TRACE Invalid logon attempts to Exchange Server

By Enabling the IIS log,

All login information will be recorded in the application log, it includes the IP address of the client, Web Browser details, etc…

1. Open IIS Manager console in administrative tools
2. Expand the server name, sites. Click on the Default Web Site.
3. Double click on Logging under IIS.

   

4. Select the Format as “W3C“. (Different format generates different views of log files)

5. Click on “Select Fields“, select all fields and click OK. (This option is not available for all formats)
6. Select “Use local time for file naming and rollover“.

   

7. In the Actions pane, click Apply.

   After that, you may look for the IIS log files in the %SystemDrive%\inetpub\logs\LogFiles folder. (This path may be changed if you change the directory path of the log file)

   
   Search for text “reason=2” This is the invalid attempt for the user. The log have all the relevant details for the invalid user logon attempt.

   

By Event Viewer, Exchange Server

Event ID 4625 displays all failed logons of exchange server. (Such as Account Name, Failure Reason, Source Network Address, etc…)