Tracing the delivery of a message in Exchange 2003

Posted on 2007-10-16
Last Modified: 2012-05-05
Hi All,

We had someone make a huge mistake costing our corporation a lot of money.  What i need to do is trace a message, that was sent internally to an internal distribution list.  One of the users who caused this claims they didn't receive this message.  Is there any logs or how can i go about finding that this message was sent to his mailbox at 3:21pm yesterday?

Question by:maestro2be
    LVL 14

    Accepted Solution

    Assuming that the logging is enabled, you can just go to message tracking in the Exchange System Manager (under "Tools"), type in the name of the sender or recipient and track the message. It will list all recipients of the message and if the message was delivered.

    Author Comment

    Thanks.  i went to where you said and did the search and it found it and showed me that it was sent to the person in question.  Now my question would be, can i prove he deleted it and what time?  Is that logged?

    LVL 14

    Expert Comment

    This is usually not logged. However there might be a way:
    Use Outlook to connect to the user's mailbox, then go to "recover deleted items" in the "Tools" menu. This depends on the setting on your Exchange server, but if it is set to keep deleted items and the user did not purge the message, you might be able to see when it was deleted.
    LVL 104

    Expert Comment

    If message tracking shows the message being delivered to the mailbox then the message was delivered. Individual message delivery is not logged. You could look in deleted items or recover deleted items to see if the message is in there. You could also look for views, rules etc that could have moved the messages.


    If your question has been answered, please remember to accept the answer and close the question.

    Author Comment

    Thanks for the information guys.  I awarded the points to Wonko because he did perfectly answer the exact question I originally asked.  As far as the finding the deleted it was mandated against the policy of retaining deleted messages so I knew that wasn't available to me at the time, but thanks for the possible solution.  This incident will probably spark the reversal of that mandate to start keeping deleted messages for a period of time.


    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Do You Know the 4 Main Threat Actor Types?

    Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

    Get an idea of what you should include in an email disclaimer with these Top 5 email disclaimer tips.
    Outlook Free & Paid Tools
    Get people started with the process of using Access VBA to control Outlook using automation, Microsoft Access can control other applications. An example is the ability to programmatically talk to Microsoft Outlook. Using automation, an Access applic…
    In this video we show how to create an email address policy in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.:  First we need to log into the Exchange Admin Center. Navigate to the Mail Flow…

    779 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    15 Experts available now in Live!

    Get 1:1 Help Now