Event IDs related to Mailbox moves
The Event source for Mailbox moves is Exchange Migration, and the events are logged in the Application log on the server where an administrator started the move. Meaning; where the admin was logged on and used the EMC or EMS to start the mailbox move. It would be nice to have all the mailbox move events gathered in one place, and that can be performed with Event collection.
| Event ID | Level | |
| 1006 | Information | Indicates the start of a mailbox move |
| 1022 | Error | Logon failure on database, caused by the mailbox move |
| 9660 | Warning | User X failed to log on because their mailbox is in the process of being moved |
| 9873 | Information | A named property has been created for database XX. Meaning the new mailbox has been created in the destination database. |
| 1007 | Information | The mailbox was successfully moved. |
| 9354 | Information | The mailbox is deleted from the source database |
| 1154 | Information | Rule synchronization between old and new mailbox has completed successfully. |
| 1205 | Error | Failed to create mailbox |
Last logged on user
Whenever you move a mailbox in Exchange Server the LastLoggedOnUserAccount attribute of the mailbox is changed to the user running the mailbox move. This is confusing since that user does not need permission to log on to the mailbox to perform the move.
It can also present a problem if you are trying to figure out which users have yet to log on to their mailboxes after moving them between servers. Let’s say you run this command:
Get-MailboxStatistics | where { $_.LastLogonTime -eq $null }
This would show you which users have never logged on to their mailboxes. Whichever servers they originally were located on cannot be removed before they have logged on at least once and been redirected to their new mailbox servers. Unfortunately, since the user performing the mailbox move is added to the LastLoggedOnUserAccount this command will probably return no users.