Ask the Expert

What event log tracks user access to Exchange Server?

Is there a log that provides the time and date a user logged on to the Exchange server?

    Requires Free Membership to View

The Local Security event log will tell you who and when a given user logged on to the Exchange server. The Domain Controller Security event log will tell you who logged on to a specific mailbox and when they did so. You can use the Exchange System Manager (ESM) to view the last account that accessed a specific mailbox and at what time.

The system account logs on to mailboxes periodically, so don't panic if you see that the local system account accessed your mailbox. It was most likely your antivirus software scanning your mailbox.

Do you have comments on this Ask the Expert Q&A? Let us know.

Related information from

  • Expert Advice: View when a mailbox or public folder was last accessed
  • Expert Advice: Track, monitor and log all email communication
  • Expert Advice: Checking logs for Outlook Web Access logon attempt
  • Fast Guide: Troubleshooting Exchange Server Event IDs
  • Reference Center: Exchange Server monitoring and logging resources
  • This was first published in September 2007

    There are Comments. Add yours.

    TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

    REGISTER or login:

    Forgot Password?
    By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
    Sort by: OldestNewest

    Forgot Password?

    No problem! Submit your e-mail address below. We'll send you an email containing your password.

    Your password has been sent to: