This question came from an Office 365 Exchange Online administrator. The Office 365 Administration page shows they have some inactive users but it doesn't list their names.
When I log into the Office365 administrative dashboard, it shows me how many inactive users there are, but it doesn't tell me who is inactive. How can I get this information?
As you've discovered, Office 365 doesn't include the names of the inactive mailboxes, but you can use PowerShell to get a list of all users and their last login time.
Get-mailbox -resultsize unlimited| Get-MailboxStatistics | select displayname, lastlogontime
If you have a large number of mailboxes, you can send the results to a CSV file and open it in Excel to sort by the date field. To output the results to a CSV file, add Export-CSV and the file path.
Get-mailbox -resultsize unlimited| Get-MailboxStatistics | select displayname, lastlogontime | Export-Csv C:\Files\test.csv
Tip: If you want to save the file in the path the used in PowerShell, usually C:\Users\Username, you only need to add the folders and file name, as seen in the screenshot above, where the CSV file was saved to C:\Users\Diane\Documents.
Step-by-step instructions
- Open PowerShell using Run as Administrator. Run the following cmdlet to bring up the log in dialog. Enter the Exchange server's administrator username and password. Note, you must have administrator rights to the server to use this.
$LiveCred = Get-Credential
- Next, run this cmdlet:
$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell/ -Credential $LiveCred -Authentication Basic -AllowRedirection
- And then run this cmdlet:
Import-PSSession $Session
- Now you're ready to get the list of users and their last logon time. If you want to output the results to a CSV file, add the Export-CSV command.
Get-mailbox -resultsize unlimited| Get-MailboxStatistics | select displayname, lastlogontime | Export-Csv C:\Files\test.csv
ShandyT says
Is there as way to get a csv list all Shared mailboxes that have not been used for a long time?
Tried it through Exchange Compliance Management but I need a hard copy of the listed mailboxes to show HoD's.
Diane Poremsky says
You can use PowerShell. But... if someone has the shared mailbox in their profile but are not actually using it, the last access time will be current.
$Result=@()$mailboxes = Get-Mailbox -RecipientTypeDetails SharedMailbox -ResultSize Unlimited
$totalmbox = $mailboxes.Count
$i = 1
$mailboxes | ForEach-Object {
$i++
$mbox = $_
$mailboxstats = Get-MailboxStatistics -Identity $mbox.UserPrincipalName | Select LastLogonTime
if ($mailboxstats.LastLogonTime -eq $null){
$lt = "Never Logged In"
}else{
$lt = $mailboxstats.LastLogonTime }
Write-Progress -activity "Processing $mbox" -status "$i out of $totalmbox completed"
$Result += New-Object PSObject -property @{
Name = $mbox.DisplayName
UserPrincipalName = $mbox.UserPrincipalName
LastLogonTime = $lt }
}
$Result | Export-CSV "C:\LastLogon-Info.csv" -NoTypeInformation -Encoding UTF8
Arsal says
Get-mailbox -resultsize unlimited| Get-MailboxStatistics | select displayname, lastlogontime
This command returns list of mailboxes with display name and last logon time but I also want to get PrimarySMTPAddress of mailboxes which is part of Get-mailbox cmdlt but not a part of Get-MailboxStatistics. Anyone know ho to achive that?
Dave says
So can we trust LastLogonTime? If it's null, does that really, really, REALLY mean the user has never used their account? I'm needing to clean out the unused accounts in our Office365 tenant (probably a few thousand), and I don't want to nuke accounts that may still be in use. If LastLogonTime is null, that means they've never logged-in, right? No gotchas, no exceptions?
Diane Poremsky says
Yeah, it would mean the user never logged in. If it is a shared mailbox, the date is the last time someone with permission to the mailbox accessed it.
Dennis says
Why use Excel?
Try piping to Out-GridView or just pipe to sort-object
After all we are talking PowerShell :)
Diane Poremsky says
Because some people might want a csv file to review later...
Johan says
Hello, how can i create a report with all SMTP alliases of an account and count number of messages received on that account last 3 months? So that we can remove unused alliasses from an account.
Diane Poremsky says
You'll need to get all addresses on the account then search the mailbox. You can do this using VBA but i don't have a macro handy that does it. If you only need to check a few addresses, you could set up mail flow rules and either tag the subject lines (so they are easier to find) or forward to another address to monitor. But, this would only work going forward.
jesus says
it is possible to change to change the UPN for another. I have the email in a csv file. im using o365
Diane Poremsky says
If you have the message header and it's editable, yes, but what are you trying to accomplish? There might be a better way.
jesus says
for exaple change jcarlos.1234@mydomain.com to 1234@mydomain.com
Diane Poremsky says
This powershell will remove current addresses, replace them with the addresses in the cmdlet and set one as default.
Set-Mailbox Username -EmailAddresses SMTP:alias@domain.com,smtp:alias@domain.onmicrosoft.com,smtp:otheralias@domain.com
Ron Walters says
Need some help here.. have been tasked with finding a way to be alerted when emails reach 100 unopened emails .. any ideas ?
Diane Poremsky says
100 in your own inbox or across the entire exchange org?
While we can get a running total of your new mail as it arrives, counting only unread messages means we need to check the inbox every so often, just in case you read messages. It can be a little more intensive, especially if the inbox is huge as outlook needs to check each message and see if it's read.
Getting a count for all users on the server is much more difficult.
Greg Lamb says
Is LastLogin a good indication of actual usage though? If staff have the mailbox attached to their Outlook install wouldn't it login every time they use Outlook and therefore not give a good enough indication of when the mailbox was actually used? Something along the lines of when the last email was received would be good??
Diane Poremsky says
Outlook will log in every time the mailbox is opened, so will various services. I no longer have an Exchange 2010 server running to check the results of the Get-mailbox command, but I'm pretty sure it include the last time the mailbox logged in as itself.
I don't think you'll be able to easily get a good value for 'last actively used' - a new message doesn't necessarily mean they read it. Last sent message would be better, but that also doesn't prove they didn't send a message recently. I don't have any scripts that get this information (their might be some in the TechNet gallery) and you'll need to have permission to read the mailbox.
Rup Singh says
Hi, we are running Exchange 2010 and I want to know which script to run on our mailbox server to tell me which mailboxes are inactive/not in use for x period of time - ie. 365 days.
We have a number of shared mailboxes and I ran/downloaded the script from https://gallery.technet.microsoft.com/scriptcenter/List-Inactive-Mailboxes-on-1ac82ddf
and this tells me my shared mailboxes have not sent any emails in x # of days, but that is incorrect as the shared mailboxes are in use daily. ie our helpdesk email account.
Diane Poremsky says
Try
Get-mailbox -resultsize unlimited| Get-MailboxStatistics | select displayname, lastlogontime
Office 365 has the stalemailbox cmdlet is available in 2010 - but this reports in active mailboxes.
Get-StaleMailboxDetailReport | Sort username -Unique | SELECT TenantName, UserName, WindowsLiveID, LastLogin, DaysInactive
Jeff says
Don...the cmdlet won't work if you are running it in powershell. It must be run from the Exchange Management Shell
Don says
The term 'Get-mailbox' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:1 char:12
+ Get-mailbox <<<< -resultsize unlimited| Get-MailboxStatistics | select displayname, lastlogontime | Export-Csv C:\la
st_logon_time.csv
+ CategoryInfo : ObjectNotFound: (Get-mailbox:String) [], CommandNotFoundException
+ FullyQualifiedErrorId : CommandNotFoundException
Diane Poremsky says
Are you using on premise exchange or office 365?
Don says
Exchange 2010 enterprise.
John says
Question regarding LastLogOnTime:
I am running Exchange 2007 SP1. Is the LastLogOnTime value pulled from AD? Or does Exchange 2007 record this as the last logon to the mailbox?
The reason I ask is because I have a number of MBs with no LastLogOnTime, but I believe they are active mailboxes (phones, mainly). This would make sense if LastLogOnTime was an AD attribute, since these accounts don't log on to the domain.
Diane Poremsky says
Exchange records it. The time is in the AD but it's not an AD logon, it's an exchange logon. (I don't log into a network, only into exchange and the last connection time is listed.)
Lorena says
I agree...the most clear information online!! Thank you so much!!!
Harvey Lyau says
Thank you. You are the most clear, concise and correct information that I have found. I searched among dozens of leads from Google, Bing, TechNet and branching into links long lost. You are a breath of fresh air! Be well and prosper...
rajanish says
Dear all can you share command
i want generate report which users not use mails 60 days in exchange 2010
any gud command