Microsoft KB Archive/301328

= A 1016 event entry appears in the application event log after you upgrade to Outlook 2002 or to a later version of Outlook =

Article ID: 301328

Article Last Modified on 1/31/2007

-

APPLIES TO


 * Microsoft Office Outlook 2007
 * Microsoft Office Outlook 2003
 * Microsoft Outlook 2002 Standard Edition
 * Microsoft Exchange Server 2003 Standard Edition
 * Microsoft Exchange 2000 Server Standard Edition
 * Microsoft Exchange Server 5.5 Standard Edition

-



This article was previously published under Q301328



SUMMARY
The following event entry may be logged in the Application event log after you upgrade to Microsoft Outlook 2002 or to a later version of Outlook:

Event ID 1016 reports:

NT User [DOMAIN\User] logged on to [User] mailbox, and is not the primary Windows NT account on this mailbox.

This is expected behavior when you use Outlook.



MORE INFORMATION
Microsoft Outlook 2002 and later versions of Outlook have a scheduling feature that is named Planner Options. This feature allows you to view the Calendar Details when you create a meeting request or use the Group Schedules feature. When you use the Planner Options feature, Outlook tries to retrieve the Calendar details of the individuals that you invited to the meeting from their Calendar folders. Even if the logon attempt does not work because of insufficient permission, the Event ID 1016 entry is logged in the application event log.

This behavior also causes the Microsoft Exchange Server Administrator program to display the [DOMAIN\User] account from the 1016 event entry in the private information store Logons container and the Mailbox Resources Properties page as the last Microsoft Windows NT account that tried to access the mailbox.

In versions of Microsoft Outlook that are earlier that Outlook 2002, the log on and query for free/busy information does not cause the Microsoft Exchange Server to log an event entry in the Application event log.

NOTE: The Event ID 1016 message indicates a MapiLogon to the root of the mailbox. This event message occurs even if you have permission to access the mailbox, and whether you access it or not. Do not use this event message as an auditing event to monitor the logon activities to a mailbox.

To turn off (disable) the Planner Options feature, use the following steps
 * 1) On the Tools menu, click Options.
 * 2) On the Preferences tab, click Calendar Options.
 * 3) In the Calendar Options dialog box, click Planner Options.
 * 4) In the Meeting Planner section, click to clear the Show popup calendar details check box.
 * 5) Click OK three times.

Additional query words: last logged on by ol2002 ol2003 ol2007

Keywords: kbreport kbupgrade kbinfo KB301328

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.