locked
Exchnge System Mgr.: "Last Logged on by NT AUTHORITY\SYSTEM" RRS feed

  • Question

  • I have received a hard copy of Exchange System Manager from a co-worker who is concerned that her mail account has been accessed w/o proper authorization.  I am not familiar with Exchange. 

    Under the path:  Company ABC > Servers > ABCExchange > First Storage Group > Mailbox Store > Mailboxes

    One will find all employee accounts.  The "last Logged on By" column typically will shows (for all other accounts) something like:

    "ABCEXCH\joeuser"

    While the entry for her account on the same day shows:

    "NT AUTHORITY\SYSTEM"

     

    Instead of "ABCEXCH\janeuser", though she has accessed her mail several time that same day.

     

    Can someone explain what this means?

     

    Thank you in advance.

    Wednesday, November 30, 2011 6:57 PM

Answers

  • It can be another process/application which has logged onto your co-worked account.  For e.g if you backups your mailboxes, it would show the account used by the backup program, or e.g if you use an archiving product then it would show that service account.

    In your post, I wouldnt be worried that someone else is logging onto your colleagues account. It shows NT AUTHORITY\SYSTEM which would suggest it's a exchange process and NOT another user.


    Sukh
    • Marked as answer by ainsof Thursday, December 1, 2011 4:06 PM
    Wednesday, November 30, 2011 10:57 PM

All replies

  • Hi Ainsof,

    You could see this when the mailbox manager runs on the server.

    Ref: http://support.microsoft.com/kb/816730

    http://blogs.technet.com/b/exchange/archive/2005/03/21/399807.aspx

    hope this helps!

     


    Thanks & Regards, Kottees *** Please mark it as an answer if it really helps you.
    Wednesday, November 30, 2011 8:13 PM
  • I'm afraid I don't understand.  Are you saying that this particular notification is a result of my coworker running this ESM on the desktop of the server?  (Or via RDT?)

    Can you explain why, in detail?

     

     

    Thank you again.

     

     

    Wednesday, November 30, 2011 9:03 PM
  • Not because of your coworkers running ESM on their desktop.

    Mailbox Manager is a tool that was designed to help enforce corporate message retention policies, and manage information store sizes. This allows you to clean mailboxes based on message size, message type, message age, and other properties.  Mailbox Manager runs within the System Attendant process.

    pls refer above article for more info..


    Thanks & Regards, Kottees *** Please mark it as an answer if it really helps you.
    Wednesday, November 30, 2011 10:17 PM
  • It can be another process/application which has logged onto your co-worked account.  For e.g if you backups your mailboxes, it would show the account used by the backup program, or e.g if you use an archiving product then it would show that service account.

    In your post, I wouldnt be worried that someone else is logging onto your colleagues account. It shows NT AUTHORITY\SYSTEM which would suggest it's a exchange process and NOT another user.


    Sukh
    • Marked as answer by ainsof Thursday, December 1, 2011 4:06 PM
    Wednesday, November 30, 2011 10:57 PM
  • Hi Sukh,

    Thanks a lot for brief explain. 


    Thanks & Regards, Kottees *** Please mark it as an answer if it really helps you.
    Thursday, December 1, 2011 4:52 AM
  • Your welcome.


    Sukh
    Thursday, December 1, 2011 10:30 AM
  • Thank you both. 
    Thursday, December 1, 2011 4:06 PM