"Last Logged on By" value shows NTAUTHORITY\System or a cluster account

When you examine the Last Logged on By value in Exchange System Manager, you notice that all mailboxes were last accessed by NT/AUTHORITY SYSTEM or by DomainName\ClusterNodeName$. The Last Logon Time value shows that these two accounts accessed all the mailboxes at approximately the same time.

This behavior occurs on Microsoft Exchange 2000 servers or Microsoft Exchange 2003 servers that run Mailbox Manager. This behavior does not indicate any issue that is related to system security.

Note that a standard server displays NT/AUTHORITY SYSTEM in the Last Logged on By column, and a cluster displays DomainName\ClusterNodeName$ in the same column.

For more information about Mailbox Manager, click the following article number to view the article in the Microsoft Knowledge Base: