Exchange Server Forums

Can "last logged on by" be trusted?

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [Microsoft Exchange 2003] >> Server Security >> Can "last logged on by" be trusted?

Page: [1]

Message

<< Older Topic Newer Topic >>

Limited time MSExchange.org offer! -- 1.Sep.2008 1:00:00 PM

TechGenix and SolarWinds have partnered to provide free copies of SolarWinds Exchange Monitor to all visitors who join the MSExchange.org Forums. SolarWinds Exchange Monitor is a handy desktop dashboard that continuously monitors Microsoft Exchange to deliver real-time insight into Exchange services, mail queue sizes, and host server health. Learn more about Exchange Monitor and the free offer!

Can "last logged on by" be trusted? - 17.Oct.2005 1:55:38 PM

bluescrn99

Posts: 1
Joined: 17.Oct.2005
Status: offline

Went into Exchange System Manager to look at mailbox sizes for users on this server. Was surprised to see that one of my user's accounts was showing an employee from our corporate office in the "last logged on by" field. Have verified that the local user is not sharing a calendar or other folder with the corporate person. Is there any administrative reason why the mailbox would be showing this person as accessing the mailbox? (There are a few mailboxes that were showing the account that runs the nightly backup jobs as the "last logged on by".) Have been watching this more closely the last few days and found one other instance where the same users's mailbox was accessed by a different person in the corporate office. (I need to be absolutely positive we can trust this info before the issue is raised with corporate management.)

Post #: 1

Featured Links*

RE: Can "last logged on by" be trusted? - 19.Oct.2005 5:17:30 AM

khowlette

Posts: 139
Joined: 19.May2005
From: UK
Status: offline

Hi

Does somebody else have access to this mailbox, it may be thats it being used by somebody else. Check the mailbox and see you has rights to it.

(in reply to bluescrn99)

Post #: 2

RE: Can "last logged on by" be trusted? - 24.Oct.2005 11:41:23 AM

BeTaCam

Posts: 420
Joined: 24.Feb.2003
From: India
Status: offline

:)

Someone has access to someone else's mailbox if not officially delegated. Check for Event ID's and date and time on the Exchange Server logs for this incident and post them. Should be able to determine what is the exact reason.

BC

(in reply to khowlette)

Post #: 3

RE: Can "last logged on by" be trusted? - 25.Oct.2005 8:43:11 AM

mbunch

Posts: 56
Joined: 9.Aug.2005
From: Raleigh, NC
Status: offline

I don't know the answer to this for sure so this is a shot in the dark on my part.

In Exchange 5.5, the logon information could be different because someone accessed a user's calendar or did a look up against the Free/Busy information. Also, if the user has delegate access and has the "open additional mailbox at logon" enabled, they would be shown as accessing the user's mailbox as well.

I admit that I don't know all of the details about how the 2003 mechanics work, but it possible that Exchange 2003 behaves in the same fashion.

-- Mike

(in reply to bluescrn99)

Post #: 4

RE: Can "last logged on by" be trusted? - 27.Oct.2005 1:54:39 PM

NarayanM

Posts: 85
Joined: 30.Jul.2004
From: hollywood, CA
Status: offline

quote:

ORIGINAL: mbunch

I don't know the answer to this for sure so this is a shot in the dark on my part.

In Exchange 5.5, the logon information could be different because someone accessed a user's calendar or did a look up against the Free/Busy information. Also, if the user has delegate access and has the "open additional mailbox at logon" enabled, they would be shown as accessing the user's mailbox as well.

I admit that I don't know all of the details about how the 2003 mechanics work, but it possible that Exchange 2003 behaves in the same fashion.

-- Mike

In my experience, that is what it is. Doing a meeting request, and checking free/busy information will show a 'last logged in' in the ESM.

We have that behavior on Exchange 2003 SP1

(in reply to mbunch)

Post #: 5