none
How to see if a user is connecting as RPC over HTTPS or as a MAPI user

    Question

  • Hi All

    Is thare a way to see if a user is connecting to the server over RPC , or MAPI, on the server side?

    Thanks!!
    Tuesday, February 23, 2010 11:44 AM

Answers

All replies

  • Hi,

    I think you can use SMTP logging to find it accurately.

    SMTP protocol logging turned on by default.

    To enable protocol logging on Receive Connectors, use the following command:

    Set-ReceiveConnector "Connector Name" -ProtocolLoggingLevel verbose

     For Send Connectors (equivalent of SMTP Connectors), using the following command:

    Set-SendConnector "Send Connector Name" -ProtocolLoggingLevel verbose

    - Receive Connector logs are located in
    \Exchange Server\TransportRoles\Logs\ProtocolLog\SmtpReceive
    - Send Connector logs are located in
    \Exchange Server\TransportRoles\Logs\ProtocolLog\SmtpSend


    Regards from http://www.windowsadmin.info/
    Tuesday, February 23, 2010 12:16 PM
  • Version of Exchange?

    Oliver
    Oliver Moazzezi | Exchange MVP, MCSA:M, MCTS:Exchange 2010, BA (Hons) Anim | http://www.exchange2007.com | http://www.exchange2010.com | http://www.cobweb.com |
    Tuesday, February 23, 2010 12:17 PM
  • Those connectors are for SMTP connectings that are generated when connecting directy to a HUB server to send mail.

    So that not that, if im not wrong.

    Tuesday, February 23, 2010 12:22 PM
  • If it's RPC over HTTPS, those will be in the IIS logs.  If you're asking if there's a way to differentiate MAPI connections from RPC, no.  Outlook uses RPC as the underlying protocol for it's MAPI connections.  They are inseperable.

    Tuesday, February 23, 2010 12:45 PM
  • Exchange 2007 SP2
    Tuesday, February 23, 2010 1:17 PM
  • You should see the RPC over HTTPS connections in the IIS logs on your CAS server.  MAPI connections will be directly to the mailbox servers, so you won't see those on the CAS server.

    • Marked as answer by ZarkoC Tuesday, February 23, 2010 2:02 PM
    Tuesday, February 23, 2010 1:32 PM
  • Tnx,
    I totaly forgot about the IIS logs, ant with the malbox servers the only way i can see the conections are with netstat. Am i correct?
    Tuesday, February 23, 2010 1:37 PM
  • You can install the User Monitor  tool (EXMON) on the mailbox servers to get a more detailed picture of what your user connections are.  That will also give you information about that client types being used for the connections.

    http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=9a49c22e-e0c7-4b7c-acef-729d48af7bc9
    • Marked as answer by ZarkoC Tuesday, February 23, 2010 2:02 PM
    Tuesday, February 23, 2010 1:55 PM
  • Tnx!!!
    Tuesday, February 23, 2010 2:03 PM
  • You can install the User Monitor  tool (EXMON) on the mailbox servers to get a more detailed picture of what your user connections are.  That will also give you information about that client types being used for the connections.

    http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=9a49c22e-e0c7-4b7c-acef-729d48af7bc9

    This isn't valid for RPC over HTTPs connection.

    Exmon will not show you if the connections are Outlook Anywhere/RPC over HTTPs or not...

    Exmon will only show you the Outlook version and if they are using Cached Exchange mode or not.

    Read: "Exmon" http://technet.microsoft.com/en-us/library/bb508855(EXCHG.65).aspx

    Checking IIS logs is valid however.
    Oliver Moazzezi | Exchange MVP, MCSA:M, MCTS:Exchange 2010, BA (Hons) Anim | http://www.exchange2007.com | http://www.exchange2010.com | http://www.cobweb.com |
    Tuesday, February 23, 2010 2:06 PM
  • It does have it's limitations, but it provides a lot more information than netstat.
    Tuesday, February 23, 2010 2:11 PM