Ability to log FAILED logon attempts to CAS server?

We are currently logging all security events from domain controllers as well as IIS/Advanced IIS logs on our CAS servers.  We wish to detect brute force attacks on OWA as well as trace back failed logon attmpts to our CAS servers.

In other words, we are looking for our CAS servers to log something along the lines of "This IP connected to this CAS server and attempted to authenticate JDOE unsuccessfully"

Right now I can see CAS activity, I see a particular user with multiple devices (Mac running Outlook, iPhone, another iPhone, and a web client running Firefox on Win 7) and we are able to see failed logon attempts for the user account between the CAS server and the Domain Controller.  What we CANNOT see is which device is generating the failed logons.
LNKDLNY2Asked:
Who is Participating?
 
Simon Butler (Sembee)Connect With a Mentor ConsultantCommented:
You need to query the IIS logs - they should contain that information. If they don't by default, then you can adjust the logging levels to include it. Then just find something that will query those logs to give you the information that you need.

Simon.
0
 
LNKDLNY2Author Commented:
Thanks Simon.  Yes, we are collecting the IIS logs but I think I need to play with the logging level.  I will look into that tomorrow and update this thread with my findings for others that may run into this problem.

As it is now, the advanced IIS logging is indeed capturing source IP for connections but there is no indicator whether an authentication failed or not.
0
 
zackmccrackenCommented:
i dont know if you are able to combine the security events and the iis logs based on timestamp? should give you an ip address + username
0
 
LNKDLNY2Author Commented:
Our problem with simply correlating with security logs is that sometimes any given user may have multiple devices configured for activesync and we can see the failed sec logs but can only correlate to maybe 2 or 3 devices that are active at that time which is not sufficient.  

I think grabbing the 401 logs from the IIS service might be what I need.  For some reason our CAS servers have advanced logging but not standard logging turned on.  I am going to test that out and see what I can collect.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.