Updated 21/04/2012: Windows 2008+ compatible script uploaded and verified working against Exchange 2007 and Exchange 2010
When you’re moving from Exchange 2007 to Exchange 2010 there are a few gotchas that it’s worth watching out for in the planning stages before you change over Client Access Namespaces or start migrating Mailboxes. If you don’t you might find you have broken Exchange 2007 clients, due to the CAS changes, and find some clients can’t connect after their mailboxes are migrated.
When it comes to the Windows version of Outlook, you can find out about currently logged-in clients using the Get-LogonStatistics command; however you also need to be aware of other clients using protocols like ActiveSync, Exchange Web Services and of course WebDAV.
ActiveSync clients will mostly be fine with CAS Namespace changes, as depending on version they should be automatically proxied from Exchange 2010 back to Exchange 2007 or should autodiscover; however some clients like the iPhone don’t work properly and you need to consider a workaround.
Exchange Web Services clients, for the most part, shouldn’t have issues thanks to AutoDiscover, however it’s good to understand what clients you have out there already so you can test and plan for any issues. There’s a number of iPhone apps that use EWS out there that your users may have bought and I’ve seen some funny issues myself with the EWS version Mac Mail on Snow Leopard that may require a client visit.
Finally, WebDAV. There’s little to explain about WebDAV apart from it’s not supported in Exchange 2010! You need to find these clients (think Entourage 2004 and 2008) and upgrade them.
Unfortunately there isn’t anything built-in to Exchange 2007 or 2010 to examine this data, but the good news is it should all be available to you via the IIS log files. Whilst logparser is pretty good, personally I wanted the data collected and grouped all in one go ready to use. And that’s where this script came from…
What information does the script output provide?
The output from the script is in CSV format, so it’s easy to use in Excel for further data processing. The CSV file itself has the following fields:
Username: Logon name of the user
ActiveSyncUser: If the user uses an ActiveSync mobile device
ActiveSyncProxyUser: If the user is currently being proxied through to this client access server
ActiveSyncClients: A semi-colon separated list of the clients in use, eg. iPad;htchero;
ActiveSyncLastAccess: Last date found for ActiveSync use
EWSUser: If the user uses some sort of Exchange Web Services client
EWSPCOutlook: Version information if the user has the Windows version of Outlook 2007 or 2010
EWSMacMail: Version information if user has the EWS version of Mac Mail
EWSMacOutlook: Version information if the user has Mac Outlook 2011
EWSEntourage: Version information if the user has Entourage 2008, Web Services Edition
EWSOther: A semi-colon separated list of any other EWS clients the user has
EWSLastAccess: Last date found for EWS use
WebDavUser: If the user uses some sort of WebDAV Exchange client
WebDavClient: A semi-colon separated list of WebDAV client software and versions in use
WebDavLastAccess: Last date found for WebDAV use
In an actual export, the above looks a little bit like this (apart from the blurry usernames!)
How to use the script
Example one – Parses log files from the default log directory “C:\WINDOWS\system32\LogFiles\W3SVC1” to “C:\output.csv”
1 | ExIISLogParser.ps1 |
Example two – Parses the last 30 days of log files from the current directory to cas_results.csv in the current directory, and saves the state to state.xml in the current directory (could take a LONG time!)
1 | ExIISLogParser.ps1 -LogFilePath "." -Days 30 -OutputCSVFile ".\cas_results.csv" -SaveStateFile ".\state.xml" |
Script Download
Download Windows 2003 version of ExIISLogParser.zip
Download Windows 2008/2008 R2 version of ExIISLogParser.zip
Pingback: Planning and migrating a small organization from Exchange 2007 to 2013 (Part 4) | Tools for Exchange & Active Directory
On 2003 Server -To avoid the error set the $Days=30 and $SaveStateFile=”c:\state.xml” on lines 35 and 37
Pingback: Find Outlook Version Cas
Any chance I can still get some help with this script? I’m trying to run it in my Exchange 2007 org and am getting the following error:
Missing ‘)’ in method call.
At D:\LogFiles\W3SVC1\ExIISLogParser.ps1:56 char:58
+ $EarliestLogDate = (Get-Date).Subtract([timespan]$($Days). <<<.Date
Any idea?
Yes awesome work ! Thank you very much !
We have 20’000 users and our logs are 500MB each day and your script takes 3GB RAM for the first log file and when it parses the second file, memory is increasing for another 3GB RAM… (Because of the array which becomes enormous)
We have to run the script against only one log file to avoid issues with memory.
1 log file is done in about 5 hours.
It would be very useful to modify the script to write each entry directly on the csv and not store that in an array. But for performance i do not know what to do.
I am also getting “I’m getting ‘cannot index into a null array.’ at 251, character 9.”
Any ideas?
I’m noticing that it classifies any access to /exchange as WebDAV. We found quite a few of what look to be non-WebDAV clients classified that way. I’m not sure what these clients are — many of them are likely failed auths or bad misparses by the script. Here’s one example:
+++++++++++++++++++++++++++++++++++++++++++++++++++++++ 0 0 0 1 Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0); 4/2/2012
— note, the “++++” is the actual username the that script produced.
Here’s another:
jdoe 0 0 1 Microsoft Office/12.0 (Windows NT 5.1; Microsoft Office Outlook 12.0.6607; Pro) Mozilla/4.0 (compatible; MSIE 6.0; MS Web Services Client Protocol 2.0.50727.4062); 4/23/2012 1 Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0); 4/13/2012
Any idea why those would show up as WebDav clients?
Hiya,
I’ve seen this before, and we put it down to clients who ahve something like
https://webmail.contoso.com/exchange
In their Browser bookmarks. To filter those out, I used the filter option in Excel to drill down to actual WebDAV clients,
Steve
Pingback: Updated–Getting info about ActiveSync, EWS and WebDAV clients from Exchange 2007 and 2010 | Steve Goodman's Exchange Blog
and one more thing, it’s better to export it to .txt file and then import from MS Excell 2010, if you export to .csv the data is inconsistent
Steve,
When I run the script an my CAS server, I get this error:
Invalid assignment expression. The left hand side of an assignment operator nee
ds to be something that can be assigned to like a variable or a property.
At: C:\inetpub\logs\LogFiles\W3SVC1\ExIISLogParser.ps1:35 char 137
+ [parameter(position1,Mandatory=$flase,ValueFromPipeline=$false,HelpMessa
ge=”Last write date of logs to search back by”)][int]$Days=0 <<<< ,
Kind regards,
Duncan
Oh dear ! You are not having luck with my scripts… They usually work, honest!
Again I am wondering if on the Exchange server it is Powershell V1 – that would be common if the server is Win 2003/setup a few years ago.
The script shouldn’t need to be run on a CAS if you can copy the files off and analyse them on an admin workstation, which may be more suitable if the server is in production.
Steve
Hi Steve,
No worries, I will copy the files over to my admin workstation and try again. 😉
The environment was built last year, and is running on W2K8.
I will let you know!
Duncan
Hi Duncan
One word of warning the current version of this script is only tested against Win 2003 IIS log files and I have had reports it doesn’t work on 2008.
Steve
Hi
Your script work’s well with windows 2008/exchange 2007
You need to modify few variables and it work’s.
Main problem is with $arrLog[5], every variable $array must be decreased buy 1
if you have $arrLog[5], for windows 2008 it has to be $arrLog[4], you have $arrLog[10] has to be $arrLog[9] etc.
Thank’s for script
Maybe you have any idea how makes him to work faster 🙂
Remigiusz
Thanks, that’s useful information.
Steve
would be awesome…
Cannot index into a null array.
At C:\Documents and Settings\administrator.LABEX\ExIISLogParser.ps1:251 char:9
+ $Output[ <<<< 1..($Output.Count)] | Select Username,ActiveSyncUser,ActiveSync
ProxyUser,ActiveSyncClients,ActiveSyncLastAccess,EWSUser,EWSPCOutlook,EWSMacMai
l,EWSMacOutlook,EWSEntourage,EWSOther,EWSLastAccess,WebDavUser,WebDavClients,We
bDavLastAccess | Export-Csv -Path $OutputCSVFile -NoClobber -NoTypeInformation
+ CategoryInfo : InvalidOperation: (System.Object[]:Object[]) [],
RuntimeException
+ FullyQualifiedErrorId : NullArray
Hiya,
At the moment, it’s only tested on Win 2003 – are you using that, or Win 2008?
Steve
I’m getting the same error on a dev Exchange server as well. The only thing I’ve changed in the script is the logfile path. It’d be sweet if I could get this work. We’re working on our migration to Exchange 2010 and this is exactly what we need for identifying EWS and WEBDAV clients.
I’m getting ‘cannot index into a null array.’ at 251, character 9. Any ideas?
Hi Steven,
It doesn’t sound like it was able to read the log file correctly. What OS are you trying it on, and were you able to specify the path to the file OK?
Steve
It’s Windows 2008. I did change file path in the script. When I execute it, it appears to load the log files then gives me the error.
Beautiful work!!
The only suggestion I have is “improve performance, if you can”. On a couple 500MB Logs its taking a long time. Logparser is a lot faster.