what is " NT authority\system " on exchange 2003 logon

On Exchange 2003 go to

exchange system manager --> server --> mail --> first storage group --> mailbox store --> mailboxes

There are "Last Logged on by"

My question is someone has logged on by " NT authority\system" and others by "domain\username (ex - aaa\david)

What is the difference between those?
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

The NT Authority\System is basically the Exchange server itself. It polls the mailboxes regularly.
However if a user has connected in between the server polling the mailboxes then you will see the user listed.

If you were to access your server before any users did in the morning you would probably see every mailbox with the NT Authority\System login.

Nothing to worry about, perfectly normal.


Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
manrippoAuthor Commented:
Why does it poll the mailboxes? Any reason?
When the Mailbox manager logs on to the mailbox you'll see NT authority\system in the ESM, do you have a mailbox manager policy?
It isn't just mailbox manager that causes that login. On two of the servers I manage I don't have mailbox manager polices and most of the mailboxes will have the last logged in setting as the \system account.
It is just how Exchange works.
If you didn't see a majority of accounts with \system then I would actually think that your Exchange server had a problem.

What upsets most people is that they cannot see when the user last logged in to their mailbox because \system account does so frequently. I believe that this is on the list of items that the MVPs put forward to Microsoft for resolution in E12. An easier way to report on when a user, and not the service last logged in.

Just going through some of the old outstanding questions as it is quiet...

Has this problem been resolved?
If you need clarification on any part of the responses above, please post back.

Otherwise you need to close the question by awarding points, or posting in the Support Topic Area (top right corner) with a link to this question asking for the moderators to close the question for you without awarding points.

It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.