Subscribe

RSS Feed (xml)

Powered By

Powered by Blogger

2016年8月12日 星期五

How to find out if user logged in to Exchange OWA?

1. please download Microsoft Log Parser 2.2 and install
Download: http://www.microsoft.com/en-us/download/details.aspx?id=24659

2. Copy your log files from C:\inetpub\logs\LogFiles\W3SVC1, to C:\log\ and merge them into one big log file using following command:

logparser.exe -i:iisw3c "select * into c:\log\merge.log from C:\Tools\W3SVC1\*" -o:csv


3. Get OWA logins using following command:

logParser -i:csv "SELECT cs-username, date, time, c-ip, cs-uri-stem, cs(User-Agent) FROM C:\log\merge.log TO C:\log\Output.csv WHERE cs-method LIKE '%get%' and cs-uri-stem LIKE '%owa%'