The organizer of a meeting receives multiple meeting responses from an attendee. An analysis of the IIS logs shows multiple MeetingResponse commands from the user's device. These commands resemble the following:
2015-11-18 13:48:57 10.0.1.161 POST /Microsoft-Server-ActiveSync/Proxy/default.eas Useremail@example.com
This issue occurs because the attendee responded to an instance of a recurring meeting by using an iOS 9.x device. The device does not correctly parse the response from the server that is running Exchange Server. Therefore, the server continues to send the meeting response.
Note: The information in this article that is related to analyzing IIS logs applies only to customers who are using Exchange on-premises. It does not apply to Exchange Online customers because they cannot access their IIS logs. For Exchange Online, we highly recommend that you make sure that all users who have iOS devices are using the latest available version of the operating system.
You can use the following Log Parser Studio query to identify users who are affected by this issue:
/* Query to find MeetingResponse commands by user device */ SELECT COUNT(*) As Hits, EXTRACT_VALUE(cs-uri-query,'DeviceType') AS DeviceType, EXTRACT_VALUE(cs-uri-query,'DeviceId') AS DeviceId, REPLACE_STR(TO_STRING(EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, '_SmtpAdrs:'), 0, '_')), '%40', '@') As User, EXTRACT_VALUE(cs-uri-query,'Cmd') AS Cmd FROM '[LOGFILEPATH]' WHERE cs-uri-stem LIKE '%Active%' AND Cmd LIKE '%MeetingResponse%' GROUP BY DeviceType,DeviceId,Cmd,User ORDER BY Hits DESC
Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.