Auditing creates an audit log - every event type you audit generates an audit log record. So you can examine all logins to all mailboxes for the last 30 days - or for however long you keep the audit logs.
Regards, Michael B. Smith Consultant and Exchange MVP http://TheEssentialExchange.com From: mck1012 [mailto:[email protected]] Sent: Wednesday, August 25, 2010 2:58 PM To: MS-Exchange Admin Issues Subject: Re: Account Logon History So if a service account logs into that mailbox it will populate "Last Time" and I will not be able to see when the user last accessed it, correct? Or does the account auditing keep a history of all accounts that accessed the mailbox and will only show the last time that account accessed it? So for example if user1 accesses user1 mailbox it will update. If svraccount accesses the same mailbox after user1 will I see only srvaccount or will I be able to see when both account last accessed the mailbox? Hope my ramblings make a little sense to someone. On Wed, Aug 25, 2010 at 2:30 PM, Michael B. Smith <[email protected]<mailto:[email protected]>> wrote: Exchange 2007 sp2 and above and Exchange 2010 sp1 and above have full account auditing support. But for just the "last time", use get-mailboxstatistics. Regards, Michael B. Smith Consultant and Exchange MVP http://TheEssentialExchange.com<http://theessentialexchange.com/> From: mck1012 [mailto:[email protected]<mailto:[email protected]>] Sent: Wednesday, August 25, 2010 2:05 PM To: MS-Exchange Admin Issues Subject: Account Logon History I am looking for a way to find the last time a user accessed their mailbox. From what I can see if a service account accesses the mailbox it changes the lastlogontime and lastuser. Is there a way to get this information from a cmdlet or is turning up logging and parsing the logs the only way to get this info.
