in exchange system manager (2003) - if you go to each exchange database, right click it, and export all data to text file, it lists all mailboxes in that database and a last logged in date. What is this last logged in date representing, the last time the domain user logged on and opened up outlook? Is it accurate? Are there any other ways a user could access their mailbox and it not update the last logged on field?

Its accurate, however it can be updated by anyone who accesses a shared calendar, free/busy information etc... in other words, I wouldnt use it as proof that someone opened another users mailbox. You can audit logons as well: http://www.msexchange.org/tutorials/auditing-mailbox-access-exchange-system-manager-event-viewer.html

Regarding to the updated log file, I’m afraid that you cannot turn it off. Only the Mailbox Audit Logging can be turned off. As an additional information, I would like to share you the following articles: http://www.msexchange.org/tutorials/Importance-Auditing-Exchange-2003-Servers.html http://technet.microsoft.com/en-us/library/ff459237.aspx Thanks. NovakPlease remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.