Exchange Log Report 1.4.0

Exchange Log Report now finds where every Exchange server really writes its logs, and checks it at every collection.

• -Mode Discover reads the real log folders with the Exchange cmdlets, run in Windows PowerShell 5.1 (they are not supported in PowerShell 7): Exchange installed on another drive, SMTP logs moved per role, message tracking, POP/IMAP, and the IIS sites from applicationHost.config — including a second OWA/ECP site, recognised from its virtual directories. View-Only Organization Management is enough.
• Every collection follows a moved IIS log folder at once, shows a missing folder, and warns when HttpProxy or IIS has stopped writing (stale source).
• Where to run it, and with which account (guide, chapter 4.1): SYSTEM on an Exchange server, or on an administration server a domain account that is local administrator of every Exchange server, with Log on as a batch job.

Download: ExchangeLogReport-1.4.0.zip contains only the files needed to run, with the HTML administrator guide (docs\ExchangeLogReport-Guide.html). There is no database in the package: the tool creates an empty one at the first collection. Requires PowerShell 7.4+ (and Windows PowerShell 5.1 for -Mode Discover, built into Windows Server).

Upgrading from 1.3.x: replace the files and keep your config, data and logs folders, then run -Mode Discover once. The database does not change.

Changes in 1.4.0

Added

• -Mode Discover: finds where every Exchange server really writes its logs — installation folder, SMTP protocol logs per role and direction, message tracking, POP3/IMAP4 — with the Exchange cmdlets run in Windows PowerShell 5.1 (src\Get-ExlExchangeSettings.ps1: Exchange Management Shell on an Exchange server, Exchange remote PowerShell with Kerberos elsewhere, -ConnectTo, -Credential). View-Only Organization Management is enough. Folders on another drive are read through the administrative share of that drive. Every folder is checked from the collector; disabled message tracking, POP/IMAP and SMTP connector logging are reported. Result in config\ExchangeLogReport.paths.psd1.
• IIS sites from applicationHost.config (\\<server>\ADMIN$): log folder, format and target of Default Web Site, Exchange Back End and of every custom site hosting Exchange virtual directories (a second OWA/ECP site), recognised from its virtual directories alone. Custom front-end sites are read with the IIS front end, custom back-end sites with ActiveSync with the ActiveSync back end.
• Checks at every collection: applicationHost.config is read again, so a moved IIS log folder or a new/removed custom Exchange site is followed at once and reported until -Mode Discover records it; an optional folder that does not exist (SMTP, MAPI, POP/IMAP, custom site) is shown as no folder; stale source warning when HttpProxy or IIS has no file newer than Collection.StaleSourceHours (new setting, 24 h). -Mode Status flags stale sources too.
• Per-server path settings for each source (FrontEndReceivePath, HubSendPath, IisFrontEndPath, MapiHttpPath...), which win over the paths file; unknown keys in a Servers block are rejected.

Changed

• Guide chapter 4: where to run the tool and with which account — SYSTEM on an Exchange server, or a domain account local administrator of every Exchange server (+ View-Only Organization Management for -Mode Discover, Log on as a batch job on the administration server); why a local account does not work; network flows. Chapter 6.1 rewritten around -Mode Discover, chapter 7 with the task of both options, new troubleshooting entries, lab validation 14.2.
• Exit code 2 now also means a stale source or IIS folders changed since -Mode Discover.
• The console shows where the paths of each server come from (Discover, configuration, defaults).

Full history: CHANGELOG.md

Package updated on 2026-10-02

Same version, same files, no change to what the tool does: the README and the guide now start with a note to unblock the files downloaded from the Internet (Get-ChildItem "C:\Chemin\Du\Dossier" -Recurse -File -Force | Unblock-File).