Solved

Last Logon Time in Exchange Manager showing time of maintenance cycle, want real user data...

Posted on 2007-04-02
7
1,060 Views
Last Modified: 2012-08-13
I have been using Exchange Manager, via drilling down to the storage group's
Mailboxes screen, to get a check on users who are not active (and therefore
may have been excused without my knowledge).  Recently, something changed
without intervention (probably via a patch) where the "Last Logon Time" is
being reset every morning at 2:30.  I am assuming there is a maintenance
cycle involved, but I do not know what.

While I know there are utilities and scripts to mine AD for the needed info,
I am wondering what changed and if I really need this maintenance cycle?  If
I cannot reasonably circumvent this problem, does someone know of a
quick/easy way to create a list of usernames and associated last logon times?

The server is SBS2003 SP1 and I am pretty sure Exchange is SP2.
--
Thanks
0
Comment
Question by:tboncher
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
  • 2
  • +1
7 Comments
 
LVL 104

Expert Comment

by:Sembee
ID: 18836690
The last login information is close to useless. The Exchange server will login to the server during the day, which is part of its normal processes.

If you want to track who has logged in to the mailboxes then you need to use the event log and relevant logging in Exchange.

Simon.
0
 
LVL 10

Expert Comment

by:ryangorman
ID: 18836999
Have you enabled Mailbox Manager or Full Text Indexing? Both log onto mailboxes and overwrite the last logon information.

You could schedule a script to run before the maintenance period and to record the information to a SQL database or similar.
0
 
LVL 27

Expert Comment

by:Exchange_Admin
ID: 18837449
Also some Exchange aware AV products will modify this field when they scan an Exchange mailbox for viruses.
0
Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

 

Author Comment

by:tboncher
ID: 18960510
Sorry, I have either been sick or swamped the past few weeks...

Sembee:  I used to be able to use this consistently until SBS 2003 Service Pack 1 (including Exchange SP2) was applied.  The e-mail anti-virus scanner was also updated at that point (they - Trend Micro - do not think anything is happening from their end).

RyanGorman:  I have not enabled anything of my own doing.  Any potential solution needs to fit the scope of effort versus a more manual solution (given 50 users).

Exchange Admin:  Trend Micro does not believe the problem is theirs.

GENERALLY:::

I am not terribly worried if this does not easily solve.  I do not want anyone, including myself, to get worked up about fixing this - just wanted to see if someone else has run into this.

Thanks, Tom.
0
 
LVL 10

Expert Comment

by:ryangorman
ID: 18963856
What user name is showing showing as logging into the mailboxes at 2:30? This may help identify the process that is responsible.

0
 
LVL 27

Accepted Solution

by:
Exchange_Admin earned 125 total points
ID: 18971297
Are you certain how your AV product works?
I have seen some that actually scan each Exchange mailbox for viruses as opposed to scanning messages "on demand" (when they are opened by the user). This happens along with scanning inbound mail.

I am sure Trend will say it is not their problem since this is per design.

Ryan... has a good point about what account is showing up.
0
 

Author Comment

by:tboncher
ID: 19017964
Trend Micro's ScanMail application is performing an "End User Quarantine" maintenance task.  They denied anything of theirs is running, but the application log is showing a start and end to this task as information events.  I could only catch it when scanned disabled mailboxes because it would generate errors (I usually filter out information events).

Now I am back to Trend for an explanation...

Thanks, Tom.
0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Lotus Notes – formerly IBM Notes – is an email client application, while IBM Domino (earlier Lotus Domino) is an email server. The client possesses a set of features that are even more advanced as compared to that of Outlook. Likewise, IBM Domino is…
Read this checklist to learn more about the 15 things you should never include in an email signature.
In this video we show how to create a Shared Mailbox in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >> Sha…
To show how to generate a certificate request in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.:  First we need to log into the Exchange Admin Center. Navigate to the Servers >> Certificates…

730 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question