Link to home
Start Free TrialLog in
Avatar of pramod1
pramod1Flag for United States of America

asked on

exchange, mailbox

how can I found who last logged into the mailbox (shared mailbox)

like 5000 mails were unread suddenly
ASKER CERTIFIED SOLUTION
Avatar of Wayne88
Wayne88
Flag of Canada image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of pramod1

ASKER

exchange 2010 enterprise
Use theGet-MailboxStatistics cmdlet in the Exchange Management Shell
Avatar of pramod1

ASKER

if mailbox name is im connect, what command should I use
How many users do you have?  If not many, just use theGet-MailboxStatistics it will show all then look for the shared mailbox name.
Avatar of pramod1

ASKER

NO I NEED TO see who logged into the mail box, what command should I use
Get-MailboxStatistics "Shared Mailbox Name"

Do you know the name of the shared mailbox?
Avatar of pramod1

ASKER

Get-MailboxStatistics -IMCONNECTSETUP@DOMAIN.COM | Sort LastLogonTime -Descending- IS NOT WORKING
Avatar of pramod1

ASKER

Yes I pinged above
Actually, not sure if Get-MailboxStatistics will work with sharedmailbox because users can’t log into it them directly.  Sorry, let me do some more testing.
Try

Get-MailboxStatistics 'emailaddressofsharedmailbox' | Select *log*
Did you have mailbox auditing enabled?  Use Get-Mailbox SharedMailBox | fl *audit*

If false then you won't have that history.  You will have to enabled it first.

https://community.spiceworks.com/how_to/120006-how-to-monitor-who-accessed-a-shared-mailbox
Avatar of pramod1

ASKER

IT JUST SAYS LOG OFF TIME
Use Get-Mailbox SharedMailBox | fl *audit* to check if mailbox auditing is enabled.  It's disabled by default.

Replace SharedMailBox with actual name
Avatar of pramod1

ASKER

I NEED TO CHECK who logged bwteen 9 and 11am today
What version of exchange are you using? Please list that when opening questions
Avatar of pramod1

ASKER

can I just found who logged
Avatar of pramod1

ASKER

sorry exchange 2010 sp3
Avatar of pramod1

ASKER

I just need to know who emails were unread and who logged in today
Won't be possible to trace who accessed the shared mailbox earlier today without mailbox auditing enabled.  By default, the mail box audit is disabled.

https://www.netwrix.com/how_to_monitor_who_accessed_shared_mailbox.html

Get-MailboxStatistics cmdlet will only show the last logon time
Avatar of pramod1

ASKER

SO there is no command shell to find who logged
Try

Get-LogonStatistics 'emailaddressofthesharedMailbox'
Avatar of pramod1

ASKER

I ONLY GOT SERVER NAME
Hi,
Until you have auditing pre-enabled, you can't see who has done what in your environment.
You must enable auditing in order to fetch these reports and find the real culprit.
Below guide containing step by step details to enable shared mailbox auditing and track every critical changes at granular level - https://www.codetwo.com/admins-blog/user-mailbox-and-shared-mailbox-auditing-in-exchange-2013/
Avatar of Naveen Sharma
Naveen Sharma

How to find the ‘last logon time’ of mailboxes in the Exchange Server:
https://community.spiceworks.com/how_to/131242-how-to-find-the-last-logon-time-of-mailboxes-in-the-exchange-server

Track shared mailbox access on Exchange Server:
https://www.lepide.com/how-to/track-shared-exchange-mailboxes-access.html

Last Logon Information in Exchange 2013:
http://techgenix.com/last-logon-information-exchange-2013/