Best way to search exchange 2013 to see if users sent email to an external domain

I am trying to search via the shell to see what users in our organization may have sent emails to a certain external domain.
Each time I run the following command: Get-MessageTrackingLog -ResultSize Unlimited -Start "1/1/2017" -End "12/5/2017" | where {$_.Sender -like "*@gmail.com"} | select-object Timestamp, SourceContext, Source, EventId, MessageSubject, Sender, {$_.Recipients} | export-csv C:\Externaldomain.com.txt

 it finds items starting on Nov 13 2017 and goes until today. But for some reason no matter what external domain name I put in, it wont find anything before Nov 13.
Is there somethin I am doing wrong?
LVL 1
vmichAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

RoninCommented:
Your logs might be configured to 30 days only or so.
Check here.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
vmichAuthor Commented:
I don't see where it shows me if we have it set for 30 days or not but if it is set to 30 days, is there no way to get information older than that for users who sent emails to an external domain?
0
vmichAuthor Commented:
So my question is now that if it is 30 days for the logs, is there still anyway we can track if users have sent emails to a particular external domain?
0
Determine the Perfect Price for Your IT Services

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden with our free interactive tool and use it to determine the right price for your IT services. Download your free eBook now!

RoninCommented:
Run Get-TransportService to view the current configuration.
0
vmichAuthor Commented:
I run that and it says that the status is true..
So I guess the setting is 30 days so back to my question then,

So my question is now that if it is 30 days for the logs, is there still anyway we can track if users have sent emails to a particular external domain older than 30 days
0
RoninCommented:
If the logs are configured for 30 days and you don't have ANY other place that keeps SMTP traffic for more than 30 days - the answer is NO.
However, validate what's the setting for the logs.
Execute:
Get-TransportService ExchangeServer[ | fl

Open in new window

to view the existing setting.
Replace ExchangeServer with the name of your Exchange server.
0
mbkitmgrCommented:
for logs older than 30 days, go to your backups.

Restore the Message Tracking logs to a different location and load them into Excel.  Its a little cumbesome but will get you the answer you need
0
vmichAuthor Commented:
logs set for 30 days
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Exchange

From novice to tech pro — start learning today.