find IP address of last ActiveSync checkin

[RabbieBurns]

We have a wifi iOS device that has gone awol in transit internationally, and the date/time of the last ActiveSync check in was a number of hours after the device was lost.

 

Is there any way I can check the IP address in Exchange logs of the last sync to check which country the device went missing in?

[pete]

Look in the IIS logs on the CAS server - you should see the ActiveSync connections.

[RabbieBurns]

had a look didnt see many logs under iis at all. Should I have increaded the logging level ?

[pete]

I don't recall doing so when I setup exchange (2007), but that doesn't mean I haven't had to debug something and left it like that because it didn't bloat the logs too much.

 

Looking in c:\inetpub\logs\logfiles\w3svc1\ I see log entries such as:

 

2014-09-03 00:07:28 SERVERIP POST /Microsoft-Server-ActiveSync/default.eas User=REDACTEDUSERNAME&DeviceId=REDACTEDDEVICEID&DeviceType=iPad&Cmd=Ping&Log=V121_LdapC1_LdapL0_RpcC28_RpcL31_Hb600_Rto1_Erq1_Pk3534166033_S1_ 443 DOMAIN\USERNAME REMOTEDEVICEIP Apple-iPad3C1/1104.201 200 0 1236 614827

 

That was an iPad doing a standard checkin and will give you user account, device and device IP info.

Edited September 4, 2014 by pete
less rushed now

[RabbieBurns]

cheers found it.

 

Last IP check in was still overseas and hasnt been online since...