Way to find out who in the organization has sent emails to a particlular external email address

Use powershell command. Make sure you have tracking logs available. Refer:
https://practical365.com/exchange-server/searching-message-tracking-logs-by-sender-or-recipient-email-address/

Get-MessageTrace -RecipientAddress <user’s address> -StartDate 11/07/2017 -EndDate 11/14/2017

Get-MessageTrace -RecipientAddress <user’s address> -StartDate 11/07/2017 -EndDate 11/14/2017 | Format-list -Property Received,SenderAddress,Status,MessageTraceId

You will get a list of all send emails and then you can find out.

You'll have to use message tracking.

Get-MessageTrackingLog | Where-Object {$_.recipients -like "Emailaddressinhere"}

Select allOpen in new window

that may work, you may need to stipulate a time frame.

Get-MessageTrace -RecipientAddress <user’s address> -StartDate 11/07/2017 -EndDate 11/14/2017

Get-MessageTrace -RecipientAddress <user’s address> -StartDate 11/07/2017 -EndDate 11/14/2017 | Format-list -Property Received,SenderAddress,Status,MessageTraceId

Won't work, cloud based only, he's on 2016 and thus going to be on prem.


Regards

Alex

So I see a couple different ways here. Which one is the best way?
Saif will yours work for exch 2016 onprem and if so, will it check all of our users emails, which we have over 3500

Alex,
How would I add a date range to your suggestion with the Get-MessageTrackingLog

Get-MessageTrackingLog -start "03/13/2018 09:00:00" -End "11/20/2019 17:00:00"| Where-Object {$_.recipients -like "Emailaddressinhere"}

Alex how do I add the unlimited results size to this because as I mentioned we have over 3500 email accounts to search

I think I got it.
I added the -Resultsize unlimited

Correct,

Sorry was grabbing a drink, that'll give you all the results rather than limiting it to 2000 I think it is.

Regards
Alex

Also I can dump this to a CSV file correct by adding the  >d:\export.csv

I wouldn't bother


Get-MessageTrackingLog -start "03/13/2018 09:00:00" -End "11/20/2019 17:00:00"| Where-Object {$_.recipients -like "Emailaddressinhere"} | Export-csv c:\temp\results.csv

that should do it, if it gives you crap out, I'll need to drop it into a report instead.

Regards
Alex

Ok dumber question.
The command completed but where does it put the info to look at to see who if anyone ahs sent an email to the external email address

Even dumber question, you did change

Get-MessageTrackingLog -start "03/13/2018 09:00:00" -End "11/20/2019 17:00:00"| Where-Object {$_.recipients -like "Emailaddressinhere"} | Export-csv c:\temp\results.csv

the in bold bit to your external mail as well as changing your time frames right?

Get-MessageTrackingLog -start "03/13/2018 09:00:00" -End "11/20/2019 17:00:00"| Where-Object {$_.recipients -eq "Emailaddressinhere"} | Export-csv c:\temp\results.csv

Select allOpen in new window

Change the -like to a -eq as well.

Get-MessageTrackingLog -start "03/13/2018 09:00:00" -End "11/20/2019 17:00:00" -recipients "emailinhere" | Export-csv c:\temp\results.csv

Select allOpen in new window

Another slightly different method, this way you don't need to do there where-object since it's not a wildcard parameter.

Yes I did make all of those changes.
Thanks I will run the command now with the CSV and let you know

Ok so I ran the command and it seemed to run just fine. But the CSV file had no data in it. So if I did the command correct, that means that none of our users have sent an email tot he external address that I put into the command and ran correct?
This is what I put into the command:

Get-MessageTrackingLog -Resultsize unlimited -start "01/01/2019 09:00:00" -End "11/14/2019 17:00:00" -recipients "abdcef@468.com" | Export-csv c:\temp\results.csv

This should search all of our over 3500 users to see if they sent email to   abdcef@468.com  correct?

Correct,

I'd say do this, do an email to your personal account, then put your own email address in and see if it returns it, if it does my code is sound and no one emailed that address. If it doesn't, then there is another issue and I think that could be down to your exchange logging.

regards
Alex

Ok I tired that with my own email and when I make the changes in the command and run it, it did not find my email...

run it without the export and see if you get the message back then.

Ok will do that now but I ran Get-TransportServer and it shows all the exchange servers have message tracking log enabled

when I run it without the export, it sits there for a couple of seconds and then drops back to the C prompt and does not show anything

Alex,
Thanks for all your help with this. I got this command to work and I should be good to go..
get-MessageTrackingLog -Resultsize unlimited -Start "01/01/2019 09:00:00" -End "11/14/2019 17:00:00" | Where-Object {$_.recipients -like "*@gmail.com"} |export-csv d:\temp\results.csv
Thanks again for your help