This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
What attribute can be used to best gauge whether a Shared Mailbox is active or not?
So far, I'm using a combination of last email sent/received timestamps and LastLogonTime.
I'm at odds whether the behavior of LastLogonTime is fit for my need though. Does this attribute detect if a shared mailbox is already connected to a user's Outlook desktop application/mobile phone, and they open the shared mailbox' inbox? What interactions does this attribute track or detect?
Additionally, is the attribute LastInteractionTime fit for what I am trying to do?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(44.800000000000004, 43%, 14%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EBJ%3C/text%3E%3C/svg%3E)
hi,@Priscillano Ramon Mariano III
Please refer to Vasily's answer.
The LastLogonTime is not a good indicator of activity, as it can be updated by background processes accessing the mailbox. LastInteractionTime also wont help you here, as it's not updated on most shared mailbox activities (only on direct login). The most accurate information you can get is out of the audit logs, but that would require additional parsing.
Can you help me get started on how to utilize the audit logs for this?
@Vasil Michev , I found the LastEmailTime attribute through export-mailboxdiagnosticlogs.
Would this attribute be helpful in this situation?
At least in my experience, the mailbox diagnostic logs are not a good source for shared mailboxes, but your mileage might vary.
As for the audit logs, you can still use good old Search-MailboxAuditLog:
Search-MailboxAuditLog -Identity ******@domain.com -StartDate (Get-Date).AddDays(-90) -EndDate (Get-Date) -LogonTypes Delegate -ShowDetails