Solved

MS Exchange 2007 Message Tracking Powershell

Posted on 2009-05-18
9
4,665 Views
Last Modified: 2012-05-07
Experts,

Im not sure if this can be done.

Is there a way to find out all users which send email to a specific domain using message tracking in exchange 2007 using like a wild card * and displaying the email address which sent it and received it ?

Scenario:

user@mycompany.com sends email to user@abc.com I don't know which user sent it or to who it got sent to. The only info i have is it was sent to someone @abc.com domain.

PowerShell Example -

get-messagetrackinglog -Recipients:*@abc.com -Server "MyServer" -Start "1/05/2009 12:13:00 PM" -End "19/05/2009 12:33:00 PM"

Regards,

WizardWill
0
Comment
Question by:WizardWill
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
  • 2
  • +1
9 Comments
 
LVL 49

Accepted Solution

by:
Akhater earned 500 total points
ID: 24419133
I think this is what you are looking for

get-messagetrackinglog -Server "MyServer" -Start "5/18/2009 9:34:00 AM" -End "5/19/2009 9:44:00 AM" | where {$_.Recipients -like "*@domain.com"}

Open in new window

0
 
LVL 6

Author Comment

by:WizardWill
ID: 24428004
is there away to filter the recipients address by domain using wild card ? eg. *@abc.com and get back a list of addresses which have sent emails to this domain
0
 
LVL 49

Expert Comment

by:Akhater
ID: 24429008
Did you try the command I gave you ?

If I understood correctly it is exactly what it does
0
Office 365 Training for IT Pros

Learn how to provision tenants, synchronize on-premise Active Directory, implement Single Sign-On, customize Office deployment, and protect your organization with eDiscovery and DLP policies.  Only from Platform Scholar.

 
LVL 6

Author Closing Comment

by:WizardWill
ID: 31582861
Thanks very much that worked great. I just had to put in the  (-ResultSize Unlimited) and it ran perfectly.
0
 
LVL 1

Expert Comment

by:ASW3382
ID: 24486344
Sorry to re-open this question, however the solution above doesnt seem to work as resultsize needs to be set to unlimited. Even then no results are displayed.  Is there any way to accomplish this through the GUI?  I find this question all across google searches and wildcards should be usable but arent.  I just want to get all messages in a data range from a specific domain.
0
 

Expert Comment

by:TikiTech
ID: 27275683
It doesn't appear that the GUI can do queries that complex. You'll need to do it from PowerShell and it’s a little inefficient because you have to retrieve all records and filter them so I use a date filter on the first query to cut the number of records before piping it to the domain filter. The first part of the query just goes out and gets a list of all the servers that have the HUB role installed so I don’t have to specify them separately, we have some HUB/CAS duel role servers so the “like” command makes sure to catch them all. I tossed in the select-object line so I could export the contents of the recipients field.
Get-ExchangeServer | where {$_.ServerRole -like "*HubTransport"} | get-messagetrackinglog -Start "2/27/2010 11:20:00 AM" -End "1/19/2011 11:30:00 AM" -resultsize unlimited | where {$_.Sender -like "*@gmail.com"} | select-object Timestamp,SourceContext,Source,EventId,MessageSubject,Sender,{$_.Recipients} | export-csv c:\gmail.csv

Open in new window

0
 
LVL 1

Expert Comment

by:ASW3382
ID: 27275812
Yikes.
It is reasons like this that people are migrating away from exchange. I have found a different way to do it in that I keep all message logs now and I also archive everything to a vendor.  Using a primitive set of tools at my vendor I can accomplish what exchange cannot.
0
 

Expert Comment

by:TikiTech
ID: 27277148
To each his own, command-line access like we get with PowerShell is something that Exchange admins have been wanting for years and finally have. Unless I missed something in your request the PowerShell command clearly shows that Exchange can deliver the information you wanted. PowerShell was a little unnerving at first, even though I’ve administered Exchange for many years I’ve never considered myself a script writer or programmer and I do not consider myself a PowerShell expert in any way. The command I put together above was just combining bits and pieces I found on other sites including the command Akhater posted.
0
 
LVL 1

Expert Comment

by:ASW3382
ID: 27277245
I love the Powershell, I was one of the admins pining away for it :)

Yes your response does appear to give me the results I would want, however as you mentioned it is rather inefficient.  The alternative route of using my smarthost's archiving service is much more efficient even though I have to use a gui.  However, now that I am journaling and keeping the message tracking logs beyond 30 days I can use some nice 3rd party tools that parse the data in seconds.
The reason I requested GUI is I have a user who performs audits and isnt Command line saavy,  the line you gave me could go bad quickly if used improperly :)
Thank you for getting back to me.
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Learn to move / copy / export exchange contacts to iPhone without using any software. Also see the issues in configuration of exchange with iPhone to migrate contacts.
How to resolve IMCEAEX NDRs in Exchange or Exchange Online related to invalid X500 addresses.
In this Micro Video tutorial you will learn the basics about Database Availability Groups and How to configure one using a live Exchange Server Environment. The video tutorial explains the basics of the Exchange server Database Availability grou…
This video discusses moving either the default database or any database to a new volume.

691 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question