Check someone use the account and password to login the mailbox as owner

Question

Hi there,

We are using exchange server 2016.
How to check someone use the account and password to login the mailbox as owner?

To check Where and when logged in and what IP?

Answer 1

Hi @Beekhang TONGYER

Please have a check via the IIS logs on the Exchange server for the specific user name.
Default Location: C:\inetpub\logs\LogFiles\W3SVC1

The IIS logs would log the email client (Outlook or OWA) and ip address of the request, which can be used for further investigation.
(Please also note that by default the IIS log is using UTC time)

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.