Learn Exchange the Guru way !!!


Exchange 2007 ActiveSync reporting

Increase in the number of mobile users using Exchange ActiveSync has grown rapidly over the years. iPhone and Windows mobile capturing market nowadays, its extremely important for exchange admins to monitor and report their usage real-time.

There have been instances where Exchange design solutions where implemented not knowing the exact impact of OWA and ActiveSync users and the load balancing CAS servers went unresponsive.

This article stresses on the importance and processes for a term well used in Exchange 2007 – Exchange ActiveSync reporting.

The best part is, we don’t have to install any tools or additional software’s for this, the Exchange 2007 power shell does the trick.

I am going to explain two cmd-lets in this article, one for all IIS logs in the W3SVC folder and one for a Single IIS log file. The process of extracting Exchange ActiveSync users with mobile devices is known as PARSING and this process was rather a hectic one in Exchange 2003.


Create a folder: C:\ActiveSync_reporting.

Keep in mind that the IIS logs in a windows 2008 machine is stored in C:\inetpub\logs\LogFiles\W3SVC1.

This is for all files in the logs folder:

Get-Childitem C:\inetpub\logs\LogFiles\W3SVC1 | where-object {$_.lastwritetime -gt $DateToCompare} | ForEach { Export-ActiveSyncLog -FileName $_.FullName -OutputPath “C:\ActiveSync_reporting” -OutputPrefix $_.Name.Replace(“.log”,”_”) -UseGMT:$true}

Output will be 6 files as shown:

Length Name
u_ex100411 _Hourly.csv


If we need output for just a single IIS log:

Export-ActiveSyncLog -FileName “C:\inetpub\logs\LogFiles\W3SVC1\u_ex100410.log” -UseGMT:$true -OutputPath “C:\ActiveSync_reporting”

Length Name


The most important file in the output is Users.csv which shows:

1. Username
2. Device ID
3. Device type
4. Hits on the CAS server

With the StatusCodes.csv, we can create a report based on http code status and find device-server communication health:

200                   – Authentication pass
400                    – Bad/invalid request
401 and 403       – Unauthorized/server refusing request
404                    – File not found
449                    – Retry
500                   – Server error
503                   – Service unavailable

Update ##############


If you need to know all users synicng with one particular DeviceType or DeviceUserAgent, run this:

$AdminSessionADSettings.ViewEntireForest = $true

Get-CASMailbox -ResultSize unlimited -filter {HasActivesyncDevicePartnership -eq $True} | % {Get-ActiveSyncDeviceStatistics -Mailbox $_.identity} | ft Identity, DeviceType, DeviceID, DeviceUserAgent, LastSuccessSync >>”C:\ActiveSync_Report_AllUSers.txt”

Now look at:
Troubleshooting Exchange ActiveSync and reading IIS logs:

I have give a Table for iOS Ver, Device Type and DeviceUserAgent… Play with Excel and sort out LastSuccessSync

Ratish Nair
MVP Exchange
Team@ MSExchangeGuru


22 Responses to “Exchange 2007 ActiveSync reporting”

  1. Jonathan Says:

    This worked Ratiish. Thanks a lot.

  2. Brant Says:

    I ran the above-suggested cmdlets for all files in the logs folder (with the exception of changing the path to “C:\synclogs” to match my pre-existing output folder) on my Exchange 2010 CAS server and it prompted me with “>>”.

  3. yo Says:

    i got the same “>>” as Brant. i checked my command and when i copied and pasted the command from the web site it changed the ” after w3svc1 to a ? I changed it back to a ” and it ran fine. FYI

  4. Harendra Says:

    It works fine for a given file, but I want to run it for all the files in a directory.

  5. Ratish Sekhar Says:

    @Harendra – This one is to run for all files in the folder:

    Get-Childitem C:\inetpub\logs\LogFiles\W3SVC1 | where-object {$_.lastwritetime -gt $DateToCompare} | ForEach { Export-ActiveSyncLog -FileName $_.FullName -OutputPath “C:\ActiveSync_reporting” -OutputPrefix $_.Name.Replace(“.log”,”_”) -UseGMT:$true}


  6. Ben Says:

    Hi Ratish.

    We are having problems with ipads that are deleting calender appointments on its own acccord from the exchange server. I have enabled advanced logging on the “microsoft-active-sync” and i am using your commands above to show me the log files. But im not finding anything in regards to errors and the like.

    Any ideas how i can troubleshoot this further?

  7. Dan Says:

    We are also having trouble with calendar appointments on iPhones, have you found a solution?

  8. Ratish Sekhar Says:

    @Dan – please refer to:

  9. Frode Says:


    On all my ActiveSync Users I get “Total Bytes Received = 0”. Do I need to enable this logging attribute or is this a bug?

    “Total Attachment Size” shows correct.


  10. Frode Says:

    Found it! Just enable the bytes sent/received fields on the IIS site.

    Could be a good idea to store the logfiles og a seperate drive..

  11. zulma Says:

    Dear Ratish, reading your post has been very helpful, i work in a large enviroment,we have 4 CAS and 4 HUB, Exchange 2010 SP1, windows2008 server, when we retrieve the Active Sync logs, they are empty?
    we are having problems with iphones and ipad, it is intermitting, they just simple time out and the devices stop syncing. Any ideas on how to retrieve this logs?

    any help would be greatly appreciated.

  12. Ratish Sekhar Says:

    Why are the log files empty? Are you looking at the right IIS log files? Parse it and look for HTTP 500 errors…
    You simply might need one more CAS server to handle the load…

  13. Dan Kempka Says:

    Ratish, thanks for your excellent posts. I stumbled upon a mystery last week that has me perplexed. The w3svc1 ActiveSync log files for our Exchange server 2003 jumped from approximately 20mb per day, to over 1.2gb per day for the past four days. My review of the log files show that our iOS devices (iPads and iPhones) are registering thousands of log entries per minute. Have you seen this behavior elsewhere?

    Dan Kempka

  14. Ratish Sekhar Says:

    I have seen a behavior in the past which did something to a user’s iPhone which made IIS logs grow 10mb per minute….
    I had her update the iOS to the latest version…

    1.2 GB Log files are a lot… how many devices do you have in your company?


  15. Dan Kempka Says:

    We have four iPhones, and four iPads. We also have at least a dozen Android phones, but they don’t seem to create the excessive log file entries that I’m seeing from iOS devices. All of the iOS devices are running the very latest version of iOS 5. I saw the first large jump in IIS log sizes last April when the files went from 20mb per day to over 150mb. Then the files dropped back down to the 20mb range in late July. In early September, the log files jumped back up to over 150mb per day, then dropped for a few days in November, then exploded to over 1gb currently. I’m guessing that Apple’s implementation of Exchange ActiveSync is the culprit, but I have no way to tell if that’s true…

  16. Troubleshooting Exchange ActiveSync and reading IIS logs « Says:

    […] Exchange 2007 ActiveSync reporting: […]

  17. Kevin Says:

    This information is great. Is there anyway to get the device iOS level for each user/device in the User.csv file. I know there are issues with older iOS revisions and I would like to tie a device to a user so that we can get the to upgrade their device?

  18. Ratish Sekhar Says:


    $AdminSessionADSettings.ViewEntireForest = $true

    Get-CASMailbox -ResultSize unlimited -filter {HasActivesyncDevicePartnership -eq $True} | % {Get-ActiveSyncDeviceStatistics -Mailbox $_.identity} | ft Identity, DeviceType, DeviceID, DeviceUserAgent, LastSuccessSync

    DeviceUserAgent is what you are looking for…

    Now look at:
    Troubleshooting Exchange ActiveSync and reading IIS logs:

    I have give a Table for iOS Ver, Device Type and DeviceUserAgent….

    Hope it helps…

    Ratish Nair

  19. Praveen Balan Says:

    Thanks Ratish, simple and quick.

  20. Transitioning Exchange 2007 Client Access servers to Exchange 2010 « Says:

    […]                               Exchange 2007 ActiveSync reporting: […]

  21. Radek Juricek Says:

    Hi, I have issue with android phones,
    any android phone is unable to connect to Active sync.

    Iphone = no problem active sync works
    NOKIA = no problem active sync works
    HTC(android) = stop syncing 2 weeks ago, error message is chceck user and password…

    I tried almost everything, include create new certifications , nothing help

    on test connectivity fail with error :

    Trying to send OPTIONS command to the server.
      Testing the OPTIONS command failed.
    URL / Microsoft-Server-ActiveSync/default.eas? AspxAutoDetectCookieSupport = 1 was adopted in response to an unexpected diversion.

    IIS log show me this:

    2013-04-26 08:07:14 POST /Microsoft-Server-ActiveSync/default.eas Cmd=GetItemEstimate&User=user1&DeviceId=HTCAnd9356cd93&DeviceType=htcbravo 443\user1 Android-EAS/0.1 302 0 0 0
    2013-04-26 08:07:14 POST /Microsoft-Server-ActiveSync/default.eas User=user2&DeviceId=ApplC39JRM44DTWF&DeviceType=iPhone&Cmd=Sync&Log=V121_Fc1_Fid:3_Ty:Em_Filt3_St:S_Sk:1816584723_Sst2_Cli:0a0c0d1f0e_LdapC3_LdapL0_RpcC31_RpcL78_Pk388095853_S1_ 443 domain\user2 Apple-iPhone5C2/1001.525 200 0 0 202
    2013-04-26 08:36:27 POST /Microsoft-Server-ActiveSync/default.eas User=user3&DeviceId=ApplC32JW1U3DTWF&DeviceType=iPhone&Cmd=FolderSync&Log=V121_St:S_LdapC0_LdapL0_RpcC17_RpcL0_Pk4149113506_ 443\user3 Apple-iPhone5C2/1002.329 200 0 0 31
    2013-04-26 08:36:28 POST /Microsoft-Server-ActiveSync/default.eas User=user3&DeviceId=ApplC32JW1U3DTWF&DeviceType=iPhone&Cmd=Settings&Log=V121_LdapC0_LdapL0_RpcC12_RpcL15_Pk4149113506_UserInfo:Get_DevModel:iPhone5C2_DevName:B%c3%adl%c3%bd+iPhone+5_DevOS:iOS+6.1.3+10B329_DevLang:cs_ 443\user3 Apple-iPhone5C2/1002.329 200 0 0 46
    2013-04-26 08:36:28 POST /Microsoft-Server-ActiveSync/default.eas Cmd=Sync&User=user1&DeviceId=HTCAnd9356cd93&DeviceType=htcbravo 443\user1 Android-EAS/0.1 302 0 0 811

  22. Radek Juricek Says:

    sorry here is details:
    exchange 2007 v08.01.0240.006 on server SBS2008 (win server standart FE SP2)

Leave a Reply




Do NOT follow this link or you will be banned from the site!