cancel
Showing results for 
Search instead for 
Did you mean: 

How to find the last accessed time and date for the archived mailbox

DKumar
Level 3

I want to know when is this vault account last accessed by.

1 ACCEPTED SOLUTION

Accepted Solutions

JesusWept3
Level 6
Partner Accredited Certified

You would have to enable auditing unfortunately.
The only things that EV logs without auditing is....

1. When was the Exchange Mailbox Entry record for them last updated? (Typically last synchronization)
2. When was the Archive last updated (typically last time they archived something)
3. When was an Archive Folder for them last updated (Again, last time they archived something in the folder)
4. Newest item archived based on sent/received date
5. Newest Item archived based on archived date

But for who accessed their vault the last time, you would absolutely need Auditing.
You could probably look through the IIS logs and look for any request that isn't Client.gif

Also auditing will not tell you when the user accessed something through Virtual Vault, it would only recall items being read from like Search.asp, archive explorer, OWA, or through a shortcut in Outlook

http://www.symantec.com/business/support/index?page=content&id=TECH49054

https://www.linkedin.com/in/alex-allen-turl-07370146

View solution in original post

4 REPLIES 4

TonySterling
Moderator
Moderator
Partner    VIP    Accredited Certified

Can you clarify what you mean by accessed?  Do you mean items added to the archive or just items viewed?

Do you have auditing enabled?

JesusWept3
Level 6
Partner Accredited Certified

You would have to enable auditing unfortunately.
The only things that EV logs without auditing is....

1. When was the Exchange Mailbox Entry record for them last updated? (Typically last synchronization)
2. When was the Archive last updated (typically last time they archived something)
3. When was an Archive Folder for them last updated (Again, last time they archived something in the folder)
4. Newest item archived based on sent/received date
5. Newest Item archived based on archived date

But for who accessed their vault the last time, you would absolutely need Auditing.
You could probably look through the IIS logs and look for any request that isn't Client.gif

Also auditing will not tell you when the user accessed something through Virtual Vault, it would only recall items being read from like Search.asp, archive explorer, OWA, or through a shortcut in Outlook

http://www.symantec.com/business/support/index?page=content&id=TECH49054

https://www.linkedin.com/in/alex-allen-turl-07370146

Prone2Typos
Moderator
Moderator
Partner    VIP    Accredited Certified

Hey OP.

Wondering if you had any more outstanding questions related to this posting. If the above answers satisified your expectations for this post please take a second and mark it as resolved so that those trying to help those in need can be easily united with those requiring help.

 

Thanks in advanced.

 

J

DKumar
Level 3

Thank you all