Solved

MS Exchange 2007 Message Tracking Powershell

Posted on 2009-05-18
9
4,646 Views
Last Modified: 2012-05-07
Experts,

Im not sure if this can be done.

Is there a way to find out all users which send email to a specific domain using message tracking in exchange 2007 using like a wild card * and displaying the email address which sent it and received it ?

Scenario:

user@mycompany.com sends email to user@abc.com I don't know which user sent it or to who it got sent to. The only info i have is it was sent to someone @abc.com domain.

PowerShell Example -

get-messagetrackinglog -Recipients:*@abc.com -Server "MyServer" -Start "1/05/2009 12:13:00 PM" -End "19/05/2009 12:33:00 PM"

Regards,

WizardWill
0
Comment
Question by:WizardWill
  • 3
  • 2
  • 2
  • +1
9 Comments
 
LVL 49

Accepted Solution

by:
Akhater earned 500 total points
ID: 24419133
I think this is what you are looking for

get-messagetrackinglog -Server "MyServer" -Start "5/18/2009 9:34:00 AM" -End "5/19/2009 9:44:00 AM" | where {$_.Recipients -like "*@domain.com"}

Open in new window

0
 
LVL 6

Author Comment

by:WizardWill
ID: 24428004
is there away to filter the recipients address by domain using wild card ? eg. *@abc.com and get back a list of addresses which have sent emails to this domain
0
 
LVL 49

Expert Comment

by:Akhater
ID: 24429008
Did you try the command I gave you ?

If I understood correctly it is exactly what it does
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 
LVL 6

Author Closing Comment

by:WizardWill
ID: 31582861
Thanks very much that worked great. I just had to put in the  (-ResultSize Unlimited) and it ran perfectly.
0
 
LVL 1

Expert Comment

by:ASW3382
ID: 24486344
Sorry to re-open this question, however the solution above doesnt seem to work as resultsize needs to be set to unlimited. Even then no results are displayed.  Is there any way to accomplish this through the GUI?  I find this question all across google searches and wildcards should be usable but arent.  I just want to get all messages in a data range from a specific domain.
0
 

Expert Comment

by:TikiTech
ID: 27275683
It doesn't appear that the GUI can do queries that complex. You'll need to do it from PowerShell and it’s a little inefficient because you have to retrieve all records and filter them so I use a date filter on the first query to cut the number of records before piping it to the domain filter. The first part of the query just goes out and gets a list of all the servers that have the HUB role installed so I don’t have to specify them separately, we have some HUB/CAS duel role servers so the “like” command makes sure to catch them all. I tossed in the select-object line so I could export the contents of the recipients field.
Get-ExchangeServer | where {$_.ServerRole -like "*HubTransport"} | get-messagetrackinglog -Start "2/27/2010 11:20:00 AM" -End "1/19/2011 11:30:00 AM" -resultsize unlimited | where {$_.Sender -like "*@gmail.com"} | select-object Timestamp,SourceContext,Source,EventId,MessageSubject,Sender,{$_.Recipients} | export-csv c:\gmail.csv

Open in new window

0
 
LVL 1

Expert Comment

by:ASW3382
ID: 27275812
Yikes.
It is reasons like this that people are migrating away from exchange. I have found a different way to do it in that I keep all message logs now and I also archive everything to a vendor.  Using a primitive set of tools at my vendor I can accomplish what exchange cannot.
0
 

Expert Comment

by:TikiTech
ID: 27277148
To each his own, command-line access like we get with PowerShell is something that Exchange admins have been wanting for years and finally have. Unless I missed something in your request the PowerShell command clearly shows that Exchange can deliver the information you wanted. PowerShell was a little unnerving at first, even though I’ve administered Exchange for many years I’ve never considered myself a script writer or programmer and I do not consider myself a PowerShell expert in any way. The command I put together above was just combining bits and pieces I found on other sites including the command Akhater posted.
0
 
LVL 1

Expert Comment

by:ASW3382
ID: 27277245
I love the Powershell, I was one of the admins pining away for it :)

Yes your response does appear to give me the results I would want, however as you mentioned it is rather inefficient.  The alternative route of using my smarthost's archiving service is much more efficient even though I have to use a gui.  However, now that I am journaling and keeping the message tracking logs beyond 30 days I can use some nice 3rd party tools that parse the data in seconds.
The reason I requested GUI is I have a user who performs audits and isnt Command line saavy,  the line you gave me could go bad quickly if used improperly :)
Thank you for getting back to me.
0

Featured Post

NAS Cloud Backup Strategies

This article explains backup scenarios when using network storage. We review the so-called “3-2-1 strategy” and summarize the methods you can use to send NAS data to the cloud

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Lotus Notes – formerly IBM Notes – is an email client application, while IBM Domino (earlier Lotus Domino) is an email server. The client possesses a set of features that are even more advanced as compared to that of Outlook. Likewise, IBM Domino is…
Read this checklist to learn more about the 15 things you should never include in an email signature.
In this video we show how to create an email address policy in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.:  First we need to log into the Exchange Admin Center. Navigate to the Mail Flow…
The video tutorial explains the basics of the Exchange server Database Availability groups. The components of this video include: 1. Automatic Failover 2. Failover Clustering 3. Active Manager

840 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question