We have a Office365, Exchange 2010, Exchange 2007 environment. :) I need to find the source IP of an e-mail that was sent through our Exchange 2007 environment. Just trying to track down the source of a internal spam storm. We are fully patched to the current versions on everything. Is ExMon still the tool of choice for doing this? Does it work in a Exchange 2007 CCR environment that is load ballanced with hardware load ballancers? Does it work in a Exchange 2010 DAG environment that is also load ballanced with hardware load ballancers? Thanks for any advice or gotchas, JasonJason Meyer

Hi Do you have anything update on your issue ?Terence Yu TechNet Community Support

We will be looking at ExMon to see what kind of informatoin it can give us. Also looking at the RPC logs to see what information that can give us. But the question of what workstation IP did this e-mail come from remains unanswered. Thanks for all of the input.Jason Meyer