Alerts for failed logon attempt on Outlook Web Access (OWA)

It is prudent to monitor and track all user logon activities in Outlook Web access (OWA). With increasing cases of information theft and security breaches, you must have in place proper tracking and monitoring tools for user logons and other related activities. Failed logons are generally an important indicator or initial sign of a possible malicious attack. Exchange Reporter Plus offers a detailed report on logon failures with information about the clientIP, browser information, date, time and type of errors because of which the logon failed, and more.

Steps to access failed OWA logon report for Exchange Servers:

Follow the steps given below to generate the logon failure report:

1. Go to the Reporting tab on the top pane.
2. Navigate to Exchange Server > OWA & ActiveSync Reports > OWA General Reports.
3. Select the Logon Failure report.
4. Enter the name of the organization and period for which you want to generate the report.
5. The report gets generated. Click on the filtericon above the report to customize your search.

Steps to generate OWA reports in Exchange Reporter Plus:

Exchange Reporter Plus offers various built-in reports that give information on OWA user logons based on users, browsers, client IP, and more. This section elaborates the steps to generate such OWA reports. For illustration purpose, let's take Log on Specifics and failed logonreports. Follow the steps given below to generate this report.

Follow the steps given below to schedule the Logon Failure report to be automatically sent to your email IDs. You can thereby get email alerts for failed OWA logons in Exchange.

1. Click on the Schedule New Report option available on the top-right corner.
2. Enter a suitable name for the scheduled report.
3. Select the Exchange Organization for which you wish to generate the report, from the drop-down of reports available.
4. Under Report Category, choose OWA & Active Sync.
5. From the list of available reports, select Logon Failure report.
6. Set the frequency for report generation.
7. Choose the report format and enter an email ID to mail the report.
8. Click on Save.

You can also use the filters available to scrutinize and customize the report generated as per your need. The OWA logon failures can be filtered based on error description, domain, server, routing group and administrative group. All you have to do in choose a suitable filter category enter the criteria and click on the Apply filter button. You can use the Export As option on the top-right corner to export this report to PDF, CSV, XLS and HTML formats.

To learn more about how Exchange Reporter Plus simplifies your Exchange Server, Online and Skype for Business server operations, click here .