Does anyone know if there is a way to track who a message originated from within the Organization? Here is what happened:Some user typed another user's email address in the From: box in an Outlook e-mail then sent it to the entire organization. The problem being that the email contained some offensive material, so management wants to know who sent it.Is there a way to find out who sent that message? I would assume that it is located in the Sent Items folder of the person who sent it, so is there a way to search through all the Exchange mailboxes to find it? Is there a third party tool? Any advice would be appreciated. Thanks.-Daniel

Hi Daniel The first thing I would do is check whether the message was spoofed or not. If the message was sent within the Exchange organisation it should not contain Internet headers. Look for these in the message options. If the message does contain Internet headers it may contain useful information regarding where the message originated (IP Address). It is possible that it was sent from Outlook, but to use a different address in the From: field, the originator would need to have "Send As" permissions on the mailbox. This would be a bit of a giveaway, so I suspect that is an unlikely scenario. Also have a look at Exchange message tracking and see if that reveals any further information. Tony www.activedir.org