question

razc-5568 avatar image
0 Votes"
razc-5568 asked razc-5568 answered

How to find exchange mailbox user last logon computer name/workstation?

Hi techies,

We have one username that always got locked out.

From the username, we trace the event id 4740 in Domain Controller and we found the "Caller Computer Name" was one of our exchange server. Since the user is a 'floater' user (doesn't have fix workstation), we need to trace on which workstation it was used to log in to the mailbox.

How we can find such information in Exchange console/ Exchange powershell console?

office-exchange-server-administration
· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hi @razc-5568

I am writing to see how everything is going on with this thread. If you still have further concern on this, please feel free to let us know.


If an Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.



0 Votes 0 ·
AndyDavid avatar image
0 Votes"
AndyDavid answered
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

joyceshen-MSFT avatar image
0 Votes"
joyceshen-MSFT answered

Hi @razc-5568

Agree with the suggestion above from Andy, you could check the IIS log for the user login information:

The IIS log is enabled by default, the location is in C:\inetpub\logs\LogFiles\W3SVC1, and the log is generated once a day by default.
You could use Excel to analyse the logs or other tools like Log Parser Studio

And the meanings of the fields are introduced here: W3C Logging


If an Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.


5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

razc-5568 avatar image
0 Votes"
razc-5568 answered

Many thanks to @AndyDavid @joyceshen-MSFT for providing the answer. Yeap, this is what I am looking for.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.