How can I monitor Outlook Web Access activity?

A. For most Microsoft Exchange Server components, you can turn on diagnostic logging by using the Diagnostic Logging tab in the component's Properties dialog box. However, because Outlook Web Access (OWA) isn't an Exchange component (strictly speaking), there's no external interface exposed that you can use to log OWA-related events. However, if you know what types of events OWA generates, you can turn on logging for the Directory Service (DS) and Information Store (IS) services, then look for the kinds of events OWA generates. To get an idea of what OWA is doing, first you have to turn on some particular logging categories:

Once you do this, you'll see six or seven events logged each time an OWA user logs on. You'll typically see event IDs 1170, 1136, 1137, 1007, and 1009, and you might see more than one of each. These events will tell you who logged on and when. (See "XWEB: Diagnostic Logging Levels for OWA Defined in the Exchange Administrator Program," Microsoft article Q246248, for more detail on the pertinent events.)