MIT-Techs
asked on
OWA will not allow user to log in
OWA is not working for one single user. When I go to the site https://mail.tlcdevelopment.com/exchange I am prompted for login.
When one of our users tries to login (with correct user and pass) he is simply prompted for login again and this loop continues. Please help.
When one of our users tries to login (with correct user and pass) he is simply prompted for login again and this loop continues. Please help.
IN ADUC on exchange goto the users account and under exchange features make sure outlook web access is enabled.
ASKER
Outlook web access is enabled. I went in and disabled it and re-enabled as well. Still not working.
have you tried different forms of logon such as:
domain\username
username@domain.local
domain\username
username@domain.local
ASKER
I just tried domain\username and username@domain with the same results.
that's odd.
Have you tried a different browser or machine. What about accessing a different user mailbox from that person's machine. Just to rule out the PC side as an issue.
Have you tried a different browser or machine. What about accessing a different user mailbox from that person's machine. Just to rule out the PC side as an issue.
ASKER
Same results on different computers. I am able to access OWA using other accounts, just not the one.
Are you sure his password isn't expired? Or set to "must change at next login?" or the account could be expired as well.
Are you able to setup an Outlook and Windows profile for that user?
Are you able to setup an Outlook and Windows profile for that user?
I have only One question to start with.
What Exchange Version are you running? E2k3/E2k7 or E2010?
~ Singh
What Exchange Version are you running? E2k3/E2k7 or E2010?
~ Singh
Go into AD, right click user, exchange tasks, select "delete mailbox"
Go into exchange, run "Run Cleanup Agent", don't purge the mailbox.
In Exchange highlight the deleted email account (has a red x on it) and select "Reconnect" to the user account you're having problems with. I've seen this re-associate the attributes.
Go into exchange, run "Run Cleanup Agent", don't purge the mailbox.
In Exchange highlight the deleted email account (has a red x on it) and select "Reconnect" to the user account you're having problems with. I've seen this re-associate the attributes.
Can you find the iis log file entries generated when this user tries to login? At what point do they start to differ from a successful login? Please paste them for us, if you can find them.
.
Make sure that you type user log in format base on form-based authentication that you selected in OWA authentication tab properties. and AD that you selected, it uses for users exchange accounts.
ASKER
@Padamdeep its a SBS2003 server so E2k3
Lets go to IIS logs on Exchange Server and check what error it is failing with?
You can go to IIS logs and search for this user's alias.
~ Singh
You can go to IIS logs and search for this user's alias.
~ Singh
Go to services.msc on Exchange Server Machine, Stop and then restart service Microsoft Exchange forms-based Authentication service.
ASKER
@Padamdeep,
This is all I see on the IIS logs.
#Software: Microsoft Internet Information Services 6.0
#Version: 1.0
#Date: 2012-04-05 00:02:48
#Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status
2012-04-05 00:02:48 192.168.1.150 UNSUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-05 00:02:48 192.168.1.150 UNSUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:02:48 192.168.1.150 UNSUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/ - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 207 0 0
2012-04-05 00:02:48 192.168.1.150 POST /Microsoft-Server-ActiveSy nc User=robert&DeviceId=ApplC 39GF97WDTD 5&DeviceTy pe=iPhone& Cmd=Ping&L og=V4TNASN C:0A0C0D0F S:0A0C0D0S P:2C23I986 62S668288R 0S0L600H0P 443 TIEMANN\robert 166.147.79.200 Apple-iPhone4C1/902.179 200 0 0
2012-04-05 00:07:09 192.168.1.150 UNSUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-05 00:07:09 192.168.1.150 UNSUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:07:09 192.168.1.150 UNSUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/ - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 207 0 0
2012-04-05 00:07:14 192.168.1.150 POST /Microsoft-Server-ActiveSy nc User=robert&DeviceId=ApplC 39GF97WDTD 5&DeviceTy pe=iPhone& Cmd=Ping&L og=V4TNASN C:0A0C0D0F S:0A0C0D0S P:2C23I986 62S668288R 0S0L600H0P 443 TIEMANN\robert 166.147.79.200 Apple-iPhone4C1/902.179 200 0 995
2012-04-05 00:07:24 192.168.1.150 UNSUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-05 00:07:24 192.168.1.150 UNSUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:07:24 192.168.1.150 UNSUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/ - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 207 0 0
2012-04-05 00:07:28 192.168.1.150 POST /Microsoft-Server-ActiveSy nc User=robert&DeviceId=ApplC 39GF97WDTD 5&DeviceTy pe=iPhone& Cmd=Ping&L og=V4TNASN C:0A0C0D0F S:0A0C0D0S P:2C24I996 00S669866R 0S0L600H0P 443 TIEMANN\robert 166.147.79.200 Apple-iPhone4C1/902.179 200 0 995
2012-04-05 00:09:51 192.168.1.150 UNSUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-05 00:09:51 192.168.1.150 POST /Microsoft-Server-ActiveSy nc User=robert&DeviceId=ApplC 39GF97WDTD 5&DeviceTy pe=iPhone& Cmd=Ping&L og=V4TNASN C:0A0C0D0F S:0A0C0D0S P:2C24I996 00S669866R 0S0L600H0P 443 TIEMANN\robert 166.147.79.200 Apple-iPhone4C1/902.179 200 0 64
2012-04-05 00:09:51 192.168.1.150 UNSUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:09:51 192.168.1.150 UNSUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/ - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 207 0 0
2012-04-05 00:11:05 192.168.1.150 PROPFIND /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:05 192.168.1.150 PROPFIND /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5 - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 207 0 0
2012-04-05 00:11:05 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-05 00:11:05 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:05 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5 - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 302 0 0
2012-04-05 00:11:05 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/AutdSt ate.xml - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-05 00:11:05 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/AutdSt ate.xml - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:05 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/AutdSt ate.xml - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 0
2012-04-05 00:11:05 192.168.1.150 PUT /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/AutdSt ate.xml - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:05 192.168.1.150 PUT /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/AutdSt ate.xml - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 0
2012-04-05 00:11:05 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/Folder SyncFile - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-05 00:11:05 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/Folder SyncFile - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:05 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/Folder SyncFile - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 0
2012-04-05 00:11:05 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/Cont acts/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-05 00:11:05 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/Cont acts/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:05 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/Cont acts/ - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 0
2012-04-05 00:11:05 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/Sugg ested+Cont acts/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-05 00:11:05 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/Sugg ested+Cont acts/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:05 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/Sugg ested+Cont acts/ - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 0
2012-04-05 00:11:05 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/Task s/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-05 00:11:05 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/Task s/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:05 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/Task s/ - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 0
2012-04-05 00:11:05 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/Inbo x/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-05 00:11:05 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/Inbo x/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:05 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/Inbo x/ - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 0
2012-04-05 00:11:05 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/Sent +Items/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-05 00:11:05 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/Sent +Items/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:05 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/Sent +Items/ - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 0
2012-04-05 00:11:05 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/Cale ndar/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-05 00:11:05 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/Cale ndar/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:05 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/Cale ndar/ - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 0
2012-04-05 00:11:05 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-13b 5 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-05 00:11:05 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-13b 5 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:05 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-13b 5 - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 0
2012-04-05 00:11:05 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc developmen t.com/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:05 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc developmen t.com/ - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 207 0 0
2012-04-05 00:11:05 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/334add cfe2a4f64c 83e157eed5 691320-81e 0005 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-05 00:11:05 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/334add cfe2a4f64c 83e157eed5 691320-81e 0005 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:05 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/334add cfe2a4f64c 83e157eed5 691320-81e 0005 - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 0
2012-04-05 00:11:05 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc developmen t.com/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:05 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc developmen t.com/ - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 207 0 0
2012-04-05 00:11:05 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-13b 9 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-05 00:11:05 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-13b 9 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:05 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-13b 9 - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 0
2012-04-05 00:11:05 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc developmen t.com/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:05 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc developmen t.com/ - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 207 0 0
2012-04-05 00:11:05 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-16d 5 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-05 00:11:05 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-16d 5 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:05 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-16d 5 - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 0
2012-04-05 00:11:05 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc developmen t.com/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:05 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc developmen t.com/ - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 207 0 0
2012-04-05 00:11:05 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-16d 7 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-05 00:11:05 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-16d 7 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:05 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-16d 7 - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 0
2012-04-05 00:11:05 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc developmen t.com/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:05 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc developmen t.com/ - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 207 0 0
2012-04-05 00:11:05 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-13b 4 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-05 00:11:05 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-13b 4 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:05 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-13b 4 - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 0
2012-04-05 00:11:05 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc developmen t.com/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:05 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc developmen t.com/ - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 207 0 0
2012-04-05 00:11:05 192.168.1.150 UNSUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-05 00:11:05 192.168.1.150 UNSUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:05 192.168.1.150 UNSUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/ - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 207 0 0
2012-04-05 00:11:05 192.168.1.150 POST /Microsoft-Server-ActiveSy nc User=robert&DeviceId=ApplC 39GF97WDTD 5&DeviceTy pe=iPhone& Cmd=Ping&L og=V4TNASN C:0A0C0D0F S:0A0C0D0S P:1C24I996 00S669866R 0S0L600H0P 443 TIEMANN\robert 166.147.79.200 Apple-iPhone4C1/902.179 200 0 0
2012-04-05 00:11:06 192.168.1.150 PROPFIND /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:06 192.168.1.150 PROPFIND /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5 - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 207 0 0
2012-04-05 00:11:06 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-13b 4 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-05 00:11:06 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-13b 4 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:06 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-13b 4 - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 0
2012-04-05 00:11:06 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc developmen t.com/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:06 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc developmen t.com/ - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 207 0 0
2012-04-05 00:11:06 192.168.1.150 PUT /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-13b 4 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:06 192.168.1.150 PUT /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-13b 4 - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 0
2012-04-05 00:11:06 192.168.1.150 POST /Microsoft-Server-ActiveSy nc User=robert&DeviceId=ApplC 39GF97WDTD 5&DeviceTy pe=iPhone& Cmd=Sync&L og=V4TCaSS C:0A0C0D0F S:0A0C0D1S P:1C4I1672 9S33686R0S 0L0H0P 443 TIEMANN\robert 166.147.79.200 Apple-iPhone4C1/902.179 200 0 0
2012-04-05 00:11:20 192.168.1.150 PROPFIND /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:20 192.168.1.150 PROPFIND /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5 - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 207 0 0
2012-04-05 00:11:20 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-16d 7 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-05 00:11:20 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-16d 7 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:20 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-16d 7 - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 0
2012-04-05 00:11:20 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc developmen t.com/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:20 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc developmen t.com/ - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 207 0 0
2012-04-05 00:11:20 192.168.1.150 PUT /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-16d 7 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:20 192.168.1.150 PUT /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-16d 7 - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 0
2012-04-05 00:11:20 192.168.1.150 POST /Microsoft-Server-ActiveSy nc User=robert&DeviceId=ApplC 39GF97WDTD 5&DeviceTy pe=iPhone& Cmd=Sync&L og=V4TEmSS C:0A0C0D0F S:0A0C0D7S P:1C4I4934 3S97018R0S 0L0H0P 443 TIEMANN\robert 166.147.79.200 Apple-iPhone4C1/902.179 200 0 0
2012-04-05 00:11:20 192.168.1.150 PROPFIND /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:20 192.168.1.150 PROPFIND /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5 - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 207 0 0
2012-04-05 00:11:20 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-16d 5 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-05 00:11:20 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-16d 5 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:20 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-16d 5 - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 0
2012-04-05 00:11:20 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc developmen t.com/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:21 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc developmen t.com/ - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 207 0 0
2012-04-05 00:11:21 192.168.1.150 PUT /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-16d 5 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:21 192.168.1.150 PUT /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-16d 5 - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 0
2012-04-05 00:11:21 192.168.1.150 POST /Microsoft-Server-ActiveSy nc User=robert&DeviceId=ApplC 39GF97WDTD 5&DeviceTy pe=iPhone& Cmd=Sync&L og=V4TEmSS C:0A0C0D0F S:0A0C0D21 SP:1C4I182 942S364228 R0S0L0H0P 443 TIEMANN\robert 166.147.79.200 Apple-iPhone4C1/902.179 200 0 0
2012-04-05 00:11:24 192.168.1.150 PROPFIND /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:24 192.168.1.150 PROPFIND /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5 - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 207 0 0
2012-04-05 00:11:24 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-05 00:11:24 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:24 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5 - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 302 0 0
2012-04-05 00:11:24 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/AutdSt ate.xml - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-05 00:11:24 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/AutdSt ate.xml - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:24 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/AutdSt ate.xml - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 0
2012-04-05 00:11:24 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/Folder SyncFile - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-05 00:11:24 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/Folder SyncFile - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:24 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/Folder SyncFile - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 0
2012-04-05 00:11:24 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/Cont acts/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-05 00:11:24 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/Cont acts/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:24 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/Cont acts/ - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 0
2012-04-05 00:11:24 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/Sugg ested+Cont acts/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-05 00:11:24 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/Sugg ested+Cont acts/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:24 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/Sugg ested+Cont acts/ - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 0
2012-04-05 00:11:24 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/Task s/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-05 00:11:24 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/Task s/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:24 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/Task s/ - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 0
2012-04-05 00:11:24 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/Inbo x/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-05 00:11:24 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/Inbo x/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:24 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/Inbo x/ - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 0
2012-04-05 00:11:24 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/Sent +Items/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-05 00:11:24 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/Sent +Items/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:24 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/Sent +Items/ - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 0
2012-04-05 00:11:24 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/Cale ndar/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-05 00:11:24 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/Cale ndar/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:24 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/Cale ndar/ - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 0
2012-04-05 00:11:24 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-13b 5 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-05 00:11:24 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-13b 5 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:24 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-13b 5 - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 0
2012-04-05 00:11:24 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc developmen t.com/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:24 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc developmen t.com/ - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 207 0 0
2012-04-05 00:11:24 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/334add cfe2a4f64c 83e157eed5 691320-81e 0005 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-05 00:11:24 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/334add cfe2a4f64c 83e157eed5 691320-81e 0005 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:24 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/334add cfe2a4f64c 83e157eed5 691320-81e 0005 - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 0
2012-04-05 00:11:24 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc developmen t.com/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:24 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc developmen t.com/ - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 207 0 0
2012-04-05 00:11:24 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-13b 9 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-05 00:11:24 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-13b 9 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:24 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-13b 9 - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 0
2012-04-05 00:11:24 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc developmen t.com/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:24 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc developmen t.com/ - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 207 0 0
2012-04-05 00:11:24 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-16d 5 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-05 00:11:24 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-16d 5 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:24 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-16d 5 - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 0
2012-04-05 00:11:24 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc developmen t.com/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:24 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc developmen t.com/ - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 207 0 0
2012-04-05 00:11:24 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-16d 7 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-05 00:11:24 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-16d 7 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:24 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-16d 7 - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 0
2012-04-05 00:11:24 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc developmen t.com/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:24 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc developmen t.com/ - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 207 0 0
2012-04-05 00:11:24 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-13b 4 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-05 00:11:24 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-13b 4 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:24 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-13b 4 - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 0
2012-04-05 00:11:24 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc developmen t.com/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:11:24 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc developmen t.com/ - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 207 0 0
2012-04-05 00:21:26 192.168.1.150 UNSUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-05 00:21:26 192.168.1.150 UNSUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:21:26 192.168.1.150 POST /Microsoft-Server-ActiveSy nc User=robert&DeviceId=ApplC 39GF97WDTD 5&DeviceTy pe=iPhone& Cmd=Ping&L og=V4TNASN C:0A0C0D0F S:0A0C0D0S P:2C23I986 62S668392R 0S0L600H0P 443 TIEMANN\robert 166.147.79.200 Apple-iPhone4C1/902.179 200 0 64
2012-04-05 00:21:26 192.168.1.150 UNSUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/ - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 207 0 0
2012-04-05 00:22:36 192.168.1.150 PROPFIND /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:22:36 192.168.1.150 PROPFIND /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5 - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 207 0 0
2012-04-05 00:22:36 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-05 00:22:36 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:22:36 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5 - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 302 0 0
2012-04-05 00:22:36 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/AutdSt ate.xml - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-05 00:22:36 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/AutdSt ate.xml - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:22:36 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/AutdSt ate.xml - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 0
2012-04-05 00:22:36 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/Folder SyncFile - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-05 00:22:36 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/Folder SyncFile - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:22:36 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/Folder SyncFile - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 0
2012-04-05 00:22:36 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/Cont acts/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-05 00:22:36 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/Cont acts/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:22:36 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/Cont acts/ - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 0
2012-04-05 00:22:36 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/Sugg ested+Cont acts/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-05 00:22:36 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/Sugg ested+Cont acts/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:22:36 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/Sugg ested+Cont acts/ - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 0
2012-04-05 00:22:36 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/Task s/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-05 00:22:36 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/Task s/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:22:36 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/Task s/ - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 0
2012-04-05 00:22:36 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/Inbo x/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-05 00:22:36 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/Inbo x/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:22:36 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/Inbo x/ - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 0
2012-04-05 00:22:36 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/Sent +Items/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-05 00:22:36 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/Sent +Items/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:22:36 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/Sent +Items/ - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 0
2012-04-05 00:22:36 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/Cale ndar/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-05 00:22:36 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/Cale ndar/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:22:36 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/Cale ndar/ - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 0
2012-04-05 00:22:36 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-13b 5 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-05 00:22:36 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-13b 5 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:22:36 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-13b 5 - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 0
2012-04-05 00:22:36 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc developmen t.com/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:22:36 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc developmen t.com/ - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 207 0 0
2012-04-05 00:22:36 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/334add cfe2a4f64c 83e157eed5 691320-81e 0005 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-05 00:22:36 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/334add cfe2a4f64c 83e157eed5 691320-81e 0005 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:22:36 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/334add cfe2a4f64c 83e157eed5 691320-81e 0005 - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 0
2012-04-05 00:22:36 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc developmen t.com/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:22:36 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc developmen t.com/ - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 207 0 0
2012-04-05 00:22:36 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-13b 9 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-05 00:22:36 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-13b 9 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:22:36 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-13b 9 - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 0
2012-04-05 00:22:36 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc developmen t.com/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:22:36 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc developmen t.com/ - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 207 0 0
2012-04-05 00:22:36 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-16d 5 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-05 00:22:36 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-16d 5 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:22:36 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-16d 5 - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 0
2012-04-05 00:22:36 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc developmen t.com/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:22:36 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc developmen t.com/ - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 207 0 0
2012-04-05 00:22:36 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-16d 7 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-05 00:22:36 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-16d 7 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:22:36 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-16d 7 - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 0
2012-04-05 00:22:36 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc developmen t.com/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:22:36 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc developmen t.com/ - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 207 0 0
2012-04-05 00:22:36 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-13b 4 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-05 00:22:36 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-13b 4 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-05 00:22:36 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-13b 4 - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 0
2012-04-05 00:22:36 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc developmen t.com/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
This is all I see on the IIS logs.
#Software: Microsoft Internet Information Services 6.0
#Version: 1.0
#Date: 2012-04-05 00:02:48
#Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status
2012-04-05 00:02:48 192.168.1.150 UNSUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:02:48 192.168.1.150 UNSUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:02:48 192.168.1.150 UNSUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:02:48 192.168.1.150 POST /Microsoft-Server-ActiveSy
2012-04-05 00:07:09 192.168.1.150 UNSUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:07:09 192.168.1.150 UNSUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:07:09 192.168.1.150 UNSUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:07:14 192.168.1.150 POST /Microsoft-Server-ActiveSy
2012-04-05 00:07:24 192.168.1.150 UNSUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:07:24 192.168.1.150 UNSUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:07:24 192.168.1.150 UNSUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:07:28 192.168.1.150 POST /Microsoft-Server-ActiveSy
2012-04-05 00:09:51 192.168.1.150 UNSUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:09:51 192.168.1.150 POST /Microsoft-Server-ActiveSy
2012-04-05 00:09:51 192.168.1.150 UNSUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:09:51 192.168.1.150 UNSUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 PROPFIND /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 PROPFIND /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 PUT /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 PUT /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 UNSUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 UNSUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 UNSUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:11:05 192.168.1.150 POST /Microsoft-Server-ActiveSy
2012-04-05 00:11:06 192.168.1.150 PROPFIND /exchange-oma/rtiemann@tlc
2012-04-05 00:11:06 192.168.1.150 PROPFIND /exchange-oma/rtiemann@tlc
2012-04-05 00:11:06 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:06 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:06 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:06 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc
2012-04-05 00:11:06 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc
2012-04-05 00:11:06 192.168.1.150 PUT /exchange-oma/rtiemann@tlc
2012-04-05 00:11:06 192.168.1.150 PUT /exchange-oma/rtiemann@tlc
2012-04-05 00:11:06 192.168.1.150 POST /Microsoft-Server-ActiveSy
2012-04-05 00:11:20 192.168.1.150 PROPFIND /exchange-oma/rtiemann@tlc
2012-04-05 00:11:20 192.168.1.150 PROPFIND /exchange-oma/rtiemann@tlc
2012-04-05 00:11:20 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:20 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:20 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:20 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc
2012-04-05 00:11:20 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc
2012-04-05 00:11:20 192.168.1.150 PUT /exchange-oma/rtiemann@tlc
2012-04-05 00:11:20 192.168.1.150 PUT /exchange-oma/rtiemann@tlc
2012-04-05 00:11:20 192.168.1.150 POST /Microsoft-Server-ActiveSy
2012-04-05 00:11:20 192.168.1.150 PROPFIND /exchange-oma/rtiemann@tlc
2012-04-05 00:11:20 192.168.1.150 PROPFIND /exchange-oma/rtiemann@tlc
2012-04-05 00:11:20 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:20 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:20 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:20 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc
2012-04-05 00:11:21 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc
2012-04-05 00:11:21 192.168.1.150 PUT /exchange-oma/rtiemann@tlc
2012-04-05 00:11:21 192.168.1.150 PUT /exchange-oma/rtiemann@tlc
2012-04-05 00:11:21 192.168.1.150 POST /Microsoft-Server-ActiveSy
2012-04-05 00:11:24 192.168.1.150 PROPFIND /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 PROPFIND /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc
2012-04-05 00:11:24 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc
2012-04-05 00:21:26 192.168.1.150 UNSUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:21:26 192.168.1.150 UNSUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:21:26 192.168.1.150 POST /Microsoft-Server-ActiveSy
2012-04-05 00:21:26 192.168.1.150 UNSUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 PROPFIND /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 PROPFIND /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 SUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-05 00:22:36 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc
ASKER
@Bopheak,
In the services console there is no service called Microsoft Exchange forms-based Authentication service.
It is not present.
In the services console there is no service called Microsoft Exchange forms-based Authentication service.
It is not present.
There aren't any OWA requests in that log segment. OWA requests would start with
GET /exchange
all the entries listed here are for ActiveSync. It may be that you have disabled logging on the Exchange VDir, or maybe they are in a different log. Are the ones above from the latest log file in the W3SVC1 folder?
GET /exchange
all the entries listed here are for ActiveSync. It may be that you have disabled logging on the Exchange VDir, or maybe they are in a different log. Are the ones above from the latest log file in the W3SVC1 folder?
ASKER
Sorry, here is the correct portion of the log.
2012-04-09 15:35:11 192.168.1.150 GET /exchange/ - 443 - 24.227.167.50 Mozilla/5.0+(Windows+NT+6. 1;+WOW64;+ rv:11.0)+G ecko/20100 101+Firefo x/11.0 401 2 2148074254
2012-04-09 15:35:11 192.168.1.150 GET /exchange/ - 443 - 24.227.167.50 Mozilla/5.0+(Windows+NT+6. 1;+WOW64;+ rv:11.0)+G ecko/20100 101+Firefo x/11.0 401 1 0
2012-04-09 15:35:11 192.168.1.150 GET /exchange/ - 443 TIEMANN\missionit 24.227.167.50 Mozilla/5.0+(Windows+NT+6. 1;+WOW64;+ rv:11.0)+G ecko/20100 101+Firefo x/11.0 200 0 0
2012-04-09 15:35:11 192.168.1.150 GET /exchange/missionit/ Cmd=navbar 443 TIEMANN\missionit 24.227.167.50 Mozilla/5.0+(Windows+NT+6. 1;+WOW64;+ rv:11.0)+G ecko/20100 101+Firefo x/11.0 200 0 0
2012-04-09 15:35:11 192.168.1.150 GET /exchange/missionit/Inbox/ Cmd=contents 443 - 24.227.167.50 Mozilla/5.0+(Windows+NT+6. 1;+WOW64;+ rv:11.0)+G ecko/20100 101+Firefo x/11.0 401 2 2148074254
2012-04-09 15:35:11 192.168.1.150 GET /exchange/missionit/Inbox/ Cmd=contents 443 - 24.227.167.50 Mozilla/5.0+(Windows+NT+6. 1;+WOW64;+ rv:11.0)+G ecko/20100 101+Firefo x/11.0 401 1 0
2012-04-09 15:35:11 192.168.1.150 GET /exchange/missionit/Inbox/ Cmd=contents 443 TIEMANN\missionit 24.227.167.50 Mozilla/5.0+(Windows+NT+6. 1;+WOW64;+ rv:11.0)+G ecko/20100 101+Firefo x/11.0 200 0 0
2012-04-09 15:35:18 192.168.1.150 GET /exchange/missionit/ Cmd=logoff 443 TIEMANN\missionit 24.227.167.50 Mozilla/5.0+(Windows+NT+6. 1;+WOW64;+ rv:11.0)+G ecko/20100 101+Firefo x/11.0 302 0 0
2012-04-09 15:35:18 192.168.1.150 GET /exchweb/bin/USA/logoff.as p - 443 TIEMANN\missionit 24.227.167.50 Mozilla/5.0+(Windows+NT+6. 1;+WOW64;+ rv:11.0)+G ecko/20100 101+Firefo x/11.0 200 0 0
2012-04-09 15:35:33 192.168.1.150 GET /exchange/ - 443 TIEMANN\missionit 24.227.167.50 Mozilla/5.0+(Windows+NT+6. 1;+WOW64;+ rv:11.0)+G ecko/20100 101+Firefo x/11.0 200 0 0
2012-04-09 15:35:33 192.168.1.150 GET /exchange/missionit/ Cmd=navbar 443 TIEMANN\missionit 24.227.167.50 Mozilla/5.0+(Windows+NT+6. 1;+WOW64;+ rv:11.0)+G ecko/20100 101+Firefo x/11.0 200 0 0
2012-04-09 15:35:33 192.168.1.150 GET /exchange/missionit/Inbox/ Cmd=contents 443 - 24.227.167.50 Mozilla/5.0+(Windows+NT+6. 1;+WOW64;+ rv:11.0)+G ecko/20100 101+Firefo x/11.0 401 2 2148074254
2012-04-09 15:35:33 192.168.1.150 GET /exchange/missionit/Inbox/ Cmd=contents 443 - 24.227.167.50 Mozilla/5.0+(Windows+NT+6. 1;+WOW64;+ rv:11.0)+G ecko/20100 101+Firefo x/11.0 401 1 0
2012-04-09 15:35:33 192.168.1.150 GET /exchange/missionit/Inbox/ Cmd=contents 443 TIEMANN\missionit 24.227.167.50 Mozilla/5.0+(Windows+NT+6. 1;+WOW64;+ rv:11.0)+G ecko/20100 101+Firefo x/11.0 200 0 0
2012-04-09 15:35:49 192.168.1.150 UNSUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-09 15:35:49 192.168.1.150 UNSUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-09 15:35:49 192.168.1.150 UNSUBSCRIBE /exchange-oma/rtiemann@tlc developmen t.com/ - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 207 0 0
2012-04-09 15:35:50 192.168.1.150 POST /Microsoft-Server-ActiveSy nc User=robert&DeviceId=ApplC 39GF97WDTD 5&DeviceTy pe=iPhone& Cmd=Ping&L og=V4TNASN C:0A0C0D0F S:0A0C0D0S P:2C24I179 26S675620R 0S0L600H0P 443 TIEMANN\robert 166.147.79.5 Apple-iPhone4C1/902.179 200 0 0
2012-04-09 15:36:08 192.168.1.150 PROPFIND /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-09 15:36:08 192.168.1.150 PROPFIND /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5 - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 207 0 0
2012-04-09 15:36:08 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-16d 5 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-09 15:36:08 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-16d 5 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-09 15:36:08 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-16d 5 - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 0
2012-04-09 15:36:08 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc developmen t.com/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-09 15:36:08 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc developmen t.com/ - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 207 0 0
2012-04-09 15:36:08 192.168.1.150 PUT /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-16d 5 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-09 15:36:08 192.168.1.150 PUT /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-16d 5 - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 0
2012-04-09 15:36:09 192.168.1.150 POST /Microsoft-Server-ActiveSy nc User=robert&DeviceId=ApplC 39GF97WDTD 5&DeviceTy pe=iPhone& Cmd=Sync&L og=V4TEmSS C:0A0C0D0F S:1A0C0D0S P:1C4I1862 80S376434R 0S21L0H0P 443 TIEMANN\robert 166.147.79.5 Apple-iPhone4C1/902.179 200 0 0
2012-04-09 15:36:09 192.168.1.150 PROPFIND /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-09 15:36:09 192.168.1.150 PROPFIND /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5 - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 207 0 0
2012-04-09 15:36:09 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-16d 5 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-09 15:36:09 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-16d 5 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-09 15:36:09 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-16d 5 - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 0
2012-04-09 15:36:09 192.168.1.150 PROPFIND /exchange-oma/rtiemann@tlc developmen t.com/-Fla tUrlSpace- /a97f5a339 9961c458f8 a807381e40 baf-16d5/a 97f5a33999 61c458f8a8 07381e40ba f-3f81c1 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-09 15:36:09 192.168.1.150 PROPFIND /exchange-oma/rtiemann@tlc developmen t.com/-Fla tUrlSpace- /a97f5a339 9961c458f8 a807381e40 baf-16d5/a 97f5a33999 61c458f8a8 07381e40ba f-3f81c1 - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 207 0 0
2012-04-09 15:36:09 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/Inbo x/Schedule +for+Rowe+ Lane+Audit .EML - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-09 15:36:09 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/Inbo x/Schedule +for+Rowe+ Lane+Audit .EML - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-09 15:36:09 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/Inbo x/Schedule +for+Rowe+ Lane+Audit .EML - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 64
2012-04-09 15:36:10 192.168.1.150 POST /Microsoft-Server-ActiveSy nc User=robert&DeviceId=ApplC 39GF97WDTD 5&DeviceTy pe=iPhone& Cmd=Sync&L og=V4TEmSS C:0A0C0D1F S:0A0C0D0S P:1C4I2203 S380744R0S 0L0H0P 443 TIEMANN\robert 166.147.79.5 Apple-iPhone4C1/902.179 200 0 0
2012-04-09 15:36:14 192.168.1.150 GET /exchange - 443 - 24.227.167.50 Mozilla/5.0+(compatible;+M SIE+9.0;+W indows+NT+ 6.1;+WOW64 ;+Trident/ 5.0) 401 2 2148074254
2012-04-09 15:36:19 192.168.1.150 PROPFIND /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-09 15:36:19 192.168.1.150 PROPFIND /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5 - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 207 0 0
2012-04-09 15:36:19 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-16d 7 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-09 15:36:19 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-16d 7 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-09 15:36:19 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-16d 7 - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 0
2012-04-09 15:36:19 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc developmen t.com/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-09 15:36:19 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc developmen t.com/ - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 207 0 0
2012-04-09 15:36:19 192.168.1.150 POST /Microsoft-Server-ActiveSy nc User=robert&DeviceId=ApplC 39GF97WDTD 5&DeviceTy pe=iPhone& Cmd=Sync&L og=V4TEmSS C:0A0C0D0F S:0A0C0D0S P:1C3I3443 S100072R0S 0L0H0P 443 TIEMANN\robert 166.147.79.5 Apple-iPhone4C1/902.179 200 0 0
2012-04-09 15:36:19 192.168.1.150 PROPFIND /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-09 15:36:19 192.168.1.150 PROPFIND /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5 - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 207 0 0
2012-04-09 15:36:19 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-16d 5 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 2 2148074254
2012-04-09 15:36:19 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-16d 5 - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-09 15:36:19 192.168.1.150 GET /exchange-oma/rtiemann@tlc developmen t.com/NON_ IPM_SUBTRE E/Microsof t-Server-A ctiveSync/ iPhone/App lC39GF97WD TD5/a97f5a 3399961c45 8f8a807381 e40baf-16d 5 - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 200 0 0
2012-04-09 15:36:19 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc developmen t.com/ - 80 - 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 401 1 0
2012-04-09 15:36:19 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc developmen t.com/ - 80 TIEMANN\robert 192.168.1.150 Microsoft-Server-ActiveSyn c/6.5.7638 .1 207 0 0
2012-04-09 15:36:20 192.168.1.150 POST /Microsoft-Server-ActiveSy nc User=robert&DeviceId=ApplC 39GF97WDTD 5&DeviceTy pe=iPhone& Cmd=Sync&L og=V4TEmSS C:0A0C0D0F S:0A0C0D0S P:1C3I7691 S369336R0S 0L0H0P 443 TIEMANN\robert 166.147.79.5 Apple-iPhone4C1/902.179 200 0 0
2012-04-09 15:36:22 192.168.1.150 GET /exchange - 443 - 24.227.167.50 Mozilla/5.0+(compatible;+M SIE+9.0;+W indows+NT+ 6.1;+WOW64 ;+Trident/ 5.0) 401 1 0
2012-04-09 15:36:22 192.168.1.150 GET /exchange - 443 - 24.227.167.50 Mozilla/5.0+(compatible;+M SIE+9.0;+W indows+NT+ 6.1;+WOW64 ;+Trident/ 5.0) 401 1 2148074252
2012-04-09 15:35:11 192.168.1.150 GET /exchange/ - 443 - 24.227.167.50 Mozilla/5.0+(Windows+NT+6.
2012-04-09 15:35:11 192.168.1.150 GET /exchange/ - 443 - 24.227.167.50 Mozilla/5.0+(Windows+NT+6.
2012-04-09 15:35:11 192.168.1.150 GET /exchange/ - 443 TIEMANN\missionit 24.227.167.50 Mozilla/5.0+(Windows+NT+6.
2012-04-09 15:35:11 192.168.1.150 GET /exchange/missionit/ Cmd=navbar 443 TIEMANN\missionit 24.227.167.50 Mozilla/5.0+(Windows+NT+6.
2012-04-09 15:35:11 192.168.1.150 GET /exchange/missionit/Inbox/
2012-04-09 15:35:11 192.168.1.150 GET /exchange/missionit/Inbox/
2012-04-09 15:35:11 192.168.1.150 GET /exchange/missionit/Inbox/
2012-04-09 15:35:18 192.168.1.150 GET /exchange/missionit/ Cmd=logoff 443 TIEMANN\missionit 24.227.167.50 Mozilla/5.0+(Windows+NT+6.
2012-04-09 15:35:18 192.168.1.150 GET /exchweb/bin/USA/logoff.as
2012-04-09 15:35:33 192.168.1.150 GET /exchange/ - 443 TIEMANN\missionit 24.227.167.50 Mozilla/5.0+(Windows+NT+6.
2012-04-09 15:35:33 192.168.1.150 GET /exchange/missionit/ Cmd=navbar 443 TIEMANN\missionit 24.227.167.50 Mozilla/5.0+(Windows+NT+6.
2012-04-09 15:35:33 192.168.1.150 GET /exchange/missionit/Inbox/
2012-04-09 15:35:33 192.168.1.150 GET /exchange/missionit/Inbox/
2012-04-09 15:35:33 192.168.1.150 GET /exchange/missionit/Inbox/
2012-04-09 15:35:49 192.168.1.150 UNSUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-09 15:35:49 192.168.1.150 UNSUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-09 15:35:49 192.168.1.150 UNSUBSCRIBE /exchange-oma/rtiemann@tlc
2012-04-09 15:35:50 192.168.1.150 POST /Microsoft-Server-ActiveSy
2012-04-09 15:36:08 192.168.1.150 PROPFIND /exchange-oma/rtiemann@tlc
2012-04-09 15:36:08 192.168.1.150 PROPFIND /exchange-oma/rtiemann@tlc
2012-04-09 15:36:08 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-09 15:36:08 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-09 15:36:08 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-09 15:36:08 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc
2012-04-09 15:36:08 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc
2012-04-09 15:36:08 192.168.1.150 PUT /exchange-oma/rtiemann@tlc
2012-04-09 15:36:08 192.168.1.150 PUT /exchange-oma/rtiemann@tlc
2012-04-09 15:36:09 192.168.1.150 POST /Microsoft-Server-ActiveSy
2012-04-09 15:36:09 192.168.1.150 PROPFIND /exchange-oma/rtiemann@tlc
2012-04-09 15:36:09 192.168.1.150 PROPFIND /exchange-oma/rtiemann@tlc
2012-04-09 15:36:09 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-09 15:36:09 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-09 15:36:09 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-09 15:36:09 192.168.1.150 PROPFIND /exchange-oma/rtiemann@tlc
2012-04-09 15:36:09 192.168.1.150 PROPFIND /exchange-oma/rtiemann@tlc
2012-04-09 15:36:09 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-09 15:36:09 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-09 15:36:09 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-09 15:36:10 192.168.1.150 POST /Microsoft-Server-ActiveSy
2012-04-09 15:36:14 192.168.1.150 GET /exchange - 443 - 24.227.167.50 Mozilla/5.0+(compatible;+M
2012-04-09 15:36:19 192.168.1.150 PROPFIND /exchange-oma/rtiemann@tlc
2012-04-09 15:36:19 192.168.1.150 PROPFIND /exchange-oma/rtiemann@tlc
2012-04-09 15:36:19 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-09 15:36:19 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-09 15:36:19 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-09 15:36:19 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc
2012-04-09 15:36:19 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc
2012-04-09 15:36:19 192.168.1.150 POST /Microsoft-Server-ActiveSy
2012-04-09 15:36:19 192.168.1.150 PROPFIND /exchange-oma/rtiemann@tlc
2012-04-09 15:36:19 192.168.1.150 PROPFIND /exchange-oma/rtiemann@tlc
2012-04-09 15:36:19 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-09 15:36:19 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-09 15:36:19 192.168.1.150 GET /exchange-oma/rtiemann@tlc
2012-04-09 15:36:19 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc
2012-04-09 15:36:19 192.168.1.150 SEARCH /exchange-oma/rtiemann@tlc
2012-04-09 15:36:20 192.168.1.150 POST /Microsoft-Server-ActiveSy
2012-04-09 15:36:22 192.168.1.150 GET /exchange - 443 - 24.227.167.50 Mozilla/5.0+(compatible;+M
2012-04-09 15:36:22 192.168.1.150 GET /exchange - 443 - 24.227.167.50 Mozilla/5.0+(compatible;+M
Are the last two entries the relevant ones?
2012-04-09 15:36:22 192.168.1.150 GET /exchange - 443 - 24.227.167.50 Mozilla/5.0+(compatible;+M SIE+9.0;+W indows+NT+ 6.1;+WOW64 ;+Trident/ 5.0) 401 1 0
2012-04-09 15:36:22 192.168.1.150 GET /exchange - 443 - 24.227.167.50 Mozilla/5.0+(compatible;+M SIE+9.0;+W indows+NT+ 6.1;+WOW64 ;+Trident/ 5.0) 401 1 2148074252
The dash (-) after the /exchange part indicates that either the browser hasn't sent the credentials yet, or that they are incorrect. It's common to see one request logged with a dash, quickly followed by another with a username in place of the dash. This just means that the server is saying 'try again, but send me some credentials next time'. However, if you don't see a second line with a username in it, it means that the server has not accepted the credentials, or the browser just isn't sending them. If there was a username in there and there was still a 401 (access denied) at the end of the line, then that would mean that the credentials were correct, but that the user didn'y have enough permissions to access one or more resources. But where the username is empty, then the credentials are just not being accepted at all.
Do you have forms-based authentication enabled (i.e. the blue logon page)? If so, does the affected user see it, or do they get the repeated popup logon prompts before they even get to see the logon page?
2012-04-09 15:36:22 192.168.1.150 GET /exchange - 443 - 24.227.167.50 Mozilla/5.0+(compatible;+M
2012-04-09 15:36:22 192.168.1.150 GET /exchange - 443 - 24.227.167.50 Mozilla/5.0+(compatible;+M
The dash (-) after the /exchange part indicates that either the browser hasn't sent the credentials yet, or that they are incorrect. It's common to see one request logged with a dash, quickly followed by another with a username in place of the dash. This just means that the server is saying 'try again, but send me some credentials next time'. However, if you don't see a second line with a username in it, it means that the server has not accepted the credentials, or the browser just isn't sending them. If there was a username in there and there was still a 401 (access denied) at the end of the line, then that would mean that the credentials were correct, but that the user didn'y have enough permissions to access one or more resources. But where the username is empty, then the credentials are just not being accepted at all.
Do you have forms-based authentication enabled (i.e. the blue logon page)? If so, does the affected user see it, or do they get the repeated popup logon prompts before they even get to see the logon page?
ASKER
Here is a better sample of the logs
I tried to log in as the user rtiemann twice with no success. I did not get any errors, just re-prompted for username and password. I have already changed the password so I know creds are correct.
At the end I logged in with another user account called missionit which worked.
How do I check to see if forms based authentication is enabled?
2012-04-16 14:38:01 192.168.1.150 GET /exchange/ - 443 - 24.227.167.50 Mozilla/5.0+(Windows+NT+6. 1;+WOW64;+ rv:11.0)+G ecko/20100 101+Firefo x/11.0 401 2 2148074254
2012-04-16 14:38:10 192.168.1.150 GET /exchange/ - 443 - 24.227.167.50 Mozilla/5.0+(Windows+NT+6. 1;+WOW64;+ rv:11.0)+G ecko/20100 101+Firefo x/11.0 401 1 0
2012-04-16 14:38:10 192.168.1.150 GET /exchange/ - 443 - 24.227.167.50 Mozilla/5.0+(Windows+NT+6. 1;+WOW64;+ rv:11.0)+G ecko/20100 101+Firefo x/11.0 401 1 2148074252
2012-04-16 14:38:17 192.168.1.150 GET /exchange/ - 443 - 24.227.167.50 Mozilla/5.0+(Windows+NT+6. 1;+WOW64;+ rv:11.0)+G ecko/20100 101+Firefo x/11.0 401 1 0
2012-04-16 14:38:17 192.168.1.150 GET /exchange/ - 443 - 24.227.167.50 Mozilla/5.0+(Windows+NT+6. 1;+WOW64;+ rv:11.0)+G ecko/20100 101+Firefo x/11.0 401 1 2148074252
2012-04-16 14:38:23 192.168.1.150 GET /exchange/ - 443 - 24.227.167.50 Mozilla/5.0+(Windows+NT+6. 1;+WOW64;+ rv:11.0)+G ecko/20100 101+Firefo x/11.0 401 1 0
2012-04-16 14:38:23 192.168.1.150 GET /exchange/ - 443 TIEMANN\missionit 24.227.167.50 Mozilla/5.0+(Windows+NT+6. 1;+WOW64;+ rv:11.0)+G ecko/20100 101+Firefo x/11.0 200 0 0
I tried to log in as the user rtiemann twice with no success. I did not get any errors, just re-prompted for username and password. I have already changed the password so I know creds are correct.
At the end I logged in with another user account called missionit which worked.
How do I check to see if forms based authentication is enabled?
2012-04-16 14:38:01 192.168.1.150 GET /exchange/ - 443 - 24.227.167.50 Mozilla/5.0+(Windows+NT+6.
2012-04-16 14:38:10 192.168.1.150 GET /exchange/ - 443 - 24.227.167.50 Mozilla/5.0+(Windows+NT+6.
2012-04-16 14:38:10 192.168.1.150 GET /exchange/ - 443 - 24.227.167.50 Mozilla/5.0+(Windows+NT+6.
2012-04-16 14:38:17 192.168.1.150 GET /exchange/ - 443 - 24.227.167.50 Mozilla/5.0+(Windows+NT+6.
2012-04-16 14:38:17 192.168.1.150 GET /exchange/ - 443 - 24.227.167.50 Mozilla/5.0+(Windows+NT+6.
2012-04-16 14:38:23 192.168.1.150 GET /exchange/ - 443 - 24.227.167.50 Mozilla/5.0+(Windows+NT+6.
2012-04-16 14:38:23 192.168.1.150 GET /exchange/ - 443 TIEMANN\missionit 24.227.167.50 Mozilla/5.0+(Windows+NT+6.
You can see where it has accepted the missionit login, because the username is recorded. However, in the previous lines, there is only a dash, which means that it didn't accept the username at all. This would normally mean that the user had just supplied the wrong password, but I'm quite sure you've thought of that one. But it might also mean the account is disabled, or locked out. Again, you've probably checked that too. It might be that the user doesn't have the 'log on to this computer' right. But that only applies if you use Basic auth, which is why I ask about what sort of authentication you use. You can tell if Forms-Based Auth is enabled easily enough. When you go to OWA, do you see a little popup logon box, or do you see a page with a (usually) blue background and MS graphics all over it?
ASKER
@ LeeDerbyshire,
you are correct about everything you mentioned. When I go to OWA it is a pop up log on box. No page for logging in.
you are correct about everything you mentioned. When I go to OWA it is a pop up log on box. No page for logging in.
Okay, so you have Basic auth and/or Integrated auth enabled. It's hard to be sure which, if you see the popup login box, since they look the same. But since Firefox only works with Basic auth anyway (only MS browsers understand how to use MS integrated auth), you can be sure that you are using the Basic auth method in this case. But it raises an interesting question. Since IE can use Integrated auth, what happens if the affected user tries to access OWA in IE, rather than FF?
ASKER
I just tried IE and got the same result.
Okay, best to have a look in Exchange System Manager at the properties of the HTTP Virtual Directory (unders servers/protocols/http), and see whether Basic and/or Integrated is/are enabled.
ASKER
Both Basic and integrated is enabled.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
During testing I rebooted the server for the millionth time and all seems to be working now. Been working for a week with no issue.<br /><br />Thank you for your help!