pramod1
asked on
exchange, mailbox
how can I found who last logged into the mailbox (shared mailbox)
like 5000 mails were unread suddenly
like 5000 mails were unread suddenly
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Use theGet-MailboxStatistics cmdlet in the Exchange Management Shell
ASKER
if mailbox name is im connect, what command should I use
How many users do you have? If not many, just use theGet-MailboxStatistics it will show all then look for the shared mailbox name.
ASKER
NO I NEED TO see who logged into the mail box, what command should I use
Get-MailboxStatistics "Shared Mailbox Name"
Do you know the name of the shared mailbox?
Do you know the name of the shared mailbox?
ASKER
Get-MailboxStatistics -IMCONNECTSETUP@DOMAIN.COM | Sort LastLogonTime -Descending- IS NOT WORKING
ASKER
Yes I pinged above
Actually, not sure if Get-MailboxStatistics will work with sharedmailbox because users can’t log into it them directly. Sorry, let me do some more testing.
Try
Get-MailboxStatistics 'emailaddressofsharedmailb ox' | Select *log*
Get-MailboxStatistics 'emailaddressofsharedmailb
Did you have mailbox auditing enabled? Use Get-Mailbox SharedMailBox | fl *audit*
If false then you won't have that history. You will have to enabled it first.
https://community.spiceworks.com/how_to/120006-how-to-monitor-who-accessed-a-shared-mailbox
If false then you won't have that history. You will have to enabled it first.
https://community.spiceworks.com/how_to/120006-how-to-monitor-who-accessed-a-shared-mailbox
ASKER
IT JUST SAYS LOG OFF TIME
Use Get-Mailbox SharedMailBox | fl *audit* to check if mailbox auditing is enabled. It's disabled by default.
Replace SharedMailBox with actual name
Replace SharedMailBox with actual name
ASKER
I NEED TO CHECK who logged bwteen 9 and 11am today
What version of exchange are you using? Please list that when opening questions
ASKER
can I just found who logged
ASKER
sorry exchange 2010 sp3
ASKER
I just need to know who emails were unread and who logged in today
Won't be possible to trace who accessed the shared mailbox earlier today without mailbox auditing enabled. By default, the mail box audit is disabled.
https://www.netwrix.com/how_to_monitor_who_accessed_shared_mailbox.html
Get-MailboxStatistics cmdlet will only show the last logon time
https://www.netwrix.com/how_to_monitor_who_accessed_shared_mailbox.html
Get-MailboxStatistics cmdlet will only show the last logon time
ASKER
SO there is no command shell to find who logged
Try
Get-LogonStatistics 'emailaddressofthesharedMa ilbox'
Get-LogonStatistics 'emailaddressofthesharedMa
ASKER
I ONLY GOT SERVER NAME
Hi,
Until you have auditing pre-enabled, you can't see who has done what in your environment.
You must enable auditing in order to fetch these reports and find the real culprit.
Below guide containing step by step details to enable shared mailbox auditing and track every critical changes at granular level - https://www.codetwo.com/ad mins-blog/ user-mailb ox-and-sha red-mailbo x-auditing -in-exchan ge-2013/
Until you have auditing pre-enabled, you can't see who has done what in your environment.
You must enable auditing in order to fetch these reports and find the real culprit.
Below guide containing step by step details to enable shared mailbox auditing and track every critical changes at granular level - https://www.codetwo.com/ad
How to find the ‘last logon time’ of mailboxes in the Exchange Server:
https://community.spiceworks.com/how_to/131242-how-to-find-the-last-logon-time-of-mailboxes-in-the-exchange-server
Track shared mailbox access on Exchange Server:
https://www.lepide.com/how-to/track-shared-exchange-mailboxes-access.html
Last Logon Information in Exchange 2013:
http://techgenix.com/last-logon-information-exchange-2013/
https://community.spiceworks.com/how_to/131242-how-to-find-the-last-logon-time-of-mailboxes-in-the-exchange-server
Track shared mailbox access on Exchange Server:
https://www.lepide.com/how-to/track-shared-exchange-mailboxes-access.html
Last Logon Information in Exchange 2013:
http://techgenix.com/last-logon-information-exchange-2013/
ASKER