Access logs...

Posted on 2006-05-04
Last Modified: 2008-02-20
I am running Windows Server 2003 with Exchange Server 2003.  Where on my server will I find the logs of who attempted to log into Outlook Web Access?
Question by:Yort
    LVL 35

    Accepted Solution

    Web Access is Internet Information Server (IIS). The logfile resides either in a folder, you have choosen within the site settings of the IIS site, which hosts the WebAccess, or within the default folder:

    There you will find a folder W3SVCxxxxxx, where xxxxx is the number of your Site (maybe 1, if you have only 1 Site). The number is shown, if you open your IIS Management console --> Your server --> click websites, on the right side you see all of your sites and the number.

    Within these logs (if enabled), you can see all requests (including the logons attemts) to IIS.
    LVL 1

    Author Comment

    Thanks!  That is what I was looking for.

    One other question:  How can you identify between valid versus invalid login attempts?
    LVL 35

    Expert Comment

    Within each log line, you get a HTTP status code, which should be 200 for an successful login.

    2006-05-05 12:34:22 W3SVC1 Server IP-Address GET /exchange - 80 -
    HTTP/1.1 Mozilla/4.0+(compatible; xxx) - - SERVER 401 2 2148074254 342 412 15

    2006-05-05 12:34:22 W3SVC1 Server IP-Address  GET /exchange - 80 DOMAIN\USERNAME IP-Address
    HTTP/1.1 Mozilla/4.0+(compatible xxx) - - SERVER 302 0 0 625 2991 687

    These are the first two lines (here with a break) of a successfull login.

    First line is the anonymous login attempt which fails with Error code 401 = access denied
    Second line is the authenticated login attempt which succeds with Error code 302 = not moved or200 = OK

    The status code is near the end of the line behind -- SERVER (here: second line)

    If a user login fails, the second response ode also may have an 4xx error code

    That the fist login fails is by design as IE allways first tries to logon anonymous.
    LVL 1

    Author Comment



    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Enabling OSINT in Activity Based Intelligence

    Activity based intelligence (ABI) requires access to all available sources of data. Recorded Future allows analysts to observe structured data on the open, deep, and dark web.

    Email statistics and Mailbox database quotas You might have an interest in attaining information such as mailbox details, mailbox statistics and mailbox database details from Exchange server. At that point, knowing how to retrieve this information …
    Find out how to use dynamic social media in email signatures with this top 10 DOs & DON’Ts.
    In this video we show how to create a Resource Mailbox in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: Navigate to the Recipients >> Resources tab.: "Recipients" is our default selection …
    In this video we show how to create a mailbox database in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Servers >> Data…

    759 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    8 Experts available now in Live!

    Get 1:1 Help Now