Ask the Expert

How to determine when an Exchange Server mailbox was last accessed by the owner

In a previous post, someone asked if there were any tools that show when an Exchange Server mailbox was last accessed.

Similarly, I'd like to know how I can determine when the mailbox owner last accessed the mailbox. Do you know how to do this? Are there any components of Exchange Server available via VBScript?

    Requires Free Membership to View


Exchange System Manager does show this information. You can access it by expanding the Mailbox Store -> Mailboxes.

Exchange Server exposes this information using the Exchange_Logon WMI provider. For more details check out the MSDN's WMI reference page on the Exchange_Logon class.

The mailbox owner's log-on info is not maintained separately by Exchange_Logon class or any other mechanism. It is the log-on information of the person who logged on last.


This is true, however, what if you have a job that accesses the mailbox, like a Veritas backup service or something to that effect. That throws off your last logged on user and times.
—Mark C.

Do you have comments on this Ask the Expert Q&A? Let us know.

Related information from

  • Tip: Track, monitor and log all email communication
  • Crash Course: A tour of Exchange System Manager
  • Reference Center: Monitoring and logging tips and resources
  • Reference Center: Exchange Server mailbox management
  • This was first published in June 2007

    There are Comments. Add yours.

    TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

    REGISTER or login:

    Forgot Password?
    By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
    Sort by: OldestNewest

    Forgot Password?

    No problem! Submit your e-mail address below. We'll send you an email containing your password.

    Your password has been sent to: