Scenario: There is a lot of mailbox in Exchange On-Premises that have IMAP and POP enabled when running get-casmailbox, but how many are actually using those protocols to connect to Exchange? Use the scriptlets below to help:

Scriptlets: Lets first grab the users who have IMAP and POP enabled in the environment and then compare it to the IMAP and POP Logs.

1. Filter For IMAP and POP Enabled Users

$ImapEnabled = Get-CASMailbox -Filter {Imapenabled -eq $true} -ResultSize unlimited
$PopEnabled = Get-CASMailbox -Filter {Popenabled -eq $true} -ResultSize unlimited

2. Parse through the IMAP and POP Logs to see which accounts are actually connecting with those protocols. (LogParser needs to be installed)

#Declare Variables
$files = @()
$servers = “ExServer1″,”ExServer2”

#Loop it to find log files
$servers | %{
“Searching Files on: $_”

$files += Get-childitem “\$_\c$\Program Files\Microsoft\Exchange Server\V15\Logging\Imap4\IMAP4.log” | Where name -notlike “BE”

$files += Get-childitem “\$_\c$\Program Files\Microsoft\Exchange Server\V15\Logging\Pop3\POP3.log” | Where name -notlike “BE“

}

#Separate the IMAP and POP Log Files
$IMAPFiles = $files | Where fullname -like “\IMAP4*” | Select -ExpandProperty fullname
$POPFiles = $files | Where fullname -like “\POP3*” | Select -ExpandProperty fullname

#Search IMAP logs and put all unique values into $IMAPAll
$IMAPLogs = @()
$IMAPfiles | %{
“$_”
$1 = & “C:\Program Files (x86)\Log Parser 2.2\logparser.exe” -i:CSV -q:on -rtp:-1 -nskiplines:5 @”
Select user From ‘$_’
“@
$IMAPLogs += $1
$IMAPLogs = $IMAPLogs | select -Unique
}

#Search POP logs and put all unique values into $POPAll
$POPLogs = @()
$Popfiles | %{
“$_”
$2 = & “C:\Program Files (x86)\Log Parser 2.2\logparser.exe” -i:CSV -q:on -rtp:-1 -nskiplines:5 @”
Select user From ‘$_’
“@
$POPLogs += $2
$POPLogs = $PopLogs | select -Unique
}

3. Review and Compare the Data Sets

Now you have two data sets that you can review and compare. The users that are actively using IMAP and POP are stored in the $IMAPLogs and $POPLogs. Everyone else found in $IMAPEnabled and $POPEnabled tha tare not in the $IMAPLogs and $POPLogs could have the protocols potentially disabled.

You could use Excel or commands similar to below:

Compare-Object $ImapLogs $($ImapEnabled.name) | Where sideindicator -eq “<=”
Compare-Object $POPLogs $($POPEnabled.name) | Where sideindicator -eq “<=”