Exchange Issues Event: 1009

Event ID 1009: Mailbox owner logons

Event ID 1009:

This Exchange event indicates a normal log on activity performed by a particular user. You might want to keep track of all the logon activities including the ones performed by the owner of a particular mailbox. This will prove to be useful whenever there is an issue and you would like to find the root cause. For example like an unintended permission or quota change.

About Exchange Reporter Plus:

Exchange Reporter Plus is a reporting, monitoring and change auditing tool for Exchange servers, Exchange Online and Skype for Business servers. This tool offers reports to audit all owner activities performed in a particular mailbox. This shall be helpful for internal auditing purposes and it is also wise to keep a record of all the changes made.

Steps to generate mailbox logon reports:

1. Go to the Reports tab on the top pane.
2. Navigate to Exchange Server > OWA & ActiveSync > ActiveSync General Reports or ActiveSync Request Reports.
3. Choose a suitable report for your requirements.
4. Enter the name of the organization.
5. Click on Generate Now.

Steps to fetch monitoring report to check ActiveSync connectivity:

1. Go to the Audit tab on the top pane.
2. Navigate to Advanced Audit drop-down on the left side.
3. Expand the Mailbox Audit Logging section, and choose the Owner Activity on Mailbox report.
4. Enter the period for report generation.
5. Select the type of view for the report (Summary, Default, or Custom View).

The Exchange Reporter Plus advantages:

• Schedule reports to get regular updates about various Exchange objects.
• Export reports in any of the 4 formats: HTML, CSV, PDF and XLS.
• Add or remove columns from the report and customize them as and when you require.
• Use the advanced filter options to generate and scrutinise the reports further.
• Customise alert profiles to get immediate SMS or email notifications.
• Add new actions that you want to audit apart from the pre-defined ones.