Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


Finding Client Access IP

  • Please log in to reply
2 replies to this topic

#1 Soldierbane


  • Members
  • 26 posts
  • Gender:Male
  • Location:New Hampshire
  • Local time:07:12 AM

Posted 20 May 2014 - 09:25 AM

Hi everyone,


I have an interesting issue that I'm hoping someone can help me with.


I'm trying to find the last ip that a specific device checked in with. If I go to EMC I can that t checked in yesterday under the "Manage Mobile Phone..." menu, but it doesn't tell me the IP it used. I also tried to find it using the Get-LogonStatistics command with no luck. 


My environment is a windows 2012 Server with Exchange 2010.


So just to clarify I'm trying to find the external IP of a specific Ipad that last synced with the server yesterday afternoon. Any help is greatly appreciated.


Thank you.

BC AdBot (Login to Remove)


#2 x64


  • Members
  • 352 posts
  • Gender:Male
  • Location:London UK
  • Local time:01:12 PM

Posted 20 May 2014 - 04:37 PM

I can't help with specifics, but you could try looking at the IIS logs on the Exchange server.

#3 JohnnyJammer


  • Members
  • 1,117 posts
  • Gender:Male
  • Location:QLD Australia
  • Local time:10:12 PM

Posted 21 May 2014 - 08:42 PM

There is a way im thinking of something like this, run this command in EMC to dump a list of ipads. After running the command below, get the device ID when you spot the users name where is shows the OU they belong to.

Get-ActiveSyncDevice | where {$_.friendlyname -match "ipad"} | Format-List >> C:\Ipads.txt

Check for people still running ios 6.*

Get-ActiveSyncDevice | where {$_.deviceos -match "ios 6."} | Format-List -Property Friendlyname, distinguishedname, name, deviceos

You can narrow that down to just an IOS version as well if you like or deviceid but now we can see the FirstSynctime but we cannot see the LastSyncTime (Not sure why).

I would then do what X64 was saying and then use a batch file so to search for the device by its ID. Save this is ExchangeSearcher.bat

Read the end of the line of text to see the external IP address. It will also tell you who and what device as well.

cd \
set logdir="C:\inetpub\logs\LogFiles\W3SVC1"
cd %logdir%
SET /p target=What is the targets IP Address, Or String Name or devideID: 
SET targetfile=C:\%target%_scan.txt
ECHO Scanning each login file in %logdir%
FOR /F %%X In ('dir /b *.log*') DO (
        Echo Seraching log file: %%X
        type %%X | find /i "%target%" >> %targetfile%
cd \
notepad %targetfile%

Hope this helps, i just threw this together so make sure you change your logfil path.

Edited by JohnnyJammer, 21 May 2014 - 10:46 PM.

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users