Solved

MS Exchange 2007 Message Tracking Powershell

Posted on 2009-05-18
9
4,657 Views
Last Modified: 2012-05-07
Experts,

Im not sure if this can be done.

Is there a way to find out all users which send email to a specific domain using message tracking in exchange 2007 using like a wild card * and displaying the email address which sent it and received it ?

Scenario:

user@mycompany.com sends email to user@abc.com I don't know which user sent it or to who it got sent to. The only info i have is it was sent to someone @abc.com domain.

PowerShell Example -

get-messagetrackinglog -Recipients:*@abc.com -Server "MyServer" -Start "1/05/2009 12:13:00 PM" -End "19/05/2009 12:33:00 PM"

Regards,

WizardWill
0
Comment
Question by:WizardWill
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
  • 2
  • +1
9 Comments
 
LVL 49

Accepted Solution

by:
Akhater earned 500 total points
ID: 24419133
I think this is what you are looking for

get-messagetrackinglog -Server "MyServer" -Start "5/18/2009 9:34:00 AM" -End "5/19/2009 9:44:00 AM" | where {$_.Recipients -like "*@domain.com"}

Open in new window

0
 
LVL 6

Author Comment

by:WizardWill
ID: 24428004
is there away to filter the recipients address by domain using wild card ? eg. *@abc.com and get back a list of addresses which have sent emails to this domain
0
 
LVL 49

Expert Comment

by:Akhater
ID: 24429008
Did you try the command I gave you ?

If I understood correctly it is exactly what it does
0
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 6

Author Closing Comment

by:WizardWill
ID: 31582861
Thanks very much that worked great. I just had to put in the  (-ResultSize Unlimited) and it ran perfectly.
0
 
LVL 1

Expert Comment

by:ASW3382
ID: 24486344
Sorry to re-open this question, however the solution above doesnt seem to work as resultsize needs to be set to unlimited. Even then no results are displayed.  Is there any way to accomplish this through the GUI?  I find this question all across google searches and wildcards should be usable but arent.  I just want to get all messages in a data range from a specific domain.
0
 

Expert Comment

by:TikiTech
ID: 27275683
It doesn't appear that the GUI can do queries that complex. You'll need to do it from PowerShell and it’s a little inefficient because you have to retrieve all records and filter them so I use a date filter on the first query to cut the number of records before piping it to the domain filter. The first part of the query just goes out and gets a list of all the servers that have the HUB role installed so I don’t have to specify them separately, we have some HUB/CAS duel role servers so the “like” command makes sure to catch them all. I tossed in the select-object line so I could export the contents of the recipients field.
Get-ExchangeServer | where {$_.ServerRole -like "*HubTransport"} | get-messagetrackinglog -Start "2/27/2010 11:20:00 AM" -End "1/19/2011 11:30:00 AM" -resultsize unlimited | where {$_.Sender -like "*@gmail.com"} | select-object Timestamp,SourceContext,Source,EventId,MessageSubject,Sender,{$_.Recipients} | export-csv c:\gmail.csv

Open in new window

0
 
LVL 1

Expert Comment

by:ASW3382
ID: 27275812
Yikes.
It is reasons like this that people are migrating away from exchange. I have found a different way to do it in that I keep all message logs now and I also archive everything to a vendor.  Using a primitive set of tools at my vendor I can accomplish what exchange cannot.
0
 

Expert Comment

by:TikiTech
ID: 27277148
To each his own, command-line access like we get with PowerShell is something that Exchange admins have been wanting for years and finally have. Unless I missed something in your request the PowerShell command clearly shows that Exchange can deliver the information you wanted. PowerShell was a little unnerving at first, even though I’ve administered Exchange for many years I’ve never considered myself a script writer or programmer and I do not consider myself a PowerShell expert in any way. The command I put together above was just combining bits and pieces I found on other sites including the command Akhater posted.
0
 
LVL 1

Expert Comment

by:ASW3382
ID: 27277245
I love the Powershell, I was one of the admins pining away for it :)

Yes your response does appear to give me the results I would want, however as you mentioned it is rather inefficient.  The alternative route of using my smarthost's archiving service is much more efficient even though I have to use a gui.  However, now that I am journaling and keeping the message tracking logs beyond 30 days I can use some nice 3rd party tools that parse the data in seconds.
The reason I requested GUI is I have a user who performs audits and isnt Command line saavy,  the line you gave me could go bad quickly if used improperly :)
Thank you for getting back to me.
0

Featured Post

Office 365 Training for Admins - 7 Day Trial

Learn how to provision tenants, synchronize on-premise Active Directory, implement Single Sign-On, customize Office deployment, and protect your organization with eDiscovery and DLP policies.  Only from Platform Scholar.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article explains in simple steps how to renew expiring Exchange Server Internal Transport Certificate.
Scam emails are a huge burden for many businesses. Spotting one is not always easy. Follow our tips to identify if an email you receive is a scam.
This video demonstrates how to sync Microsoft Exchange Public Folders with smartphones using CodeTwo Exchange Sync and Exchange ActiveSync. To learn more about CodeTwo Exchange Sync and download the free trial, go to: http://www.codetwo.com/excha…
This video shows how to quickly and easily add an email signature for all users on Exchange 2016. The resulting signature is applied on a server level by Exchange Online. The email signature template has been downloaded from: www.mail-signatures…

734 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question