Recently had a customer on Small Business Server think someone might be logging into the server as him. To check logs in IIS for a user :
2 ) Copy the logs from the default Location
3) Save the following as query.sql in C:\Temp\Logs\
SELECT cs-username, date, time, c-ip, cs-uri-stem, cs(User-Agent) FROM C:\Temp\Logs\*
WHERE cs-method LIKE ‘%get%’ and cs-uri-stem LIKE ‘%owa%’
Logparser.exe file:C:\Temp\Logs\query.sql -i:IISW3C -o:CSV
Trackback from your site.