IIS logs should show it:
https://serverfault.com/questions/947930/exchange-2016-how-to-audit-mailbox-user-access-to-get-their-ip
How to find exchange mailbox user last logon computer name/workstation?
Hi techies,
We have one username that always got locked out.
From the username, we trace the event id 4740 in Domain Controller and we found the "Caller Computer Name" was one of our exchange server. Since the user is a 'floater' user (doesn't have fix workstation), we need to trace on which workstation it was used to log in to the mailbox.
How we can find such information in Exchange console/ Exchange powershell console?
2 additional answers
Sort by: Most helpful
-
Joyce Shen - MSFT 16,641 Reputation points
2022-05-06T02:23:02.5+00:00 Hi @razc
Agree with the suggestion above from Andy, you could check the IIS log for the user login information:
The IIS log is enabled by default, the location is in C:\inetpub\logs\LogFiles\W3SVC1, and the log is generated once a day by default.
You could use Excel to analyse the logs or other tools like Log Parser StudioAnd the meanings of the fields are introduced here: W3C Logging
If an Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
-
razc 21 Reputation points
2022-05-13T05:54:58.06+00:00 Many thanks to @Andy David - MVP @Joyce Shen - MSFT for providing the answer. Yeap, this is what I am looking for.