With this article I would like to explain how to audit your Exchange Infrastructure to understand if someone is accessing other mailboxes.

Scenario:
User1 : normal user configured in EXAMPLE Exchange System.
UserA : Bad Exchange Administrator for EXAMPLE mail system.
UserB : Good Exchange Administrator for EXAMPLE mail system.

Question:
UserA access User1 mailbox to read his/her e-mails. How UserB can audit this activity?

Answer:
UserB must access EXAMPLE Exchange Server (locally or using remote desktop) and run Exchange Management Shell. This tool is a Powershell Based interface: simple and powerful !!

At Shell prompt UserB mast run Get-MailboxStatistics User1 | Select DisplayName, LastLoggedOnUserAccount in order to display who is the last logged on account for User1 Mailbox

If UserB would like to have more info, he can run Get-MailboxStatistics User1 | fl

Exchange Management Shell can be used to audit, list and export lots information on Mailboxes and Mailbox Stores. Please run “get-excommand” to read a complete commands list. If you prefer can run “get-excommand > commands.txt” to save in a text file.