Hi, I am trying to monitor client logon events on exchange server. The problem that I have is that when client access exchange via POP3 or IMAP, event ID 4624 doesn't have the client's IP address. I asked exchange monitoring forum and they pointed me to an exchange update that is supposed to generate event ID 2104 with similar information. I tried that but it didn't work out. The thread is: http://social.technet.microsoft.com/Forums/en-US/exchangesvrmonitoring/thread/ab7a16ba-133f-4383-9369-9ac4668d45aa Can someone in this forum help me to see why 4624 doesn't have IP address or why 2104 is not generated in my security log. Thanks, Felix