Announcement

Collapse
No announcement yet.

Auditing OWA Logins

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Auditing OWA Logins

    Hi,

    I'm hoping someone could help with the following:

    I have 2 AD accounts/mailboxes; User A and User B. User A has full-mailbox access to User B's mailbox.
    I have 2 Exchange 2007 servers; Mailbox/Hub and CAS/Hub.

    I currently have mailbox access logging on and can see that the CAS/Hub server is accessing the mailbox of User B;
    "Windows User 'domain\CAS/Hub$' logged in to [email protected] mailbox, and is not the primary Windows account on this mailbox."

    I am certain that user A is accessing this mailbox through Outlook Web Access but am unsure how to set up logging so that it tells me so.

    Any help would be greatly appreciated.

    Kind regards,

    Rick

  • #2
    Re: Auditing OWA Logins

    OWA is just a web site. Therefore query the IIS logs for the default web site.

    Simon.
    --
    Simon Butler
    Exchange MVP

    Blog: http://blog.sembee.co.uk/
    More Exchange Content: http://exchange.sembee.info/
    Exchange Resources List: http://exbpa.com/
    In the UK? Hire me: http://www.sembee.co.uk/

    Sembee is a registered trademark, used here with permission.

    Comment


    • #3
      Re: Auditing OWA Logins

      Hi Simon,

      Thanks for your reply.

      I checked the logs the other day (%SystemDrive%\inetpub\logs\LogFiles\W3SVC1) but could only find an entry when a user logs on to OWA. I selected all fields for W3C but am unsure as to whether there is anything else I need to configure.

      Kind regards,

      Rick

      Comment


      • #4
        Re: Auditing OWA Logins

        If the user is accessing the mailbox through OWA, then that is all it will show - the authentication. If they are using their own credentials then that will show when they access the mailbox of the other user.

        Simon.
        --
        Simon Butler
        Exchange MVP

        Blog: http://blog.sembee.co.uk/
        More Exchange Content: http://exchange.sembee.info/
        Exchange Resources List: http://exbpa.com/
        In the UK? Hire me: http://www.sembee.co.uk/

        Sembee is a registered trademark, used here with permission.

        Comment


        • #5
          Re: Auditing OWA Logins

          Hi Simon,

          Thanks again for your replies. Took some figuring out but I believe I've found the lines in the log that represent logging on to another users inbox.

          2009-08-20 23:29:18 192.168.1.20 POST /owa/ev.owa oeh=1&ns=RecipWell&ev=Resolve&prfltncy=20&prfrpccn t=5&prfrpcltncy=0&prfldpcnt=1&prfldpltncy=16&prfav lcnt=0&prfavlltncy=0 443 UserA 192.168.1.101 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+5.1;+InfoPat h.2;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.04506.30) 200 0 0 203

          2009-08-20 23:29:20 10.10.10.23 GET /owa/[email protected] - 443 - 192.168.1.101 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+5.1;+InfoPat h.2;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.04506.30) 301 0 0 0

          Does this look correct to you?

          Kind regards,

          Rick

          Comment


          • #6
            Re: Auditing OWA Logins

            This shows the mailbox that was being accessed: GET /owa/[email protected]

            Simon.
            --
            Simon Butler
            Exchange MVP

            Blog: http://blog.sembee.co.uk/
            More Exchange Content: http://exchange.sembee.info/
            Exchange Resources List: http://exbpa.com/
            In the UK? Hire me: http://www.sembee.co.uk/

            Sembee is a registered trademark, used here with permission.

            Comment

            Working...
            X