[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
?
Solved

Access logs...

Posted on 2006-05-04
4
Medium Priority
?
280 Views
Last Modified: 2008-02-20
I am running Windows Server 2003 with Exchange Server 2003.  Where on my server will I find the logs of who attempted to log into Outlook Web Access?
0
Comment
Question by:Yort
  • 2
  • 2
4 Comments
 
LVL 35

Accepted Solution

by:
Bembi earned 2000 total points
ID: 16610667
Web Access is Internet Information Server (IIS). The logfile resides either in a folder, you have choosen within the site settings of the IIS site, which hosts the WebAccess, or within the default folder:
C:\windows\system32\logfiles

There you will find a folder W3SVCxxxxxx, where xxxxx is the number of your Site (maybe 1, if you have only 1 Site). The number is shown, if you open your IIS Management console --> Your server --> click websites, on the right side you see all of your sites and the number.

Within these logs (if enabled), you can see all requests (including the logons attemts) to IIS.
0
 
LVL 1

Author Comment

by:Yort
ID: 16610697
Thanks!  That is what I was looking for.

One other question:  How can you identify between valid versus invalid login attempts?
0
 
LVL 35

Expert Comment

by:Bembi
ID: 16614073
Within each log line, you get a HTTP status code, which should be 200 for an successful login.

2006-05-05 12:34:22 W3SVC1 Server IP-Address GET /exchange - 80 - 192.168.225.1
HTTP/1.1 Mozilla/4.0+(compatible; xxx) - - SERVER 401 2 2148074254 342 412 15

2006-05-05 12:34:22 W3SVC1 Server IP-Address  GET /exchange - 80 DOMAIN\USERNAME IP-Address
HTTP/1.1 Mozilla/4.0+(compatible xxx) - - SERVER 302 0 0 625 2991 687

These are the first two lines (here with a break) of a successfull login.

First line is the anonymous login attempt which fails with Error code 401 = access denied
Second line is the authenticated login attempt which succeds with Error code 302 = not moved or200 = OK

The status code is near the end of the line behind -- SERVER (here: second line)

If a user login fails, the second response ode also may have an 4xx error code

That the fist login fails is by design as IE allways first tries to logon anonymous.
0
 
LVL 1

Author Comment

by:Yort
ID: 16615901
Bembi,

Thanks!
0

Featured Post

Veeam Disaster Recovery in Microsoft Azure

Veeam PN for Microsoft Azure is a FREE solution designed to simplify and automate the setup of a DR site in Microsoft Azure using lightweight software-defined networking. It reduces the complexity of VPN deployments and is designed for businesses of ALL sizes.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If something goes wrong with Exchange, your IT resources are in trouble.All Exchange server migration processes are not designed to be identical and though migrating email from on-premises Exchange mailbox to Cloud’s Office 365 is relatively simple…
Stellar Exchange Toolkit: this 5 in 1 toolkit comes loaded with mega-software tool. Here’s an introduction to tools’ usage and advantages:
In this video we show how to create an email address policy in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.:  First we need to log into the Exchange Admin Center. Navigate to the Mail Flow…
In this video we show how to create a mailbox database in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Servers >> Data…
Suggested Courses

873 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question