retrieving sent email in Exchange2000

[goldmeier]

I do not know which board is most appropriate for this, so I am posting it here..

I am the sysadmin in my company and I was asked by the CEO to dig up an email that was sent out by somebody. He does not know who did it, but he sent an email to everybody explaining a new policy regarding a specific service provider in the company. Somebody sent that email to the said service providers competition, causing damage to our company.

He now asked me if there is a way to find out from the server who sent the email. I know the date of the email and the address it was sent to.

We are using Exchange 2000 - is there anyway for me to look for this info from the server or do I have to log into everyones mailbox and look through their sent items (if they have not deleted it)?

And, is this morally ok? The guy who did it was disloyal to the company, so it seems ok, but OTH he will probably get canned if he is caught..

[silencio]

If you audit the SMTP service you can look at outgoing messages with the specific date and time and reciepients email address. In that line you'll find the senders email as well.

Auditing has to be turned on though. Your log will look something like this.

2002-10-04 19:36:50 mx5.thebiz.net OutboundConnectionCommand SMTPSVC1 TC0DC01 - 25 EHLO - tc0dc01.cluster.lab 0 4 0 10765 SMTP -
2002-10-04 19:36:50 mx5.thebiz.net OutboundConnectionResponse SMTPSVC1 TC0DC01 - 25 - - 250-mx5.thebiz.net 0 18 0 10937 SMTP -
2002-10-04 19:36:50 mx5.thebiz.net OutboundConnectionCommand SMTPSVC1 TC0DC01 - 25 MAIL - FROM: [email protected] 0 4 0 10953 SMTP -
2002-10-04 19:36:53 mx5.thebiz.net OutboundConnectionResponse SMTPSVC1 TC0DC01 - 25 - - 250+ok 0 6 0 13984 SMTP -
2002-10-04 19:36:53 mx5.thebiz.net OutboundConnectionCommand SMTPSVC1 TC0DC01 - 25 RCPT - TO: [email protected] 0 4 0 13984 SMTP -
2002-10-04 19:36:53 mx5.thebiz.net OutboundConnectionResponse SMTPSVC1 TC0DC01 - 25 - - 250+ok 0 6 0 14171 SMTP -
2002-10-04 19:36:53 mx5.thebiz.net OutboundConnectionCommand SMTPSVC1 TC0DC01 - 25 DATA - - 0 4 0 14171 SMTP -
2002-10-04 19:36:55 mx5.thebiz.net OutboundConnectionResponse SMTPSVC1 TC0DC01 - 25 - - 354+go+ahead 0 12 0 15593 SMTP -
2002-10-04 19:36:56 mx5.thebiz.net OutboundConnectionResponse SMTPSVC1 TC0DC01 - 25 - - 250+ok+1033760258+qp+8872 0 25 0 17281 SMTP -
2002-10-04 19:36:56 mx5.thebiz.net OutboundConnectionCommand SMTPSVC1 TC0DC01 - 25 QUIT - - 0 4 0 17281 SMTP -
2002-10-04 19:36:56 mx5.thebiz.net OutboundConnectionResponse SMTPSVC1 TC0DC01 - 25 - - 221+mx5.thebiz.net 0 18 0 17390 SMTP -