JSI Tip 1789. Event ID 1016.

When you attempt to access another users mailbox, or schedule, even if you have been granted access, the following event is logged:

   Event ID: 1016
   Source: MSExchangeIS Private
   Type: Success Audit
   Category: Logons
   NT User DomainName\UserName logged on to John/Jane Doe mailbox, and is not the
   primary Windows NT account on this mailbox.

An Event ID 1016 is logged, even if you were not successful.

Some antivirus software requires that you use an Exchange Service Admin account, so it can open and scan all mailboxes. This causes Event ID 1016 to be logged for each mailbox, with a text similar to:

NT User ExchService logged on to ExUser<n> mailbox, and is not the Primary Windows NT Account on this mailbox

Comments

Plain text