Using EWS to search through timestamps RRS feed

  • Question

  • I am completely new to EWS, I am wondering if this can help to check timestamps on calendar accounts. My goal is to determine if certain mailboxes and rooms(in outlook) are still being used. I have set a standard by which I am searching. I am looking for mailboxes and rooms that have not been booked or looked at in more than 2 months. I do not know the capabilities of EWS, however I was told that EWS exchanges information with the host and has infromation packets that carry timestamps. How can I retrieve this?

    Please help me with any direction, I was using powershell, but some of the accounts have never been logged into since they are for calendar and public mailbox use. There should be a way to track this information.

    I don't mind reading a couple books on this, any recommendations would be great also!

    Thanks in Advance!

    Friday, June 22, 2012 6:59 PM

All replies

  •   EWS wont tell you who has looked (or is looking) at a particular mailboxes you can use Get-MailboxStatistics and look at the LastLoggedOnAccount property to see the last access. Otherwise you can enable auditing at the store level (depending on Exchange version) to see who is accessing the folder.

      With EWS you can look at the creation time of the last Item created in the calendar pretty easy if you want to use Powershell get a copy of the EWS Managed API from and then you can use something like

    $MailboxName = ""
    ## Load Managed API dll  
    Add-Type -Path "C:\Program Files\Microsoft\Exchange\Web Services\1.2\Microsoft.Exchange.WebServices.dll"  
    ## Set Exchange Version  
    $ExchangeVersion = [Microsoft.Exchange.WebServices.Data.ExchangeVersion]::Exchange2010_SP2  
    ## Create Exchange Service Object  
    $service = New-Object Microsoft.Exchange.WebServices.Data.ExchangeService($ExchangeVersion)  
    ## Set Credentials to use two options are availible Option1 to use explict credentials or Option 2 use the Default (logged On) credentials  
    #Credentials Option 1 using UPN for the windows Account  
    $creds = New-Object System.Net.NetworkCredential("user@domain","password")   
    $service.Credentials = $creds      
    #Credentials Option 2  
    #service.UseDefaultCredentials = $true  
    ## Choose to ignore any SSL Warning issues caused by Self Signed Certificates  
    ## Code From
    ## Create a compilation environment
    $Provider=New-Object Microsoft.CSharp.CSharpCodeProvider
    $Params=New-Object System.CodeDom.Compiler.CompilerParameters
    $Params.ReferencedAssemblies.Add("System.DLL") | Out-Null
      namespace Local.ToolkitExtensions.Net.CertificatePolicy{
        public class TrustAll : System.Net.ICertificatePolicy {
          public TrustAll() { 
          public bool CheckValidationResult(System.Net.ServicePoint sp,
            System.Security.Cryptography.X509Certificates.X509Certificate cert, 
            System.Net.WebRequest req, int problem) {
            return true;
    ## We now create an instance of the TrustAll and attach it to the ServicePointManager
    ## end code from
    ## Set the URL of the CAS (Client Access Server) to use two options are availbe to use Autodiscover to find the CAS URL or Hardcode the CAS to use  
    #CAS URL Option 1 Autodiscover  
    "Using CAS Server : " + $Service.url   
    #CAS URL Option 2 Hardcoded  
    #$uri=[system.URI] "https://casservername/ews/exchange.asmx"  
    #$service.Url = $uri    
    ## Optional section for Exchange Impersonation  
    #$service.ImpersonatedUserId = new-object Microsoft.Exchange.WebServices.Data.ImpersonatedUserId([Microsoft.Exchange.WebServices.Data.ConnectingIdType]::SmtpAddress, $MailboxName) 
    $folderid = new-object Microsoft.Exchange.WebServices.Data.FolderId([Microsoft.Exchange.WebServices.Data.WellKnownFolderName]::Calendar,$MailboxName)   
    $Calendar = [Microsoft.Exchange.WebServices.Data.Folder]::Bind($Service,$folderid)
    $ivItemView = New-Object Microsoft.Exchange.WebServices.Data.ItemView(1)
    if($Calendar.TotalCount -gt 0){
    	$fiResults = $Calendar.findItems($ivItemView)
    	if($fiResults.TotalCount -gt 0){
    		"Last Created Subject : " + $fiResults.Items[0].Subject
    		"Last Created DateTime : " + $fiResults.Items[0].DateTimeCreated		
    Monday, June 25, 2012 6:45 AM