Is there a log that provides the time and date a user logged on to the Exchange server?
By submitting your email address, you agree to receive emails regarding relevant topic offers from TechTarget and its partners. You can withdraw your consent at any time. Contact TechTarget at 275 Grove Street, Newton, MA.
The Local Security event log will tell you who and when a given user logged on to the Exchange server. The Domain Controller Security event log will tell you who logged on to a specific mailbox and when they did so. You can use the Exchange System Manager (ESM) to view the last account that accessed a specific mailbox and at what time.
The system account logs on to mailboxes periodically, so don't panic if you see that the local system account accessed your mailbox. It was most likely your antivirus software scanning your mailbox.
Do you have comments on this Ask the Expert Q&A? Let us know.
Related information from SearchExchange.com:
- Expert Advice: View when a mailbox or public folder was last accessed
- Expert Advice: Track, monitor and log all email communication
- Expert Advice: Checking logs for Outlook Web Access logon attempt
- Fast Guide: Troubleshooting Exchange Server Event IDs
- Reference Center: Exchange Server monitoring and logging resources
Dig Deeper on Microsoft Exchange Server Monitoring and Logging
Related Q&A from Richard Luckett
I have limited drive space on my Exchange Server but need to restore large mailboxes. Can I prevent mailbox restores from a recovery database by ...continue reading
I want to move from a single Exchange 2013 server to multiple servers, including multiple database and client access servers, for HA. What's the best...continue reading
My mailbox migration from Exchange 2010 to Exchange 2013 is moving very slowly. What might be causing this and how can I speed up the process?continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.