We want to audit mailboxes on our Exchange 2000 server that have not been logged onto by a user for a long time. I can see under Systems Manager all the mailboxes and last logon time and last logon user. The problem is that we have an archiving service account and an exmerge backup service account that will logon to all mailboxes daily to perform tasks on the mailbox. What I need to know is when the mailbox was logged on by the mailbox owner. Thanks in advance. Greg.

Hi Greg, ESM shows last logged on account only. You can increase MSExchangeIS > Mailbox > Logons diagnostic logging to minimum which logs an entry in Application event log with username and mailbox name whenever it is accessed then you need to filterapplication log as per your requirement. You may use EventComb utility to filter it and get required output. How to Configure Diagnostics Logging

Do you need to isolate Exchange specific access, or general AD account login? If AD will suffice look for lastlogon or lastlogontimestamp. I've used joetools to find this before and diasble accounts based on my findings. http://www.joeware.net/freetools/tools/getuserinfo/index.htm & http://www.joeware.net/freetools/tools/adfind/index.htm

I have a script which collects the last logon by Domain controller, however I need to know if they are opening thier mailbox and checking email or not. For the Diagnostics logging, this needs to be turned on which it currently isn't.This will be helpful in future but I am assuming that there isn't a way to look back at the logon activity without this logging function? Thanks for your replies.