Video Screencast Help

How to find the last accessed time and date for the archived mailbox

Created: 04 Feb 2014 • Updated: 19 Feb 2014 | 4 comments
This issue has been solved. See solution.

I want to know when is this vault account last accessed by.

Operating Systems:

Comments 4 CommentsJump to latest comment

TonySterling's picture

Can you clarify what you mean by accessed?  Do you mean items added to the archive or just items viewed?

Do you have auditing enabled?

JesusWept3's picture

You would have to enable auditing unfortunately.
The only things that EV logs without auditing is....

1. When was the Exchange Mailbox Entry record for them last updated? (Typically last synchronization)
2. When was the Archive last updated (typically last time they archived something)
3. When was an Archive Folder for them last updated (Again, last time they archived something in the folder)
4. Newest item archived based on sent/received date
5. Newest Item archived based on archived date

But for who accessed their vault the last time, you would absolutely need Auditing.
You could probably look through the IIS logs and look for any request that isn't Client.gif

Also auditing will not tell you when the user accessed something through Virtual Vault, it would only recall items being read from like Search.asp, archive explorer, OWA, or through a shortcut in Outlook

TypoProne's picture

Hey OP.

Wondering if you had any more outstanding questions related to this posting. If the above answers satisified your expectations for this post please take a second and mark it as resolved so that those trying to help those in need can be easily united with those requiring help.

Thanks in advanced.