How to count which business systems use SMTP and EWS to send emails through Exchange 2019?

Hi yanhaowen

Based on my research, there are no built-in GUI reports in Microsoft Exchange Server 2019 that directly show which business systems are using SMTP or EWS. The recommended approach is to analyze Exchange transport logs for SMTP activity and IIS/Exchange HTTP proxy logs for EWS activity.

Identify systems using SMTP

SMTP activity can be identified from Message Tracking Logs and, for more detailed connection analysis, SMTP Protocol Logs.

• Message Tracking Logs: The following PowerShell example checks the last 7 days of SMTP receive events and groups them by client IP address:

$StartDate = (Get-Date).AddDays(-7)
Get-TransportService | ForEach-Object {
 Get-MessageTrackingLog -Server $_.Name `
 -Start $StartDate `
 -EventId RECEIVE `
 -Source SMTP `
 -ResultSize Unlimited
} |
Group-Object ClientIp |
Sort-Object Count -Descending |
Select-Object @{Name="Client IP Address";Expression={$_.Name}},
 @{Name="Total Emails Sent";Expression={$_.Count}} |
Format-Table -AutoSize

This helps identify which systems are submitting the highest volume of SMTP messages. You can then correlate the IP addresses with DNS, CMDB, or network inventory records to determine the associated business applications (ERP systems, scanners, monitoring tools, etc.).

• SMTP Protocol Logs: Message Tracking Logs only show successfully processed messages. For more complete SMTP connection auditing, including connector usage and authentication details, SMTP Protocol Logging is recommended.

Check whether protocol logging is enabled:

Get-ReceiveConnector | Select Name,ProtocolLoggingLevel

Enable verbose logging if needed:

Set-ReceiveConnector "Connector Name" -ProtocolLoggingLevel Verbose

SMTP protocol logs are stored here:

C:\Program Files\Microsoft\ExchangeServer\V15\TransportRoles\Logs\ProtocolLog\SmtpReceive

These logs provide additional information such as:

• Remote IP address
• HELO/EHLO hostname
• Authenticated account
• Connector used
• SMTP session details

Identify systems using EWS

Because EWS operates over HTTPS, its activity is not recorded in transport logs. Instead, you must analyze IIS logs and Exchange HTTP proxy logs.

• IIS Logs:

IIS logs are typically located here:

C:\inetpub\logs\LogFiles\W3SVC1

Search for:

/EWS/Exchange.asmx

Example PowerShell:

Get-ChildItem "C:\inetpub\logs\LogFiles\W3SVC1\u_ex*.log" |
Select-String "/EWS/Exchange.asmx" |
ForEach-Object { ($_ -split ' ')[8] } |
Group-Object | Sort-Object Count -Descending
``

This shows which systems (by ser-Agent)

• Review User-Agent strings:

Many applications identify themselves via the User-Agent field in IIS logs (cs(User-Agent)).

This often reveals the application (e.g. Outlook, BackupExec, Mimecast, EWS clients).

• Use Exchange HttpProxy EWS logs:

Exchange also logs EWS activity here:

C:\Program Files\Microsoft\Exchange Server\V15\Logging\HttpProxy\Ews

Example:

Import-Csv "C:\Program Files\Microsoft\Exchange Server\V15\Logging\HttpProxy\Ews\*.log" |
Group-Object AuthenticatedUser |
Sort-Object Count -Descending

This method is often simpler and more useful than raw IIS parsing, especially for identifying service accounts.

Not all modern applications use EWS anymore. Depending on your environment, you may also see:

• Microsoft Graph API
• SMTP AUTH
• Direct Send
• Other REST-based integrations

If your goal is migration or decommissioning (especially from Exchange 2019), you should also review:

• SMTP AUTH usage
• OAuth usage
• Basic authentication dependencies

I hope this information helps and if you have any question, please feel free to ask via comment section!

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.