how do I trace a logon failure

Hi,

A client has had a list of failed OWA access logons.  The event logs show error 529 logon type 8.  The IP address is of the router which indicates an external attempt.  The suspision is that its a recently dismissed member of staff.... the attempt was with all the managers accounts.  How do I trace the original IP.....? the ones in the events just show the routers IP

Thanks

Matt
mattleedcAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Malli BoppeCommented:
You need to check the router or your firewall logs.I don't think you get IP address from with in the exchange.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
supportsCommented:
have u checked event logs....
0
MegaNuk3Commented:
Have a look in the IIS logs of the OWA server:
IIS log under C:\Windows\logfiles\W3SVC1
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Exchange

From novice to tech pro — start learning today.