Finding the last logon time in Exchange

[Jobos]

I’ve got a user who claims they cannot access their exchange mailbox from home via OWA. Personally I think it a ploy to say they haven’t received something when they have as I saw the person concerned the other week and talked them through logging on and accessing their mail and everything worked fine.

 

We use exchange 2003 here and in exchange system manager\mailbox store\mailboxes the user is listed as logging on at 20:35 yesterday when the school was shut. Is that the definitive time of their last logon or is it not safe to use this information?

[Willott]

I would have a check in your IIS logs at the same time just to be 100% sure. I think that any scheduled jobs that access the mailbox would show as a different user accessing the mailbox.

[Jobos]

Yes I realized that after I posted, thanks anyway. The ISA logs confirmed that the mailbox was accessed at that time.

 

It makes me mad when staff lie using the excuse that the network is faulty when it’s clearly not. I had the HT asking me this morning why staff cannot access their email... luckily the ISA logs don’t lie!

Edited December 3, 2009 by Jobos

[srochford]

the OWA logs are also good - they will show you the subject of every email read/sent and can help to prove that someone has read the email and the time at which they did it.

 

Not sure how accurate the info in the Exchange server console is - it could just be saying "user X made a connection at hh:mm" but if the browser just hangs at that point then the user won't have read their email even though they did make a connection.