Last Logon Time in Exchange Manager showing time of maintenance cycle, want real user data...

I have been using Exchange Manager, via drilling down to the storage group's
Mailboxes screen, to get a check on users who are not active (and therefore
may have been excused without my knowledge).  Recently, something changed
without intervention (probably via a patch) where the "Last Logon Time" is
being reset every morning at 2:30.  I am assuming there is a maintenance
cycle involved, but I do not know what.

While I know there are utilities and scripts to mine AD for the needed info,
I am wondering what changed and if I really need this maintenance cycle?  If
I cannot reasonably circumvent this problem, does someone know of a
quick/easy way to create a list of usernames and associated last logon times?

The server is SBS2003 SP1 and I am pretty sure Exchange is SP2.
--
Thanks
tboncherAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

SembeeCommented:
The last login information is close to useless. The Exchange server will login to the server during the day, which is part of its normal processes.

If you want to track who has logged in to the mailboxes then you need to use the event log and relevant logging in Exchange.

Simon.
0
ryangormanCommented:
Have you enabled Mailbox Manager or Full Text Indexing? Both log onto mailboxes and overwrite the last logon information.

You could schedule a script to run before the maintenance period and to record the information to a SQL database or similar.
0
Exchange_AdminCommented:
Also some Exchange aware AV products will modify this field when they scan an Exchange mailbox for viruses.
0
Creating Active Directory Users from a Text File

If your organization has a need to mass-create AD user accounts, watch this video to see how its done without the need for scripting or other unnecessary complexities.

tboncherAuthor Commented:
Sorry, I have either been sick or swamped the past few weeks...

Sembee:  I used to be able to use this consistently until SBS 2003 Service Pack 1 (including Exchange SP2) was applied.  The e-mail anti-virus scanner was also updated at that point (they - Trend Micro - do not think anything is happening from their end).

RyanGorman:  I have not enabled anything of my own doing.  Any potential solution needs to fit the scope of effort versus a more manual solution (given 50 users).

Exchange Admin:  Trend Micro does not believe the problem is theirs.

GENERALLY:::

I am not terribly worried if this does not easily solve.  I do not want anyone, including myself, to get worked up about fixing this - just wanted to see if someone else has run into this.

Thanks, Tom.
0
ryangormanCommented:
What user name is showing showing as logging into the mailboxes at 2:30? This may help identify the process that is responsible.

0
Exchange_AdminCommented:
Are you certain how your AV product works?
I have seen some that actually scan each Exchange mailbox for viruses as opposed to scanning messages "on demand" (when they are opened by the user). This happens along with scanning inbound mail.

I am sure Trend will say it is not their problem since this is per design.

Ryan... has a good point about what account is showing up.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
tboncherAuthor Commented:
Trend Micro's ScanMail application is performing an "End User Quarantine" maintenance task.  They denied anything of theirs is running, but the application log is showing a start and end to this task as information events.  I could only catch it when scanned disabled mailboxes because it would generate errors (I usually filter out information events).

Now I am back to Trend for an explanation...

Thanks, Tom.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Exchange

From novice to tech pro — start learning today.