This script will look for quarantined event log ID 10018 which is created when a user has been quarantined in Exchange 2010 or 2013. This is currently the only way to find out when a user was quarantined. I plan on updating the script to search through the registry as well in the event that your environment has many event logs that would remove the quarantine event log. 


The Event log looks like the following:

Log Name: Application 
Source: MSExchangeIS 
Event ID: 10018 
Task Category: General 
Level: Error 
The mailbox for user <guid>: /o=Contoso /ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=UserMailbox has been quarantined. Access to this mailbox will be restricted to administrative logons for the next 6 hours.


Help has been added to the script if needed.