Tracking Logons – Exchange 2007 Mailbox

Exchange2007Enterprise

First of all you have to turn on loggin on the mailbox servers (all og them) To test the current level fire this command on the mailbox Server: get-EventLogLevel MSExchangeIS\9000 Private\Logons (default level is lovest) Run the following command on all mailbox servers: Set-EventLogLevel MSExchangeIS\9000 Private\Logons level low Now you can track use mailbox logins in the Event Viewer look for eventid: 1016 Filter the Eventlog using this command: Get-EventLog -LogName “Application” | where-object{$_.EventID -eq “1016” -and $_.Message -ilike “*USER*”} Where USER is the User ALIAS you want to track.. Event ID 1009 is an indication that the specified user account logged into the specified mailbox. Event ID 1013 is very much a companion event for event ID 1016. Event ID 1013 informs you that the specified user account has opened an additional mailbox

BTW, here are your options

  • 1016 will even track Calendar access
  • 1009 is an indication that the specified user account logged into the specified mailbox
  • 1013 informs you that the specified user account has opened an additional mailbox