Exchange Issues Event: 1016

Event ID 1016: Exchange mailbox store

Event ID 1016:

This Exchange event indicates that that a user has logged on to a particular mailbox, but that user account is not the owner of the mailbox. Monitoring non-owner logons are important. This way you can keep track of who all have access to the various mailboxes in your Exchange organizations and also stop possible attacks if any.

About Exchange Reporter Plus:

Exchange Reporter Plus is a reporting, monitoring and change auditing tool for Exchange servers, Exchange Online and Skype for Business servers. This tool offers a number of audit and monitoring reports in regards with user logons. Auditing non-user logon in a mailbox is vital to be aware of each logon activity performed and preventing possible information threat or unexpected logons.

Steps to generate mailbox logon reports:

1. Go to the Reporting tab on the top pane.
2. Navigate to Exchange Server > OWA & ActiveSync > ActiveSync General Reports or ActiveSync Request Reports.
3. Choose a suitable report for your requirements.
4. Enter the name of the organization.
5. Click on Generate Now.

Steps to fetch monitoring report to check ActiveSync connectivity:

1. Go to the Auditing tab on the top pane.
2. Navigate to Advanced Audit drop-down on the left side.
3. Expand the Mailbox Audit Logging section, and choose a report. (Admin, delegate, non-owner activites).
4. Enter the period for report generation.
5. Select the type of view for the report (Summary, Default, or Custom View).

Highlights of Exchange Reporter Plus:

• Schedule reports to get regular updates about various Exchange objects.
• Export reports in any of the 4 formats: HTML, CSV, PDF and XLS.
• Add or remove columns from the report and customize them as and when you require.
• Use the advanced filter options to generate and scrutinise the reports further.
• Customise alert profiles to get immediate SMS or email notifications.
• Add new actions that you want to audit apart from the pre-defined ones.