Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible, using Logparser or similar, to report on Exchange 2003/2010 mailbox access from users who are not the mailbox owner?

The access might come from an Outlook client or OWA so I presume this would need a query for the IIS logs and also a query for the machine event logs?


share|improve this question

According to this article:

  • It appears the IIS logs will contain user information in the cs-username column. You can find failed attempts by looking for reason=2 in the cs-uri-query.

  • In the Security event log Event ID 4625 contains information about failed login attempts.

Given that it appears to be stored in both locations, the easiest solution may be to just use the Event Viewer and filter down to that specific Event ID.

Otherwise "select top 10 * from u_ex*.log where cs-uri-query like '%reason=2%'" would be your starting point for the logparser query against the IIS logs.

share|improve this answer
Thanks for the follow up. Part of the issue is that there may not be a failed login attempt. We're trying to identify instances of admin-type users abusing their positions unfortunately. – Danny Aug 21 '12 at 19:24
Ah, that sucks. If you post some anonymized IIS logs we might be able to see if there's a successful login stored. I haven't worked with Exchange Server logs, but if it stores the authenticated user, you might be able to parse out large amounts of activity. Or they might be crafty ... Yuck. – James Skemp Aug 22 '12 at 23:21
I'll see what I can get and post shortly. Thanks – Danny Aug 24 '12 at 9:23

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.