2

I am looking for the easiest way to view/audit which users are logging in to ActiveSync on my Exchange Server 2003 machine. For example, various adroid/iphone and other mobile devices are set up this way. I would like to be able to report or view who is currently using it, ideally for a time frame.

I am assuming there is probably a log file in IIS, and I could run that through some kind of analysis software, but is there some other built in reporting / analysis tool (or easier method)?

Scott Szretter
  • 1,860
  • 11
  • 42
  • 66

1 Answers1

4

Your question is truncated (stopping with "but is"), but I suspect you were asking if there is some "easier" log file than the IIS logs. While it's possible that the "Security" event log could yield some information (depending on how your Audit Policy is configured) the logs for the IIS Web Site hosting the Exchange-ActiveSync folder really are your best bet.

The analysis doesn't have to be too difficult, though. Unix-style text processing utilities would be one avenue if you're comfortable with cut, grep, sort, and uniq .

Another, possibly more "friendly" avenue, would be to use Microsoft LogParser (which the Exchange Team Blog has some coverage on in a couple of different postings).

Evan Anderson
  • 141,071
  • 19
  • 191
  • 328
  • Yep. The Outlook Mobile Access IIS log records always have "/Microsoft-Server-ActiveSync" in the 7th column (assuming w3c logging), and the domain\username in the 10th column. Also, if the logs are less than 1,000,000 lines, it may be possible to use Excel 2010, as the IIS logs are usually space-delimited fairly reliably. – Greg Askew Feb 25 '12 at 19:42