Today I was in a hurry to find out which user is massively spamming through Exchange and to find out how and from where he was connected.

Log Parser Studio to the rescue … You need to download Log Parser 2.2 (that changed its URL in meantime 🙂

And just use the query:

SELECT * FROM ‘[LOGFILEPATH]’ WHERE cs-username = ‘domain\username’

You will get the connectivity logs for a user…