NIJ

Hi, i'm facing a strange behaviour. On a shared mailbox, some mails are tagged as spam. But don't know which workstation (user) is tagging the mail as SPAM. How can i found it ? The individual whitelist/blacklist is configured (not the global), but where can i see it for each Workstation from the ERAPROTECT ?) Thank you for your help,