Enable IMAP4 / POP3 protocol logging in Exchange 2007
I recently needed to determine which Exchange 2007 users had IMAP4 and POP3 enabled and also review the logs to see which users actually access the server via either protocol. These steps walk through how to determine which users are enabled for either IMAP4 or POP3 in Exchange 2007 and also how to turn on and view protocol logs to determine which users are accessing the server using the protocols.
I used Quest’s Powergui with the Exchange 2007 powerpack to do this – http://www.powergui.org/index.jspa. Its free and a great tool if you don’t have it yet you should look into getting it. Open Powergui, expand Exchange 2007, Client Access, User Configuration. A list of the users will display in the middle, right click on the column header and check off PopEnabled and ImapEnabled. You can now see which users are enabled and disabled. You can also sort by any column by clicking the header.
You can setup a filter that will automatically show you only users that are POP3 enabled or IMAP4 enabled. Click User Configuration then click the Filters button in the middle pane. Click the drop down arrows and set them to Property = ImapEnabled, Operator = Equal, Value = True. You can save the Filter by clicking Save As entering a name and clicking OK. A new script will appear under the User Configuration node which will automatically display only users with IMAP4 enabled. You can do the same for POP3.
Once you determine what users are enabled for IMAP4 or POP3 you’ll want to find out which users are actually accessing the server using the protocols so you can disable any that are not. To enabled IMAP4 or POP3 protocol follow these instructions by Microssoft:
http://technet.microsoft.com/en-us/library/aa997690.aspx
Restart the service after making the change.
Once enabled you can use a tool like Logparser or if you only have a handful of users that are using IMAP/POP like I did just go to the log files and search it for their username. You might want to search the log everyday for a few days before disabling IMAP/POP on the user accounts just to make sure they aren’t using it.
Imap logs are normally located here: C:\Program Files\Microsoft\Exchange Server\Logging\Imap4
You can open with notepad and search for the username.
