Thanks to PowerShell, you can easily verify the activity on a shared or a user’s mailbox on Exchange (on-premises and Online).
The cmdlets that come in handy in this situation are:
- Get-MailboxStatistics, which lets us check the Last logon time on a mailbox,
- And, of course, Get-Mailbox
Let’s start with the most basic activity report – a list of users’ and shared mailboxes sorted starting from the most recent logon time.
Here is the script that will let us generate it:
Get-Mailbox -ResultSize Unlimited -RecipientTypeDetails UserMailbox,SharedMailbox | Get-MailboxStatistics | Sort-Object lastlogontime -Descending | Select-Object DisplayName,LastLogonTime
If you don’t need the whole list, just a certain number of most active mailboxes, use the -First parameter in the Select-Object cmdlet:
Get-Mailbox -ResultSize Unlimited -RecipientTypeDetails UserMailbox,SharedMailbox | Get-MailboxStatistics | Sort-Object lastlogontime -Descending | Select-Object –First <number> -Property DisplayName,LastLogonTime
Keep in mind that the script above won’t let you control the activity time range in your list. No worries – that’s where the next script comes in:
Get-Mailbox -ResultSize Unlimited –RecipientTypeDetails UserMailbox,SharedMailbox | Where {(Get-MailboxStatistics $_.Identity).LastLogonTime -gt (Get-Date).AddDays(-30)} | Sort -Property @{e={( Get-MailboxStatistics $_.Identity).LastLogonTime}} -Descending | Select-Object DisplayName,@{n="LastLogonTime";e={(Get-MailboxStatistics $_.Identity).LastLogonTime}}
The key part is the configuration of the Where filter.
In my example it’s configured to list mailboxes which were active in the last 30 days:
(Get-MailboxStatistics $_.Identity).LastLogonTime -gt (Get-Date).AddDays(-30)
But it can be just as easily set up to check activity by hours, minutes, seconds or years. Learn more about date arithmetic in the Get-Date cmdlet
Tips
All of the above results can be exported to CSV files by piping the cmdlets to Export-Csv.
To list inactive mailboxes, simply leave out the -Descending switch in each script.
Exchange 2013 from MS:
As we discussed, I understand you’re talking about the ‘LastLogonTime’ property for the mailbox statistics. In older versions of Exchange this property was indeed used to track the last login time of a mailbox, but now has become a bit of a misnomer. While you previously it might have indicated the last time a Delegate or Owner logged into the mailbox, currently it is used to indicate the last time the mailbox was accessed, in most cases by a mailbox assistant, so it’s not a good metric for tracking the actual usage of a mailbox.
If you needed to know the exact timestamp of the last logon and it is within the logging timeframe (max 90 days), you can pull a audit log for each mailbox and look for the MailboxLogin event.
https://docs.microsoft.com/en-us/Exchange/policy-and-compliance/mailbox-audit-logging/mailbox-audit-logging?view=exchserver-2019
Unfortunately I was not able to find any official documentation that state that the ‘LastLogonTime’ is a supported parameter or not. I will keep looking from this documentation and in case I’m not able to find it will submit the request with our Team.
I am getting an error running the Where>number of days script. Exchange Management Shell Pipeline Not Executed Because a Pipeline Is Already Executing..
Please try saving get-mailbox results into a variable and then substitute the first part of the script with the variable:
$Mailboxes = Get-Mailbox -ResultSize Unlimited –RecipientTypeDetails UserMailbox,SharedMailbox;$Mailboxes | Where...
I think you mean to use the “Where-Object” cmdlet
Can you show me the documentation for the “Where” cmdlet?
Hi Brian,
Where is an alias for the Where-Object cmdlet. Which means that, unless you change or remove this default alias, Where and Where-Object will give you the same results.
Thanks for posting this, Adam.
In a hybrid configuration, it is possible to identify active onprem mailboxes? I think we’ve migrated all the mailboxes to O365 that are going to remain active. I would like to tell if there are any active onprem mailboxes that have been missed and migrate them.
Thanks!
Hi Joe,
Generating the list of active mailboxes is the easy part – you can follow the instructions from the article above. The slightly harder part is comparing the list from the on-prem Exchange with the list of mailboxes in Office 365. Personally, I would do the following:
1. generate the two lists mentioned above and export them to CSV files,
2. open them in MS Excel, leave only mailbox aliases so that they are displayed in two different columns,
3. and use Conditional Formatting > Highlight Cells Rules > Duplicate Values… to mark unique values.
Then, all mailboxes which have not been migrated to Office 365 will be highlighted.
Hope this helps