Sanitizing Get-LogonStatistics cmdlet data to view better Logon stats in Exchange 2007

If you have used the get-Logonstatistics cmdlet you will know that it’s a great tool for looking at who’s logged onto your Exchange server using Outlook but the results set that it returns can be a little awkward to use in a continuative way. This is way of saying there is a lot of noise in what is returned also because logons are happening at different times of the day if you are looking to log this information over a period of time so you can do statistical analysis of the data it can be a little difficult. So what this script does is first looks at sanitizing the data by only looking at the results from get-Logonstatistics that actually represent mailboxes and also reduces down each logon so it only shows one entry per IP/Client connection. To create files that can be used to look at logon statistics it records the results of each query in a daily file and uses some logic to find new logons and filter existing ones.

How it works

Like many of the scripts I post it uses a lot of different powershell functions to achieve different levels of functionality. It uses Import-csv and Export-csv to keep track of the history status as well as two hashtables are used with an aggregation key that filters down the result set of a Get-logonstatistic query down to a useable format. A get-mailbox query is also used to make sure that only logons that relate to actual mailboxes are included in the results.

Running the Script

When you run the script it takes one argument which is the name of the server you want to run it against. Eg.

.\ sanlog.ps1 yourservername

This is just a simple start but it gives a framework you can could use to create actual logon reports that record when users loged on and logged off and how long they where using resources on your server.

I’ve put a download of this script here the script itself looks like.

$ServerName = $args[0]

$ExcomCollection = @()
$MBHash = @{ }
$MBHistHash = @{ }

$HistoryDir = "c:\LogonHistory"

if (!(Test-Path -path $HistoryDir))
{
New-Item $HistoryDir -type directory
$frun = 1
}

$datetime = get-date
$fname = $script:HistoryDir + "\"
$fname = $fname + $datetime.ToString("yyyyMMdd") + $ServerName + "-LogonHist.csv"

Import-Csv ($fname) | %{
$idvalue = $_.identity.ToString()
$logonEvent = $_
$ltime = [datetime]::Parse($_.LogonTime)
if ($_.ClientIPAddress -eq $null){$agvalue = $_.identity.ToString() + $_.UserName + $ltime.ToString("hhmm").Substring(0,3)}
else{$agvalue = $_.identity.ToString() + $_.UserName + $_.ClientIPAddress}
if ($MBHistHash.Containskey($agvalue) -eq $false){
$MBHistHash.Add($agvalue,$_)
}

}


get-mailbox -server $ServerName -ResultSize Unlimited | foreach-object{
if ($MBHash.Containskey($_.LegacyExchangeDN.ToString()) -eq $false){
$MBHash.add($_.LegacyExchangeDN.ToString(),$_)
}
}
$LogonUnQ = @{ }

get-logonstatistics | foreach-object{
$idvalue = $_.identity.ToString()
$logonEvent = $_
$ltime = $_.LogonTime
if ($_.ClientIPAddress -eq $null){$agvalue = $_.identity.ToString() + $_.UserName + $ltime.ToString("hhmm").Substring(0,3)}
else{$agvalue = $_.identity.ToString() + $_.UserName + $_.ClientIPAddress}
if ($idvalue -ne $null){
if ($LogonUnQ.Containskey($agvalue) -eq $false){
if ($MBHash.Containskey($idvalue)){
$LogonUnQ.Add($agvalue,$logonEvent)
if ($MBHistHash.Containskey($agvalue) -eq $false){
$MBHistHash.Add($agvalue,$_)
}
else{
$ts = New-timeSpan $MBHistHash[$agvalue].LogonTime $ltime
if ($ts.minutes -gt 5){
$MBHistHash.Add($agvalue+$ltime,$_)

}
}
}

}
}
}
foreach ($row in $MBHistHash.Values){
$ExcomCollection += $row
}

$ExcomCollection | export-csv –encoding "unicode" -noTypeInformation $fname