locked
Log OWA Authentication Failures RRS feed

  • Question

  • How do you configure Exchange/IIS to log OWA login failures, what log file can the logs then be found in (for Exchange 2003, 2007, and 2010)? I've enabled IIS logging, but I don't see OWA login failures showing up in the IIS logs.

    Thanks in advance!

    Thursday, May 19, 2011 10:49 PM

Answers

  • In Exchange 2010, OWA logon failure will be recorded in event ID 4625 on the CAS server with detail logon failure information.
    Jack Zhou
    • Marked as answer by Sophia Xu Thursday, May 26, 2011 6:42 AM
    Wednesday, May 25, 2011 5:59 AM
  • It shows up as an Event ID 529 in the CAS security log.  This event shows all bad user name or password events so use it in conjunction with the IIS logs.
    TBrennan
    • Marked as answer by Sophia Xu Thursday, May 26, 2011 6:42 AM
    Monday, May 23, 2011 4:12 PM

All replies

  • It shows up as an Event ID 529 in the CAS security log.  This event shows all bad user name or password events so use it in conjunction with the IIS logs.
    TBrennan
    • Marked as answer by Sophia Xu Thursday, May 26, 2011 6:42 AM
    Monday, May 23, 2011 4:12 PM
  • In Exchange 2010, OWA logon failure will be recorded in event ID 4625 on the CAS server with detail logon failure information.
    Jack Zhou
    • Marked as answer by Sophia Xu Thursday, May 26, 2011 6:42 AM
    Wednesday, May 25, 2011 5:59 AM
  • Thank you both TPBrennan and jackzhou_5!
    Saturday, May 28, 2011 1:45 AM