How to find exchange mailbox user last logon computer name/workstation?

Question

Hi techies,

We have one username that always got locked out.

From the username, we trace the event id 4740 in Domain Controller and we found the "Caller Computer Name" was one of our exchange server. Since the user is a 'floater' user (doesn't have fix workstation), we need to trace on which workstation it was used to log in to the mailbox.

How we can find such information in Exchange console/ Exchange powershell console?

Answer 1

IIS logs should show it:
https://serverfault.com/questions/947930/exchange-2016-how-to-audit-mailbox-user-access-to-get-their-ip

Answer 2

Hi @razc

Agree with the suggestion above from Andy, you could check the IIS log for the user login information:

The IIS log is enabled by default, the location is in C:\inetpub\logs\LogFiles\W3SVC1, and the log is generated once a day by default.
You could use Excel to analyse the logs or other tools like Log Parser Studio

And the meanings of the fields are introduced here: W3C Logging

---

If an Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 3

Many thanks to @Andy David - MVP @Joyce Shen - MSFT for providing the answer. Yeap, this is what I am looking for.