Exchange 2010: Which users connect to the Client Access Server?

If you want to find out which users connect to the Client Access Server, you will find a corresponding log file on the CAS server under the path "C:\Program Files\Microsoft\Exchange Server\V14\Logging\RPC Client Access"

Here you will find the corresponding logs which also contain the SID of the user who has connected to the CAS server

This information can be important if, for example, a Client Access Array is set up at a later date. To find out which Outlook profiles still connect directly to the CAS server and do not go via the client access array / load balancer.

The log file can be prepared using various means, here as an example in Excel:

Here you can see the client IP address and the SID of the user. The SID can in turn be translated into the user name using Powershell. This script can be used for this purpose

http://blogs.technet.com/b/heyscriptingguy/archive/2010/10/12/use-powershell-to-translate-a-user-s-sid-to-an-active-directory-account-name.aspx