Exchange 2010 last logon time to mailbox

This post is also available in: Polish

 

Sometimes we need to find when user logged to mailbox for the last time.

To achieve this we need to use  Get-MailboxStatistics CMDlet

Below command will display LastLogonTime for mailbox JSmith:

Get-MailboxStatistics JSmith | select DisplayName, LastLogonTime

 

If we are using shared mailboxes we also should display user account which were used to log to mailbox.
This command will display mailbox name, LastLogonTime and user account used to logon:

Get-MailboxStatistics JSmith | select DisplayName, LastLogonTime, LastLoggedOnUserAccount

 

When we want to get logon time information for all mailboxes in database or in mailbox server MX01, we need to use Get-Mailbox CMDlet, and pipe result to Get-MailboxStatistics

Below example will return last logon time for all mailboxes supported by MX01 mailbox server:

Get-Mailbox -server MX01 -ResultSize Unlimited | Get-MailboxStatistics | sort LastLogonTime select DisplayName, LastLogonTime, LastLoggedOnUserAccount

 

When we have lot of mailboxes on our server we need to pipe results to a file like .csv where we can sort and filter results.

To achieve this you need to add this command at the end:

| Out-File d:\scripts\LastLogon_Report.csv

 

You have to be aware of that LastLogonTime is modified by Microsoft Outlook and all mobile devices used to connect to mailbox. So it doesn’t mean that user logged to mailbox, it can mean that he left running Outlook or has mobile devices connected to mailbox which checks emails in mailbox from time to time.

 

 

Print Friendly
Tagged , . Bookmark the permalink.

2 Responses to Exchange 2010 last logon time to mailbox

  1. Eswar says:

    Hi,Which ADAttribute does the LastLoginTime refer to..?

Leave a Reply to Eswar Cancel reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>