<div>
There included in one of the IIS logs and includes the IP address in each line. You'd have to filter all the internal IP addresses out (from the correct column, as the source server's IP is also always there). So it will take a heavy computer to do this job.
</div>


There included in one of the IIS logs and includes the IP address in each line. You'd have to filter all the internal IP addresses out (from the correct column, as the source server's IP is also always there). So it will take a heavy computer to do this job.

<div>
Thanks. I know where the logs are placed, I also understand the information is there, I am trying to find some way to parse them to get only external/internet connections.
</div>


Thanks. I know where the logs are placed, I also understand the information is there, I am trying to find some way to parse them to get only external/internet connections.

<div>
No comment has been added to this question in more than 21 days, so it is now classified as abandoned.<br />
<br />
I have recommended this question be closed as follows:<br />
<br />
Accept: 'Bembi' (<a href="https:#a43307126" rel="ugc">https:#a43307126</a>)<br />
<br />
If you feel this question should be closed differently, post an objection and the moderators will review all objections and close it as they feel fit. If no one objects, this question will be closed automatically the way described above.<br />
<br />
seth2740<br />
Experts-Exchange Cleanup Volunteer
</div>


No comment has been added to this question in more than 21 days, so it is now classified as abandoned.

I have recommended this question be closed as follows:

Accept: 'Bembi' (https:#a43307126 [https:#a43307126])

If you feel this question should be closed differently, post an objection and the moderators will review all objections and close it as they feel fit. If no one objects, this question will be closed automatically the way described above.

seth2740
Experts-Exchange Cleanup Volunteer

<div>
<div class="content wysiwyg-content">
Hello Experts, <br />
<br />
We need to search the OWA logs to identify the users that are accessing OWA externally ( internet). I was wondering if someone has done this before and can please share the steps, script or procedure on how to get this done. <br />
&nbsp;<br />
We are running Exchange 2016 On premise.<br />
<br />
Thank you
</div>
</div>


Hello Experts, 

We need to search the OWA logs to identify the users that are accessing OWA externally ( internet). I was wondering if someone has done this before and can please share the steps, script or procedure on how to get this done. 
 
We are running Exchange 2016 On premise.

Thank you

Need to search OWA logs to identify the users that access OWA externally

Windows PowerShell is a task automation and configuration management framework from Microsoft, consisting of a command-line shell and associated scripting language built on the .NET Framework. PowerShell provides full access to the Component Object Model (COM) and Windows Management Instrumentation (WMI), enabling administrators to perform administrative tasks on both local and remote Windows systems as well as WS-Management and Common Information Model (CIM) enabling management of remote Linux systems and network devices.

Powershell

Exchange is the server side of a collaborative application product that is part of the Microsoft Server infrastructure. Exchange's major features include email, calendaring, contacts and tasks, support for mobile and web-based access to information, and support for data storage.

Exchange

Within Internet message handling services (MHS), a message transfer agent or mail transfer agent (MTA) or mail relay is software that transfers electronic mail messages from one computer to another using a client–server application architecture. A MTA implements both the client (sending) and server (receiving) portions of the Simple Mail Transfer Protocol (SMTP). The terms mail server, mail exchanger, and MX host may also refer to a computer performing the MTA function. The Domain Name System (DNS) associates a mail server to a domain with mail exchanger (MX) resource records containing the domain name of a host providing MTA services.