Where are mailbox last logon, client IP address and other details in Exchange 2007 & Exchange 2010?

by Bharat Suneja

In Exchange Server 2003/2000, expanding a Mailbox Database (MDB) provides information about mailboxes in a database, last logon/logoff times and account(s) that logged on to mailboxes (see ‘Displaying Client IP Address in Exchange System Manager‘ for details).

Screenshot: Store Logons
Figure 1: In Exchange 2003, the Logons node displays Store logon-related information. Click here to see a bigger screenshot.

In Exchange Server 2007/2010, these details are not displayed in the EMC. The reasons are not hard to guess. These details are retrieved by querying the mailbox database. In Exchange 2003, these are displayed when you select the mailbox database, resulting in a single mailbox database being queried. In Exchange 2007/2010, mailboxes are displayed when you select Recipient Configuration -> Mailboxes, and depending on the selected scope or filter, the console displays mailboxes from the entire organization. Querying all mailbox databases on different servers in a distributed organization can become very slow, generate a lot of extra network traffic— terribly inefficient.

Instead, why not allow the administrator to query for these details when they’re actually required? The shell provides you the flexibility to only get the fields you want, only for the mailboxes you want, making it much more efficient. If you manage smaller Exchange deployments and love your GUI management tools, you may not fall in love with the idea. (But that debate’s already settled, and you’re going to have to learn some bit of Exchange shell to be able to manage Exchange 2007 and later. The good news is, it’s cooler, easy-to-use, well-documented by now, and comes with plenty of help!).

Logon Statistics

The Get-LogonStatistics cmdlet provides the following logon-related information.

AdapterSpeed :
ClientIPAddress :
ClientMode :
ClientName :
ClientVersion :
CodePage :
CurrentOpenAttachments :
CurrentOpenFolders :
CurrentOpenMessages :
FolderOperationCount :
FullMailboxDirectoryName :
FullUserDirectoryName :
HostAddress :
LastAccessTime :
Latency :
LocaleID :
LogonTime :
MACAddress :
MessagingOperationCount :
OtherOperationCount :
ProgressOperationCount :
RPCCallsSucceeded :
StreamOperationCount :
TableOperationCount :
TotalOperationCount :
TransferOperationCount :
UserName :
Windows2000Account :
ServerName :
StorageGroupName :
DatabaseName :
Identity :

The command can be constrained to a mailbox database (Get-LogonStatistics -Database “MyDatabase” | fl), a mailbox server (get-logonstatistics -Server “MyServer”), or a particular mailbox.

Mailbox information

In ESM, the Mailboxes node of a Mailbox Store displays mailbox-related information such as mailbox size, number of items, and last logon/logoff.

Screenshot: Mailboxes node in Exchange 2003 ESM
Figure 2: In Exchange 2003, the Mailboxes node displays mailbox-related information. Click here to see a bigger screenshot.

This information can be retrieved using the Get-MailboxStatistics cmdlet. It provides the following information related to a mailbox:

AssociatedItemCount :
DeletedItemCount :
DisconnectDate :
DisplayName :
ItemCount :
LastLoggedOnUserAccount :
LastLogoffTime :
LastLogonTime :
LegacyDN :
MailboxGuid :
ObjectClass :
StorageLimitStatus :
TotalDeletedItemSize :
TotalItemSize :
Database :
ServerName :
StorageGroupName :
DatabaseName :
Identity :

It can also be constrained to a -Database, -Server, or mailbox.

Now that we’re dealing with the shell, besides these cmdlets’ built-in filtering capabilities (Database, Server, or mailbox), you can use Powershell’s where-object cmdlet to further filter the results based on the properties returned by each cmdlet. For example, to find out logon sessions from a particular IP address:

Get-LogonStatistics -Server “MyServer” | where {$_.ClientIPAddress -like “192.168.2.101”}

{ 15 comments… read them below or add one }

Anonymous July 24, 2008 at 9:18 am

Get-LogonStatistics default display is ugily:

Lots of … in the output. Does anyone test this stuff? :-)

Reply

Anonymous July 24, 2008 at 8:14 pm

Another wonderful post – thanks for making it easier!

Daniel Smith

Reply

Anonymous July 25, 2008 at 7:09 am

Will this stuff ever be put back in the GUI ?

Most non full time email administrators do not have the time to try and figure out PowerShell..

Reply

Morat November 28, 2012 at 3:54 am

Totally with you. Powershell is a horrible excuse for a shell anyway. SO damn wordy.

Reply

lseamans September 3, 2008 at 1:23 pm

I can’t seem to SEE all the fields, they’re off the side. i’m fidgeting with window size, etc, but is there a way to say, show me fields listed DOWN instead of across?

Reply

Bharat Suneja September 3, 2008 at 1:31 pm

@Lynne:
– To list all fields in a list view instead of the default table view, pipe the output to format-list, for example:
Get-Mailbox “foo” | fl
Get-ReceiveConnector | fl
Get-SendConnector | fl

– To select and view only particular properties of an object, use the Select-Object cmdlet:
Get-Mailbox | Select Name,Databse,*Email*

Get-ReceiveConnector | Select Name,Bindings

– To format tables where information in the rows fits, use the format-table cmdlet with the -AutoSize switch:
Get-Mailbox | ft Name,Database,*Email* -AutoSize

Reply

lseamans September 4, 2008 at 1:41 pm

THANK YOU!!

Reply

ip finding September 29, 2008 at 11:30 pm

Thanks! I’ve been looking for this!

Reply

lseamans January 13, 2009 at 5:41 am

I have another question, and i bet i’m just being dumb (again).

Sometimes when i do “get-logonstatistics” for a mailbox, nothing comes back. Just the prompt.

Does that mean the mailbox has never been logged on?

I’m trying to find out how someone accesses their mailbox, and it could be imap. How do i check for that?

Reply

Anonymous June 8, 2009 at 4:57 am

oh and brilliant, get-logonstatistics is too wide for the default settings of the window and you can't change the width without causing an error.

GOOD WORK!!!

Reply

Anonymous June 17, 2009 at 2:26 pm

I personally love Powershell. It is one of the best decisions MS has ever made.

Get-LogonStatistics username | ft username, logontime, lastaccesstime, servername, clientversion -autosize

Or:
Get-LogonStatistics | Export-Csv logonstats.csv -NoTypeInformation

Export all the logon stats for every user, all fields, then you can sort and filter with Excel to get exactly what you are looking for.

How about this?
Get-LogonStatistics | where {$_.ClientVersion -eq "12.0.6423.1000"} | Measure-Object

Get the count times a mailbox was opened with Outlook 2007.

Reply

Anonymous June 18, 2009 at 3:18 am

Hi to all!!!
Can you explain how to obtain history logging to one mailbox during the definite period of time.
This command returns only information about active connections, isn't it?

Best regards!!!

Reply

Anonymous October 7, 2009 at 9:18 am

Would anyone have a CmdLet for gathering the lastLogon attribute from mailboxes on an Exchange 2003 server?

The goal is to have a script that will rehome mailboxes that have not been logged into over a set period, to an Exchange 2007 server.

Cheers

Reply

tom November 1, 2012 at 12:15 am

Whenever i run this get-mailboxstatistics cmdlet i get this error
Get-LogonStatistics’ is not recognized as an internal or external command,
and on powershell i get the error
The term ‘.\get-mailboxstatistics’ is not recognized as the name of a cmdlet, function, script file, or operable progra
m. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.

How i can run this command then?

regards

Reply

Bharat Suneja November 2, 2012 at 3:53 pm

1. Are you doing this in Exchange Shell or Windows PowerShell?
2. One thing to check would be permissions. In Exchange 2010, you need to have the appropriate permissions to be able to run a cmdlet (or even have it returned when you use Get-Command). See the permissions snippet in each cmdlet.

Reply

Leave a Comment

Previous post:

Next post: