Is there a log that provides the time and date a user logged on to the Exchange server?
The Local Security event log will tell you who and when a given user logged on to the Exchange server. The Domain Controller Security event log will tell you who logged on to a specific mailbox and when they did so. You can use the Exchange System Manager (ESM) to view the last account that accessed a specific mailbox and at what time.
The system account logs on to mailboxes periodically, so don't panic if you see that the local system account accessed your mailbox. It was most likely your antivirus software scanning your mailbox.
Do you have comments on this Ask the Expert Q&A? Let us know.
Related information from SearchExchange.com:
- Expert Advice: View when a mailbox or public folder was last accessed
- Expert Advice: Track, monitor and log all email communication
- Expert Advice: Checking logs for Outlook Web Access logon attempt
- Fast Guide: Troubleshooting Exchange Server Event IDs
- Reference Center: Exchange Server monitoring and logging resources
Dig Deeper on Exchange Server setup and troubleshooting
Related Q&A from Richard Luckett
Some folders in a mailbox on Exchange Server 2013 are not showing up on the folder list in the OWA virtual directory but do appear in other views. Continue Reading
We have a Client Access Server and Mailbox Server on Exchange 2013 and we want to install an Edge Transport role on another machine. I joined the ... Continue Reading
How can I enable Outlook Anywhere to allow internal use for all users and external use for only some users in Exchange 2013? Continue Reading