Scenario: You want to find ActiveSync activity for specific users that is stored in IIS logs on the Exchange Servers.
Using LogParser you can edit and run the following command:
logparser “Select * from ‘servernamec$inetpublogslogfilesw3svc1*.log’ Where cs-uri-stem LIKE ‘%Microsoft-Server-ActiveSync%’ AND (cs-uri-query LIKE ‘%username1%’ OR cs-uri-query LIKE ‘%username2%’)” -i:IISW3C -q:on >FilePathfilename.txt
Ex-Shell 