Q

How to view when a mailbox or public folder was last accessed

When was an Exchange Server mailbox or Exchange Server public folder last accessed? Learn how to display this information using Exchange System Manager in Exchange Server 2003.

Are there any tools available that show the last time an Exchange Server mailbox or Exchange Server public folder was accessed? We're running Exchange 2003 with Outlook 2000/Outlook 2003 clients.
VIEW MEMBER FEEDBACK

Exchange System Manager displays the last logon and logoff information. Expand a mailbox store, click on Mailboxes -- and a list of mailboxes along with this information is displayed. Similarly, the last accessed and last update received info is displayed in ESM (Exchange Server 2003) when you click on a public folder and select the Status tab.


MEMBER FEEDBACK

This worked, however I noticed that a user's mailbox was last accessed by another user, who doesn't have mailbox access rights. How could this happen?
—Riyas P.

******************************************

It's not possible to access an Exchange mailbox without having access permissions. You must have either Full Mailbox Access permission explicitly granted to you (or a security group you are a member of ) or the login credentials of a user who "owns" the mailbox (in which case, the mailbox owner's name should show up).

In Exchange 2000, however, access was possible if you weren't a member of Administrators or Domain Admins groups by making the account a member of the Exchange Domain Servers group (see Microsoft KB article 262054, How to get service account access to all mailboxes in Exchange 2000). Inherited store permissions can also allow you to access mailboxes.

Permissions can also be delegated or assigned by users (e.g., permissions assigned to assistants to access a Calendar or Contacts folder).

You should also take a look at Event ID 1016 in the Security event log to monitor mailbox access. For more info about this Event ID, refer to Microsoft KB article 867640 How to monitor mailbox access by auditing or by viewing Mailbox Resources in Exchange Server."
—Bharat Suneja, Exchange Server Administration expert

******************************************

Is there a way to change the amount of time the log stores data? We checked it after having Exchange for four months, and it only shows us about the last week or so of access. We wanted to keep logs for at least six to twelve months, if possible.
—Martin E.

******************************************

Event Logs can be configured to store more or less data. On Windows Server 2003, follow the following steps to change the Event Log settings:

  1. Start Event Viewer.
  2. Right click the Event Log you want to modify, such as Application, Security, System, etc.
  3. Select Properties.
  4. In the "Log size" section, modify the "Maximum log size" as required.
  5. You can also control what happens when the log reaches the maximum size. The choices:
    - Overwrite older events as needed.
    - Overwrite events older than specified number of days.
    - Do not overwrite older events (clear log manually).
—Bharat Suneja, Exchange Server Administration expert

Do you have comments on this Ask the Expert Q&A? Let us know.

Related information from SearchExchange.com:

  • FAQ: Exchange public folders
  • Crash Course: A tour of Exchange System Manager
  • Exchange Admin 101: Introducing public folders
  • Reference Center: Exchange 2003 tips and resources
  • Reference Center: Exchange System Manager tips and resources
  • This was first published in April 2006

    Dig deeper on Microsoft Exchange Server Monitoring and Logging

    Pro+

    Features

    Enjoy the benefits of Pro+ membership, learn more and join.

    Have a question for an expert?

    Please add a title for your question

    Get answers from a TechTarget expert on whatever's puzzling you.

    You will be able to add details on the next page.

    0 comments

    Oldest 

    Forgot Password?

    No problem! Submit your e-mail address below. We'll send you an email containing your password.

    Your password has been sent to:

    -ADS BY GOOGLE

    SearchWindowsServer

    SearchEnterpriseDesktop

    SearchCloudComputing

    SearchSQLServer

    Close