Report Outlook client versions for Outlook Anywhere clients

Question

On Exchange 2010 with SP1. Mailbox role on one server, CAS on another. I need to know What Outlook versions my client are using to connect, but this server is hosted and all clients are RPC over HTTP (Outlook Anywhere).

Get-LogonStatistics can give me ClientVersion, but it can only be run against mailbox role servers and shows versions like 3585.0.33038.1 and ClientName of CAS server hostname.

Any other ideas on how to find the Outlook client versions (2003/2007/2010/2011) being used through RPC over HTTP?

Solution

provided you can extract user-agent strings from your logs...

For Outlook 2007+ (I haven't worked with Office 2003 in some time, I can't remember) they each have their own User agent, so you can look that up via google for more details. I find sites like user-agent-string.info useful (or any others, I have no affiliation with that one but seems to come up first when I search).

I know that Office 2007 will include "Office 12" somewhere in the string, the end normally. Here are some examples with Office 2010:

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; Trident/4.0; InfoPath.2; MSOffice 14) Microsoft Office/14.0 (Windows NT 5.1; Microsoft Outlook 14.0.4536; Pro; MSOffice 14)

You can see that MSOffice 14 is what you'll see for Office 2010. You can probably find more. I know that for a customer of mine at work, he has a ton of Mac users that connect to his exchange server via RPC over HTTP, and when monitoring we discovered that you can even find the specific version (I'm guessing to take into account certain major updates? I'm not an MS guy) of MS Office 2011

Comments

[Bret Fisher]

solution: Use Microsoft Log Parser on IIS logs of CAS logparser -rtp:-1 "SELECT cs(User-Agent) AS Client, COUNT(*) AS Requests INTO BrowserReport.txt FROM %SystemDrive%\inetpub\logs\LogFiles\W3SVC1\U_ex1108*.log GROUP BY Browser ORDER BY Requests DESC"

[Bret Fisher]

Are you referring to IIS logs on CAS role? Not a bad idea.

[sandroid]

Yeah :) The CAS role will undoubtedly have this info stored in logs. I work for a company that does HTTP/S monitoring by way of sniffing. I saw that we were able to extract these attributes which is where I got the idea from. I'm thinking it's probably a little time consuming to sift through the logs, but it sounds like it's something you may only need to extract once or twice, not as a regular report. If it is regular, perhaps something like splunk would help to do this?