Solved

Exchange 2003 mailbox shows administrator as last logged on

Posted on 2013-01-03
5
658 Views
Last Modified: 2013-01-21
As I was cleaning up the exchange, I am looking in ESM / mail store and i discovered that many users show last "logged on by" the domain administrator - myself.

I obviously did not log on at all. I don't know the reason why this is showing. Can it be that I have Symantec backup exec backing up the information store and in turn cause this?

please help. I hope this isn't a security concern.

Tx
0
Comment
Question by:tobe1424
  • 3
  • 2
5 Comments
 
LVL 3

Assisted Solution

by:gaurav2rawat
gaurav2rawat earned 500 total points
ID: 38741218
If the name is one of your other users, it may be because that user tried to access the other user's calendar.  I am pretty sure that Exchange System Manager is showing you "access attempts", though and not actual accesses and in your case if you're using the domain admin account for backupexec then that should be the reason

 

It could also be someone opening another user's calendar through Outlook, for example.  If it is 2 people that don't work together or it is people that should not be trying to open the boss' calendar, then you should probably investigate.
0
 

Author Comment

by:tobe1424
ID: 38741743
i forgot to mention that the "access attempts" are identical. I've seen a few topics online with respect to another user showing up. But in my case its the domain admin. Check it out:

Mailstore
0
 
LVL 3

Expert Comment

by:gaurav2rawat
ID: 38741866
As I said earlier its just the access attempts could be for backups or other activities like calendar opening for other user
If still worried then check the backup times and verify it with the account access
0
 

Author Comment

by:tobe1424
ID: 38745707
its possible that the backup times are causing this...but then again i have other users who still show that the domain admin last attempted to access the mailbox, however it shows that this occurred 6 years ago..example...2007, some 2009...

i only submitted a portion of a screenshot to show some that were accessed simultaneously.

thx again..
0
 
LVL 3

Accepted Solution

by:
gaurav2rawat earned 500 total points
ID: 38751420
In that case you could check the Local Security event log which will tell you who and when, a given user logged on to the Exchange server. The Domain Controller Security event log will tell you who logged on to a specific mailbox and when they did so.
You could also use exchange mailbox auditing using this Microsoft article
http://technet.microsoft.com/en-us/library/ff461937.aspx


There are variety of users who access mailbox for again a variety of reasons from backups, antivirus scans to calendar and day to day email tasks. Now what happened in the past is all speculations-as we can't research much on that, but for future you could enable auditing at the maibox level using this article-
http://technet.microsoft.com/en-us/library/ff461937.aspx
0

Featured Post

Complete VMware vSphere® ESX(i) & Hyper-V Backup

Capture your entire system, including the host, with patented disk imaging integrated with VMware VADP / Microsoft VSS and RCT. RTOs is as low as 15 seconds with Acronis Active Restore™. You can enjoy unlimited P2V/V2V migrations from any source (even from a different hypervisor)

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Active Directory security has been a hot topic of late, and for good reason. With 90% of the world’s organization using this system to manage access to all parts of their IT infrastructure, knowing how to protect against threats and keep vulnerabil…
Recently, Microsoft released a best-practice guide for securing Active Directory. It's a whopping 300+ pages long. Those of us tasked with securing our company’s databases and systems would, ideally, have time to devote to learning the ins and outs…
The video tutorial explains the basics of the Exchange server Database Availability groups. The components of this video include: 1. Automatic Failover 2. Failover Clustering 3. Active Manager
Exchange organizations may use the Journaling Agent of the Transport Service to archive messages going through Exchange. However, if the Transport Service is integrated with some email content management application (such as an antispam), the admini…

749 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question