No announcement yet.

Exchange script question...

  • Filter
  • Time
  • Show
Clear All
new posts

  • Exchange script question...

    Hey everyone. I just found this site and it appears this might be the place I am looking for for some assistance. I am currently wanting to monitor any change in the "last logged on by" field in ESM on exchange 2003 for a couple of mailboxes and in short I am not sure where to get started. The reason for this is that it is believed there might be some unauthorized access to some mailboxes and I would just like to have a script running that will write an entry to a file telling me when anyone but the mailbox owner accesses the mailbox.

  • #2
    Re: Exchange script question...

    Welcome, Zenlakin
    I'm moving this thread to the Exchange 2003 forum where you will probably get a better response (Hi Sembee )
    Tom Jones
    MCT, MCSE (2000:Security & 2003), MCSA:Security & Messaging, MCDBA, MCDST, MCITP(EA, EMA, SA, EDA, ES, CS), MCTS, MCP, Sec+
    IT Trainer / Consultant
    Ossian Ltd

    ** Remember to give credit where credit is due and leave reputation points where appropriate **


    • #3
      Re: Exchange script question...

      Last Logged on by is not to be trusted. It doesn't mean that someone else is accessing a mailbox - it can be triggered by any number of things which are perfectly normal for Exchange operation - such as a calendar look up. I actually ignore it completely, it is a waste of time.

      If you want to monitor mailbox access the only way is to turn up audit logging on the server. You will have to use a tool to manage the logs because it will drown out everything in the application log. 500,000 entries in the log in a few days is not unusual even on a small number of users.

      Simon Butler
      Exchange MVP

      More Exchange Content:
      Exchange Resources List:
      In the UK? Hire me:

      Sembee is a registered trademark, used here with permission.