How to find exchange mailbox user last logon computer name/workstation?

razc 21 Reputation points
2022-05-05T05:04:27.983+00:00

Hi techies,

We have one username that always got locked out.

From the username, we trace the event id 4740 in Domain Controller and we found the "Caller Computer Name" was one of our exchange server. Since the user is a 'floater' user (doesn't have fix workstation), we need to trace on which workstation it was used to log in to the mailbox.

How we can find such information in Exchange console/ Exchange powershell console?

Exchange Server Management
Exchange Server Management
Exchange Server: A family of Microsoft client/server messaging and collaboration software.Management: The act or process of organizing, handling, directing or controlling something.
7,484 questions
{count} votes

2 additional answers

Sort by: Most helpful
  1. Joyce Shen - MSFT 16,651 Reputation points
    2022-05-06T02:23:02.5+00:00

    Hi @razc

    Agree with the suggestion above from Andy, you could check the IIS log for the user login information:

    The IIS log is enabled by default, the location is in C:\inetpub\logs\LogFiles\W3SVC1, and the log is generated once a day by default.
    You could use Excel to analyse the logs or other tools like Log Parser Studio

    And the meanings of the fields are introduced here: W3C Logging


    If an Answer is helpful, please click "Accept Answer" and upvote it.

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    0 comments No comments

  2. razc 21 Reputation points
    2022-05-13T05:54:58.06+00:00

    Many thanks to @Andy David - MVP @Joyce Shen - MSFT for providing the answer. Yeap, this is what I am looking for.

    0 comments No comments