Solved

MS Exchange 2007 Message Tracking Powershell

Posted on 2009-05-18
9
4,613 Views
Last Modified: 2012-05-07
Experts,

Im not sure if this can be done.

Is there a way to find out all users which send email to a specific domain using message tracking in exchange 2007 using like a wild card * and displaying the email address which sent it and received it ?

Scenario:

user@mycompany.com sends email to user@abc.com I don't know which user sent it or to who it got sent to. The only info i have is it was sent to someone @abc.com domain.

PowerShell Example -

get-messagetrackinglog -Recipients:*@abc.com -Server "MyServer" -Start "1/05/2009 12:13:00 PM" -End "19/05/2009 12:33:00 PM"

Regards,

WizardWill
0
Comment
Question by:WizardWill
  • 3
  • 2
  • 2
  • +1
9 Comments
 
LVL 49

Accepted Solution

by:
Akhater earned 500 total points
ID: 24419133
I think this is what you are looking for

get-messagetrackinglog -Server "MyServer" -Start "5/18/2009 9:34:00 AM" -End "5/19/2009 9:44:00 AM" | where {$_.Recipients -like "*@domain.com"}

Open in new window

0
 
LVL 6

Author Comment

by:WizardWill
ID: 24428004
is there away to filter the recipients address by domain using wild card ? eg. *@abc.com and get back a list of addresses which have sent emails to this domain
0
 
LVL 49

Expert Comment

by:Akhater
ID: 24429008
Did you try the command I gave you ?

If I understood correctly it is exactly what it does
0
 
LVL 6

Author Closing Comment

by:WizardWill
ID: 31582861
Thanks very much that worked great. I just had to put in the  (-ResultSize Unlimited) and it ran perfectly.
0
Too many email signature updates to deal with?

Do you feel like you are taking up all of your time constantly visiting users’ desks to make changes to email signatures? Wish you could manage all signatures from one central location, easily design them and deploy them quickly to users? Well, there is an easy way!

 
LVL 1

Expert Comment

by:ASW3382
ID: 24486344
Sorry to re-open this question, however the solution above doesnt seem to work as resultsize needs to be set to unlimited. Even then no results are displayed.  Is there any way to accomplish this through the GUI?  I find this question all across google searches and wildcards should be usable but arent.  I just want to get all messages in a data range from a specific domain.
0
 

Expert Comment

by:TikiTech
ID: 27275683
It doesn't appear that the GUI can do queries that complex. You'll need to do it from PowerShell and it’s a little inefficient because you have to retrieve all records and filter them so I use a date filter on the first query to cut the number of records before piping it to the domain filter. The first part of the query just goes out and gets a list of all the servers that have the HUB role installed so I don’t have to specify them separately, we have some HUB/CAS duel role servers so the “like” command makes sure to catch them all. I tossed in the select-object line so I could export the contents of the recipients field.
Get-ExchangeServer | where {$_.ServerRole -like "*HubTransport"} | get-messagetrackinglog -Start "2/27/2010 11:20:00 AM" -End "1/19/2011 11:30:00 AM" -resultsize unlimited | where {$_.Sender -like "*@gmail.com"} | select-object Timestamp,SourceContext,Source,EventId,MessageSubject,Sender,{$_.Recipients} | export-csv c:\gmail.csv

Open in new window

0
 
LVL 1

Expert Comment

by:ASW3382
ID: 27275812
Yikes.
It is reasons like this that people are migrating away from exchange. I have found a different way to do it in that I keep all message logs now and I also archive everything to a vendor.  Using a primitive set of tools at my vendor I can accomplish what exchange cannot.
0
 

Expert Comment

by:TikiTech
ID: 27277148
To each his own, command-line access like we get with PowerShell is something that Exchange admins have been wanting for years and finally have. Unless I missed something in your request the PowerShell command clearly shows that Exchange can deliver the information you wanted. PowerShell was a little unnerving at first, even though I’ve administered Exchange for many years I’ve never considered myself a script writer or programmer and I do not consider myself a PowerShell expert in any way. The command I put together above was just combining bits and pieces I found on other sites including the command Akhater posted.
0
 
LVL 1

Expert Comment

by:ASW3382
ID: 27277245
I love the Powershell, I was one of the admins pining away for it :)

Yes your response does appear to give me the results I would want, however as you mentioned it is rather inefficient.  The alternative route of using my smarthost's archiving service is much more efficient even though I have to use a gui.  However, now that I am journaling and keeping the message tracking logs beyond 30 days I can use some nice 3rd party tools that parse the data in seconds.
The reason I requested GUI is I have a user who performs audits and isnt Command line saavy,  the line you gave me could go bad quickly if used improperly :)
Thank you for getting back to me.
0

Featured Post

Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

Join & Write a Comment

Easy CSR creation in Exchange 2007,2010 and 2013
Not sure what the best email signature size is? Are you worried about email signature image size? Follow this best practice guide.
In this video we show how to create an email address policy in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.:  First we need to log into the Exchange Admin Center. Navigate to the Mail Flow…
This video discusses moving either the default database or any database to a new volume.

707 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now