JSI Tip 1789. Event ID 1016.

When you attempt to access another users mailbox, or schedule, even if you have been granted access, the following event is logged:

   Event ID: 1016   Source: MSExchangeIS Private   Type: Success Audit   Category: Logons   NT User DomainNameUserName logged on to John/Jane Doe mailbox, and is not the   primary Windows NT account on this mailbox.

An Event ID 1016 is logged, even if you were not successful.

Some antivirus software requires that you use an Exchange Service Admin account, so it can open and scan all mailboxes. This causes Event ID 1016 to be logged for each mailbox, with a text similar to:

NT User ExchService logged on to ExUser mailbox, and is not the Primary Windows NT Account on this mailbox