?
Solved

"Who sent that email?" search in Exchange 2010

Posted on 2010-11-29
8
Medium Priority
?
1,568 Views
Last Modified: 2012-05-10
I have been asked by my boss to confidentially find out who sent an email to a specific email address.  He has given me the destination email address and the date and approximate time that the message was sent, withing a ½-hour window.

How do I search for that?  We have Exchange 2010.

Thanks,
Jono
0
Comment
Question by:Jono Martin
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
8 Comments
 
LVL 14

Expert Comment

by:athomsfere
ID: 34231492
Was it sent from a group mailbox in your domain?

Do you have a copy of the message, or better yet the original email untouched / moved?
0
 
LVL 26

Accepted Solution

by:
Tony J earned 2000 total points
ID: 34231535
You can do it in the Exchange Management Console from within the tools, message tracking.

Or use the following Exchange Management Shell script:

Get-MessageTrackingLog -server abc -recipients abc@contoso.com -start "01/01/2010 00:01:00" -end "11/11/2010 23:59:00" | fl
0
 

Author Comment

by:Jono Martin
ID: 34233119
Tony1044 - I get the following message in PowerShell when using the suggested command:

"The term 'Get-MessageTrackingLog' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again."

I do have SP1 installed (recently).  Is there something else I need to do to get these commands to work in PowerShell?

Thanks.
0
Efficient way to get backups off site to Azure

This user guide provides instructions on how to deploy and configure both a StoneFly Scale Out NAS Enterprise Cloud Drive virtual machine and Veeam Cloud Connect in the Microsoft Azure Cloud.

 
LVL 26

Expert Comment

by:Tony J
ID: 34233164
You need to run the exchange management shell, not plain old powershell.
0
 

Author Comment

by:Jono Martin
ID: 34234307
OK.  I have run the cmd and I have a couple of questions:
1. What does the "| fl" do?
2. Where can I find the results of this command?

Thanks again!
Jono
0
 

Author Closing Comment

by:Jono Martin
ID: 34234339
Nevermind that last comment.  I see that it shows in the shell itself unless there are no results, which was the case.

Thanks for your help.
Jono
0
 

Author Comment

by:Jono Martin
ID: 34234404
Actually, I'm still interested to know what the pipe command at the end means (" | fl ").

Thanks,
Jono
0
 
LVL 26

Expert Comment

by:Tony J
ID: 34236989
Format List. It gives more detail and can be used to filter with extra commands.
0

Featured Post

On Demand Webinar: Networking for the Cloud Era

Ready to improve network connectivity? Watch this webinar to learn how SD-WANs and a one-click instant connect tool can boost provisions, deployment, and management of your cloud connection.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Lotus Notes – formerly IBM Notes – is an email client application, while IBM Domino (earlier Lotus Domino) is an email server. The client possesses a set of features that are even more advanced as compared to that of Outlook. Likewise, IBM Domino is…
Unified and professional email signatures help maintain a consistent company brand image to the outside world. This article shows how to create an email signature in Exchange Server 2010 using a transport rule and how to overcome native limitations …
This video discusses moving either the default database or any database to a new volume.
Exchange organizations may use the Journaling Agent of the Transport Service to archive messages going through Exchange. However, if the Transport Service is integrated with some email content management application (such as an antispam), the admini…
Suggested Courses

752 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question