Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Where can I locate log data for exchange 2010 that will show me data such as users accessing the db, or failed logon attempts.

Thanks!

share|improve this question

3 Answers 3

up vote 4 down vote accepted

Login-attempts are filed with the normal Windows login attept log, in the Security event-log. I don't believe there is a way to disambiguate Exchange logins from normal Windows logins, but your Client-access servers shouldn't be seeing any plain-windows logins anyway, so it's safe to assume that everything there is Exchange-related.

I don't believe, though may be wrong, that there is a way to audit database-access. That kind of log would get insanely spammy in an organization of any size due to the amount of activity Outlook does just sitting there apparently doing nothing. The default Outlook connection mode is based on a pull model, so Outlook polls the Exchange server periodically (the interval can be tuned, but by default it is pretty short) which would be the kind of thing to get logged.

share|improve this answer

As far as I am aware, there isn't a way to audit access to the Mailbox databases. If a user is logged in and connected to Exchange (via OWA, Outlook client, or mobile device with ActiveSync), you can basically assume that they're interfaced with the mailbox servers.

User authentication for Exchange is handled by Active Directory. The Security Log in the client access server may contain some security auditing information, but the best place to look would be the security logs on the domain controller. This will only tell you who was authenticating when (and possibly the client they were connecting from). However, tracking when/where a user logged in can be difficult if you have multiple domain controllers because you would need to search the security logs on EVERY domain controller to find the information you're looking for. There are some 3rd party programs that will do this for you.

share|improve this answer

Assuming you're running Exchange 2010 SP1, you might be looking for Mailbox Audit Logging. You'll have to turn it on, and configure it for what you're looking for. Once you do, you'll definitely need to take care to watch out for the growth of this because it can get to be a lot of information pretty quickly.

As far as where you can find the logs, you'll need to run the powershell commands found in that article to see the logs, but I believe the info is stored in the individual mailboxes. I can't point to documentation on that one, so I might be mistaken about where they're stored.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.