Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We are having issues where users claim that their Outlook Web access login attempts are intermittently unsuccessful. After a few minutes, it works.

I suspect user error but I cannot confirm that without further investigation.

Would like to see logs to confirm this.

share|improve this question

2 Answers 2

up vote 1 down vote accepted

Check your IIS logs to see if that reveals anything.

Of particular interest in the logs might be the HTTP status code, however the URLs they are browsing could be interesting in case there is some issue where your users are being incorrectly bounced between servers and the authentication isn't being passed through correctly, or even at all.

I haven't really looked much at the Exchange 2010 IIS logs, but if your users are being directed to a page similar to you-put-your-password-in-wrong-you-numpty.aspx then that would probably be your definitive answer. In all seriousness though, if you purposefully authenticate incorrectly and see what that looks like in the IIS logs, you might see a similar pattern for other users (I'm thinking being directed to the logon page with some specific parameters in the query string like login.aspx?reason=xxx).

share|improve this answer

If you are auditing logins on the OWA server, I would expect them to show up there.

share|improve this answer
    
How do you turn on/view status of OWA login auditing? Also, by "OWA server", I'm assuming you mean the CAS, correct? –  Belmin Fernandez Jun 28 '11 at 14:14
    
This is not an OWA issue, but an OS issue. In Windows on the CA server, modify local security policy to audit successful and failed login attempts. (There should be a local Administration tool called "Local Security policy). –  uSlackr Jun 28 '11 at 14:18
1  
Auditing logons at the OS level isn't going to show you why the logons are failing, unless the failures are bad username/password failures. You need to log/monitor at the network and protocol level to determine if the failures are network or protocol errors. –  joeqwerty Jun 28 '11 at 14:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.