1

Is there a way to find out, what is the last time a user logged in to OWA? (Actually, it would be even better to find out, if he read his emails, but I don't think that's possible.)

If there are logs that contain such kinds of activities, where can I find them? Or if they need to be activated, where can I do that?

1 Answer 1

4

Apparently you can do this using MS Logparser to extract the relevant information from your IIS logs.

Download MS Log Parser 2.2 and install - download from: http://www.microsoft.com/en-us/download/details.aspx?id=24659

Grab your log files from C:\inetpub\logs\LogFiles\W3SVC1, copy them to C:\log\ and merge them into one big log file using

logparser.exe -i:iisw3c “select * into c:\log\mergedlog\merge.log from c:\log\*” -o:csv

Get OWA logins using

LogParser -i:csv “SELECT cs-username, date, time, c-ip, cs-uri-stem, cs(User-Agent) FROM C:\log\mergedlog\merge.log TO C:\log\Output.csv WHERE cs-method LIKE ‘%get%’ and cs-uri-stem LIKE ‘%owa%’

Source: http://myriadofthings.com/outlook-web-access-owa-and-activesync-reporting-using-iis-logs/

1
  • I'm not going to do it with Log Parser, but thanks anyway.
    – marsze
    Nov 29, 2013 at 14:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .