How to view when a mailbox or public folder was last accessed

Digg This!     StumbleUpon     Del.icio.us

RELATED CONTENT Microsoft Exchange Server Monitoring and Logging Analyzing Exchange ActiveSync data from .CSV report files Top Exchange Server performance monitoring and troubleshooting tools Extracting Exchange ActiveSync data from IIS log files How effective is tracking the IP address of an email hacker? Error message: 'ID no: 8004100e Exchange System Manager' How to generate HTML reports with the Exchange Management Shell (EMS) IMAP list command only returns a list of Exchange public folders A network connection problem or an offline server prevented delivery of the message Monitor and search Exchange mailboxes for music and video files How much bandwidth is required to send email in Exchange 2003? Microsoft Exchange Server Public Folders Restore contacts from an Exchange public folder Importing a public folder contact list into an Exchange 2007 public folder Exchange Server public folder rules and memory limits Editing Exchange Server public folder permissions Search and index Microsoft Outlook 2007 public folders Can't delete old Microsoft Outlook public folders Sharing a user's Outlook calendar with a public folder calendar Why can't I grant users permissions to an Exchange public folder? Can I prevent users from deleting voice messages from a UM folder? Move public folder data from Exchange Server to a local share Microsoft Outlook Stop personal calendar appointments from showing on Exchange Server Relocating Outlook email messages on a hosted Exchange 2007 server Creating Meeting Workspaces in MOSS 2007 and Outlook 2007 Control Outlook 2007 in cached mode settings with group policies Sending poll questions through Exchange to non-Outlook users Sort Microsoft Outlook email messages by original date Performing advanced search queries in Microsoft Outlook 2007 Synchronized Exchange mobile device showing deleted appointment Group policy settings for Outlook 2007 in cached mode Problems creating Microsoft Outlook profile in Windows Vista Microsoft Outlook Research

RELATED GLOSSARY TERMS Terms from Whatis.com − the technology online dictionary public folder  (SearchExchange.com) rehoming  (SearchExchange.com)

RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary

VIEW MEMBER FEEDBACK

Exchange System Manager displays the last logon and logoff information. Expand a mailbox store, click on Mailboxes -- and a list of mailboxes along with this information is displayed. Similarly, the last accessed and last update received info is displayed in ESM (Exchange Server 2003) when you click on a public folder and select the Status tab.

This worked, however I noticed that a user's mailbox was last accessed by another user, who doesn't have mailbox access rights. How could this happen?
—Riyas P.

******************************************

It's not possible to access an Exchange mailbox without having access permissions. You must have either Full Mailbox Access permission explicitly granted to you (or a security group you are a member of ) or the login credentials of a user who "owns" the mailbox (in which case, the mailbox owner's name should show up).

In Exchange 2000, however, access was possible if you weren't a member of Administrators or Domain Admins groups by making the account a member of the Exchange Domain Servers group (see Microsoft KB article 262054, How to get service account access to all mailboxes in Exchange 2000). Inherited store permissions can also allow you to access mailboxes.

Permissions can also be delegated or assigned by users (e.g., permissions assigned to assistants to access a Calendar or Contacts folder).

You should also take a look at Event ID 1016 in the Security event log to monitor mailbox access. For more info about this Event ID, refer to Microsoft KB article 867640 How to monitor mailbox access by auditing or by viewing Mailbox Resources in Exchange Server."
—Bharat Suneja, Exchange Server Administration expert

******************************************

Is there a way to change the amount of time the log stores data? We checked it after having Exchange for four months, and it only shows us about the last week or so of access. We wanted to keep logs for at least six to twelve months, if possible.
—Martin E.

******************************************

Event Logs can be configured to store more or less data. On Windows Server 2003, follow the following steps to change the Event Log settings:

1. Start Event Viewer.
2. Right click the Event Log you want to modify, such as Application, Security, System, etc.
3. Select Properties.
4. In the "Log size" section, modify the "Maximum log size" as required.
5. You can also control what happens when the log reaches the maximum size. The choices:
   - Overwrite older events as needed.
   - Overwrite events older than specified number of days.
   - Do not overwrite older events (clear log manually).
   

Do you have comments on this Ask the Expert Q&A? Let us know.

Related information from SearchExchange.com: