Announcement

Collapse
No announcement yet.

Log bad login attempts

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Log bad login attempts

    Hi Everyone. I have a question. I used to have an Exchange 2k3 setup running on Windows 2000 Advanced Server. On that setup, whenever someone would login in with bad user name or password (which everyone uses OWA) it would log that in the Windows Event viewer with a yellow exclamation in a triangle I beleive...may even have been called a WSVC32 or something similar.

    I now have a new/clean exchange installation with Exchange 2003 SP2 and Windows 2003 standard SP2...when users mess up logging in to OWA nothing gets flagged in the event viewer.

    I need some assistance....I am sure that it is just something that needs turned on somewhere I just don't know where I should look.

    Thanks, RC!!

  • #2
    Re: Log bad login attempts

    The authentication attempt will be logged in the IIS logs which you can query. Otherwise you have to adjust the diagnostic logging which is on the properties of the server in ESM.

    Simon.
    --
    Simon Butler
    Exchange MVP

    Blog: http://blog.sembee.co.uk/
    More Exchange Content: http://exchange.sembee.info/
    Exchange Resources List: http://exbpa.com/
    In the UK? Hire me: http://www.sembee.co.uk/

    Sembee is a registered trademark, used here with permission.

    Comment


    • #3
      Re: Log bad login attempts

      Originally posted by Sembee View Post
      The authentication attempt will be logged in the IIS logs which you can query. Otherwise you have to adjust the diagnostic logging which is on the properties of the server in ESM.

      Simon.
      Is that located under the Domain Controller Setup from the Start->Programs->Administrative Tools?

      RC

      Comment


      • #4
        Re: Log bad login attempts

        What Simon means with the second suggestion is go into Exchange System Manager, right-click on your server, then choose the diagnostics logging tab.

        I'm not sure which service you will need to log though, sorry.

        Comment


        • #5
          Re: Log bad login attempts

          No, I am referring to IIS logs, which are by default in \Windows\System32\LogFiles\W3svc1 for the default web site. That is on the server itself, not the domain controller.

          Simon.
          --
          Simon Butler
          Exchange MVP

          Blog: http://blog.sembee.co.uk/
          More Exchange Content: http://exchange.sembee.info/
          Exchange Resources List: http://exbpa.com/
          In the UK? Hire me: http://www.sembee.co.uk/

          Sembee is a registered trademark, used here with permission.

          Comment

          Working...
          X