Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am looking for the easiest way to view/audit which users are logging in to ActiveSync on my Exchange Server 2003 machine. For example, various adroid/iphone and other mobile devices are set up this way. I would like to be able to report or view who is currently using it, ideally for a time frame.

I am assuming there is probably a log file in IIS, and I could run that through some kind of analysis software, but is there some other built in reporting / analysis tool (or easier method)?

share|improve this question
up vote 4 down vote accepted

Your question is truncated (stopping with "but is"), but I suspect you were asking if there is some "easier" log file than the IIS logs. While it's possible that the "Security" event log could yield some information (depending on how your Audit Policy is configured) the logs for the IIS Web Site hosting the Exchange-ActiveSync folder really are your best bet.

The analysis doesn't have to be too difficult, though. Unix-style text processing utilities would be one avenue if you're comfortable with cut, grep, sort, and uniq .

Another, possibly more "friendly" avenue, would be to use Microsoft LogParser (which the Exchange Team Blog has some coverage on in a couple of different postings).

share|improve this answer
Yep. The Outlook Mobile Access IIS log records always have "/Microsoft-Server-ActiveSync" in the 7th column (assuming w3c logging), and the domain\username in the 10th column. Also, if the logs are less than 1,000,000 lines, it may be possible to use Excel 2010, as the IIS logs are usually space-delimited fairly reliably. – Greg Askew Feb 25 '12 at 19:42

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.