Exchange 2010 Monitoring

How can I check what accounts are being logged into via OWA? an account I have removed permissions on (as they have left the business) is still showing the odd email as read and I want to ensure this is legit and not an intrusion.

Thanks
LVL 1
Dan130Asked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Andy MIT Systems ManagerCommented:
I believe if you check the IIS web logs it details access attempts on there.

If you suspect the user is trying to access his emails you could always disable the AD account, change the password, or disable OWA access to that account.

It's worth checking if the account was used on a mobile phone at all and disable that access method to the account via exchange or if any other users have access to that mailbox.
Dan130Author Commented:
Hi Andy,

Account has been disabled for a week or so now, access has been disabled via OWA and mobile access sync is around the same time. ill check the IIS logs my worry is that the person that has left has the details of the account that is currently reviewing his emails for monitoring purposes. could I check the public IP address that's being used when attempting to log in,.
Andy MIT Systems ManagerCommented:
I believe the IIS logs should show external IP of the conection however if the user is using a dynamic line it may come up with different addresses. If you believe that the user is using a different account to access the emails I would strongly recommend changing all user account passwords in the first instance.
Andy MIT Systems ManagerCommented:
Oh and Windows server security log should also show login events for the account in question and which IP is logged in from.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Exchange

From novice to tech pro — start learning today.