Recipe5.7.Getting Mailbox Access and Logon Information

Recipe 5.7. Getting Mailbox Access and Logon Information

Problem

You want to know who last logged onto a mailbox and when.

Solution

Using a graphical user interface

Open the Exchange System Manager (Exchange System Manager.msc).
In the left pane, expand the appropriate Administrative Groups container, and then expand the Servers container.
Expand the storage group and database that hold the target mailbox.
Select the Mailboxes node under the mailbox store object.
Check the Last Logon Time, Last Logoff Time, and Last Logged on By columns in the right ESM pane. (If any of these columns are not visible, use the View Add/Remove Columns command to make them appear.)

Using VBScript with Exchange Server 2003

' This code retrieves the logon and logoff times for all mailboxes on  ' the specified server.   ' ------ SCRIPT CONFIGURATION ------  strComputerName = "<ServerName>"  ' e.g., batman  strE2K3WMIQuery = "winmgmts://" & strComputerName &_     "/root/MicrosoftExchangeV2" ' ------ END CONFIGURATION ---------    For each mailbox in mboxList     strOutput = ""     strOutput = "Mailbox: " & mailbox.MailboxDisplayName & vbCRLF     theTime = mailbox.LastLogonTime     If (IsNull(theTime)) then        strOutput = strOutput & "  Never logged on" & vbCRLF     else        strOutput = strOutput & "  Last logon at: " & theTime & vbCRLF        strOutput = strOutput & "             by: " & mailbox.LastLoggedOnUserAccount     End If     WScript.Echo strOutput   Next Discussion

Exchange has always tracked who logs on to what mailboxes and when; it just hasn't exposed most of this data in a usable way (and no, printing out screen captures of the mailbox listing described in the GUI solution doesn't count as "usable"). The Exchange Server 2003 WMI provider's Exchange_Mailbox class provides the time of the last logon and logoff (in GMT), as well as exposes the name of the last account used to log on to the mailbox. This can easily be used in scripts that find stale mailboxes that haven't been used in a specified period; alternatively, you can use it to find mailboxes that shouldn't be used but were. If you need to get this information from Exchange 2000 or Exchange 5.5 servers without using ESM, you'll need a third-party reporting/query tool.

There's one caveat to this recipe: if you're using an anti-virus, backup, or other program that logs on to mailboxes with MAPI, the last logon time will be updated when they log on. This means that you can't rely on the logon times to tell you when the user last logged on to her mailbox. Some third-party tools, such as Quest's MessageStats, tend to use the tracking logs to obtain information about which mailboxes are active by seeing whether they send any email during the reporting period.