Tracking OWA Access

[fil_b]

I know you can see who logged in via OWA in the security logs

 

but i was wandering if there was anywhere else that tracks who logged in and records what machine they was on??

 

In security logs it just puts the name of the server for the machine name

 

Thanks

 

Phil

[ChanderBatra]

You can get all the informaion from IIS logs. For more information you can google "Using OWA logs to make your civil case"

 

Actually it is difficult to manually go through log file to trace particular user account. I am also looking for a software which can parse IIS logs and give result in form of Report.

[fil_b]

You can get all the informaion from IIS logs. For more information you can google "Using OWA logs to make your civil case"

 

Actually it is difficult to manually go through log file to trace particular user account. I am also looking for a software which can parse IIS logs and give result in form of Report.

 

is this what i need

 

http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/5562d179-7807-47b2-a8d1-69549535e45e.mspx?mfr=true

[ChanderBatra]

I am not sure about Microsoft log parser. I'll check if it can parse .log file i.e. IIS log file which can be found in %systemroot%\system32\LogFiles\W3SVC1 directory.

I tried Managengine Event Log Analyzer to produce a report of IIS logs but that does not give desired output. I was known of some software which can scan text file (log file) for particular word and highlight all the lines in the text file having that word. Like in your case you can search for a user account name or LogonFrm.asp I have forgotten the name of that software. I'll search and let you know if I find something useful.

[Fivetwelve]

Hmm interesting topic. Something like this could be reasonably easy to code. I recently made something which parsed some horribly obfuscated HTML from a UK haulage companies tracking system and returned the interesting bits of information as a PHP array.

 

I may tackle something like this when I get some free time... if I do I'll keep you posted!

[CraigM]

I was reading some articles on msexchange.org about something similar to this, using Microsoft's Log Parser. The articles are here and here