



If you’re wondering when an Exchange mailbox got created, you will most likely stumble over the Active Directory user attribute MSExchWhenMailboxCreated . You can get the value using PowerShell or ADUC with advanced features enabled.

Get-ADUser -Properties MSExchMaiboxWhenCreated

MSExchWhenMailboxCreated contains not the full truth

That could almost be the end of the story. BUT that attribute is not what you might think. The attribute gets only propagated the FIRST time the user gets a mailbox. If that users mailbox was disabled and then recreated later, the timestamp of the first mailbox creation retains.

If the mailbox creation was done recently, you might find according event log entries on the Exchange Server. If you search the MSExchange Management Event Log for mailbox creations manually (CTRL+F and look for “Enable-Mailbox”) you might find the actual mailbox creation date. The PowerShell way would be:

Get-EventLog -Source "MSExchange CmdletLogs" -LogName "MSExchange Management" -ComputerName < Servername > -Message "*Enable-Mailbox*test.user*"

Exchange Versions

This procedure was tested with Exchange 2013 CU23. I’m not sure if this behavior is intended, of it’s a bug in Exchange 2013. The general procedure should also apply to Exchange 2016/2019 and Exchange Online.