Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Last Logon Time in Exchange Manager showing time of maintenance cycle, want real user data...

Posted on 2007-04-02
7
Medium Priority
?
1,073 Views
Last Modified: 2012-08-13
I have been using Exchange Manager, via drilling down to the storage group's
Mailboxes screen, to get a check on users who are not active (and therefore
may have been excused without my knowledge).  Recently, something changed
without intervention (probably via a patch) where the "Last Logon Time" is
being reset every morning at 2:30.  I am assuming there is a maintenance
cycle involved, but I do not know what.

While I know there are utilities and scripts to mine AD for the needed info,
I am wondering what changed and if I really need this maintenance cycle?  If
I cannot reasonably circumvent this problem, does someone know of a
quick/easy way to create a list of usernames and associated last logon times?

The server is SBS2003 SP1 and I am pretty sure Exchange is SP2.
--
Thanks
0
Comment
Question by:tboncher
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
  • 2
  • +1
7 Comments
 
LVL 104

Expert Comment

by:Sembee
ID: 18836690
The last login information is close to useless. The Exchange server will login to the server during the day, which is part of its normal processes.

If you want to track who has logged in to the mailboxes then you need to use the event log and relevant logging in Exchange.

Simon.
0
 
LVL 10

Expert Comment

by:ryangorman
ID: 18836999
Have you enabled Mailbox Manager or Full Text Indexing? Both log onto mailboxes and overwrite the last logon information.

You could schedule a script to run before the maintenance period and to record the information to a SQL database or similar.
0
 
LVL 27

Expert Comment

by:Exchange_Admin
ID: 18837449
Also some Exchange aware AV products will modify this field when they scan an Exchange mailbox for viruses.
0
Office 365 Training for Admins - 7 Day Trial

Learn how to provision tenants, synchronize on-premise Active Directory, implement Single Sign-On, customize Office deployment, and protect your organization with eDiscovery and DLP policies.  Only from Platform Scholar.

 

Author Comment

by:tboncher
ID: 18960510
Sorry, I have either been sick or swamped the past few weeks...

Sembee:  I used to be able to use this consistently until SBS 2003 Service Pack 1 (including Exchange SP2) was applied.  The e-mail anti-virus scanner was also updated at that point (they - Trend Micro - do not think anything is happening from their end).

RyanGorman:  I have not enabled anything of my own doing.  Any potential solution needs to fit the scope of effort versus a more manual solution (given 50 users).

Exchange Admin:  Trend Micro does not believe the problem is theirs.

GENERALLY:::

I am not terribly worried if this does not easily solve.  I do not want anyone, including myself, to get worked up about fixing this - just wanted to see if someone else has run into this.

Thanks, Tom.
0
 
LVL 10

Expert Comment

by:ryangorman
ID: 18963856
What user name is showing showing as logging into the mailboxes at 2:30? This may help identify the process that is responsible.

0
 
LVL 27

Accepted Solution

by:
Exchange_Admin earned 375 total points
ID: 18971297
Are you certain how your AV product works?
I have seen some that actually scan each Exchange mailbox for viruses as opposed to scanning messages "on demand" (when they are opened by the user). This happens along with scanning inbound mail.

I am sure Trend will say it is not their problem since this is per design.

Ryan... has a good point about what account is showing up.
0
 

Author Comment

by:tboncher
ID: 19017964
Trend Micro's ScanMail application is performing an "End User Quarantine" maintenance task.  They denied anything of theirs is running, but the application log is showing a start and end to this task as information events.  I could only catch it when scanned disabled mailboxes because it would generate errors (I usually filter out information events).

Now I am back to Trend for an explanation...

Thanks, Tom.
0

Featured Post

Is Your AD Toolbox Looking More Like a Toybox?

Managing Active Directory can get complicated.  Often, the native tools for managing AD are just not up to the task.  The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article lists the top 5 free OST to PST Converter Tools. These tools save a lot of time for users when they want to convert OST to PST after their exchange server is no longer available or some other critical issue with exchange server or impor…
There are times when we need to generate a report on the inbox rules, where users have set up forwarding externally in their mailbox. In this article, I will be sharing a script I wrote to generate the report in CSV format.
In this video we show how to create a Shared Mailbox in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >> Sha…
Exchange organizations may use the Journaling Agent of the Transport Service to archive messages going through Exchange. However, if the Transport Service is integrated with some email content management application (such as an antispam), the admini…

670 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question