [1] << Older Topic    Newer Topic >>
All Forums >> [Microsoft Exchange 2000] >> Outlook Web Access >> Security ?: Can you tell if an emal is sent from OWA? Page: [1]
Jump to:

New Messages No New Messages
Hot Topic w/ New Messages Hot Topic w/o New Messages
Locked w/ New Messages Locked w/o New Messages
 Post New Thread
 Reply to Message
 Post New Poll
 Submit Vote
 Delete My Own Post
 Delete My Own Thread
 Rate Posts


Follow TechGenix on Twitter