How to find IP address from which client accessing mailbox using outlook / Owa / mobile device

_{Wednesday, May 27, 2015 5:10 AM}

hi 

one users wanted to know IP address from which his mailbox access using Outlook, OWA & mobile device 

if its mobile device need to find the OS version and type of device like  iphone / samsung 

i already tried get-logonstatistice , but it wont provide client IP address from which users access mailbox

sandip

_{Thursday, May 28, 2015 2:36 PM ✅Answered | 2 votes}

IIS logs would show IP for OWA connections (not MAPI = Outlook before Exchange 2013) but they are not very easy to read.

In case you are wondering where those logs are (by default):

C:\inetpub\logs\LogFiles\W3SVC1

I'm not sure about Message Tracking logs showing IP address of client machines.

Message Tracking logs don't even exist on a single role CAS:

"Exchange servers that have the Client Access server role or Unified Messaging server role don't have message tracking logs."

(from Lynn-Li's link above)

Message Tracking has to do with SMTP traffic (mail serve to mail server traffic). I don't know what "client-IP" is for but I don't think it has to do with client access via Outlook or OWA.

ExMon and Mailbox auditing might be better options.

Here's an article on mailbox auditing:

http://www.msexchange.org/articles-tutorials/exchange-server-2010/compliance-policies-archiving/auditing-mailbox-access.html

There's an example of auditing results where the IP address is shown (among tons of other barely readable data) and it happens to be an IPv6 address.

You may or may not be able to get OS and version of the mobile device with the tools above.

Please mark as helpful if you find my contribution useful or as an answer if it does answer your question. That will encourage me - and others - to take time out to help you.

_{Wednesday, May 27, 2015 5:59 AM}

Hi ,

you can make use of mailbox auditing and iis logs .

Thanks & Regards S.Nithyanandham

_{Wednesday, May 27, 2015 7:01 AM}

As said above, you need to enable mailbox audit logging that will let you get such information in depth.

To enable auditing on exchange mailboxes, you can download this PDF guide from given resource and follow the steps for the same : https://gallery.technet.microsoft.com/Enabling-Exchange-2010-368786d3

If you want to track such critical events into real time, this automated solution (http://www.mailboxaccessauditing.com/) could also be a good approach to deal in such circumstance.

_{Thursday, May 28, 2015 3:07 AM}

Hi,

ExMon should be the closest tool to satisfy your request. You can download here.

In addition, Message Tracking Logging can log the client-IP.

Refer from:

https://technet.microsoft.com/en-us/library/bb124926(v=exchg.141).aspx

Best Regards.

Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com

Lynn-Li
TechNet Community Support