Way to find out who in the organization has sent emails to a particlular external email address

vmich
vmich used Ask the Experts™
on
We are running exchange 2016 and we need a way to search our entire email system, which has over 3500 users, to see who in the company has sent emails to external email address.
Which is the best way to accomplish this within exchange 2016?
Not sure if I can do it via the ECP or does it have to be run via powershell?
Thanks
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
AmitIT Architect
Distinguished Expert 2017

Commented:
Use powershell command. Make sure you have tracking logs available. Refer:
https://practical365.com/exchange-server/searching-message-tracking-logs-by-sender-or-recipient-email-address/
Saif ShaikhServer engineer

Commented:
Get-MessageTrace -RecipientAddress <user’s address> -StartDate 11/07/2017 -EndDate 11/14/2017

Get-MessageTrace -RecipientAddress <user’s address> -StartDate 11/07/2017 -EndDate 11/14/2017 | Format-list -Property Received,SenderAddress,Status,MessageTraceId

You will get a list of all send emails and then you can find out.
AlexA lack of information provides a lack of a decent solution.

Commented:
You'll have to use message tracking.

Get-MessageTrackingLog | Where-Object {$_.recipients -like "Emailaddressinhere"}

Open in new window



that may work, you may need to stipulate a time frame.
Success in ‘20 With a Profitable Pricing Strategy

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden using our free interactive tool and use it to determine the right price for your IT services. Start calculating Now!

AlexA lack of information provides a lack of a decent solution.

Commented:
Get-MessageTrace -RecipientAddress <user’s address> -StartDate 11/07/2017 -EndDate 11/14/2017

Get-MessageTrace -RecipientAddress <user’s address> -StartDate 11/07/2017 -EndDate 11/14/2017 | Format-list -Property Received,SenderAddress,Status,MessageTraceId

Won't work, cloud based only, he's on 2016 and thus going to be on prem.


Regards

Alex

Author

Commented:
So I see a couple different ways here. Which one is the best way?
Saif will yours work for exch 2016 onprem and if so, will it check all of our users emails, which we have over 3500

Author

Commented:
Alex,
How would I add a date range to your suggestion with the Get-MessageTrackingLog
AlexA lack of information provides a lack of a decent solution.

Commented:
Get-MessageTrackingLog -start "03/13/2018 09:00:00" -End "11/20/2019 17:00:00"| Where-Object {$_.recipients -like "Emailaddressinhere"}

Author

Commented:
Alex how do I add the unlimited results size to this because as I mentioned we have over 3500 email accounts to search

Author

Commented:
I think I got it.
I added the -Resultsize unlimited
AlexA lack of information provides a lack of a decent solution.

Commented:
Correct,

Sorry was grabbing a drink, that'll give you all the results rather than limiting it to 2000 I think it is.

Regards
Alex

Author

Commented:
Also I can dump this to a CSV file correct by adding the  >d:\export.csv
AlexA lack of information provides a lack of a decent solution.

Commented:
I wouldn't bother


Get-MessageTrackingLog -start "03/13/2018 09:00:00" -End "11/20/2019 17:00:00"| Where-Object {$_.recipients -like "Emailaddressinhere"} | Export-csv c:\temp\results.csv

that should do it, if it gives you crap out, I'll need to drop it into a report instead.

Regards
Alex

Author

Commented:
Ok dumber question.
The command completed but where does it put the info to look at to see who if anyone ahs sent an email to the external email address
AlexA lack of information provides a lack of a decent solution.

Commented:
Even dumber question, you did change

Get-MessageTrackingLog -start "03/13/2018 09:00:00" -End "11/20/2019 17:00:00"| Where-Object {$_.recipients -like "Emailaddressinhere"} | Export-csv c:\temp\results.csv

the in bold bit to your external mail as well as changing your time frames right?
AlexA lack of information provides a lack of a decent solution.

Commented:
Get-MessageTrackingLog -start "03/13/2018 09:00:00" -End "11/20/2019 17:00:00"| Where-Object {$_.recipients -eq "Emailaddressinhere"} | Export-csv c:\temp\results.csv

Open in new window


Change the -like to a -eq as well.
AlexA lack of information provides a lack of a decent solution.

Commented:
Get-MessageTrackingLog -start "03/13/2018 09:00:00" -End "11/20/2019 17:00:00" -recipients "emailinhere" | Export-csv c:\temp\results.csv

Open in new window



Another slightly different method, this way you don't need to do there where-object since it's not a wildcard parameter.

Author

Commented:
Yes I did make all of those changes.
Thanks I will run the command now with the CSV and let you know

Author

Commented:
Ok so I ran the command and it seemed to run just fine. But the CSV file had no data in it. So if I did the command correct, that means that none of our users have sent an email tot he external address that I put into the command and ran correct?
This is what I put into the command:

Get-MessageTrackingLog -Resultsize unlimited -start "01/01/2019 09:00:00" -End "11/14/2019 17:00:00" -recipients "abdcef@468.com" | Export-csv c:\temp\results.csv

This should search all of our over 3500 users to see if they sent email to   abdcef@468.com  correct?
AlexA lack of information provides a lack of a decent solution.

Commented:
Correct,

I'd say do this, do an email to your personal account, then put your own email address in and see if it returns it, if it does my code is sound and no one emailed that address. If it doesn't, then there is another issue and I think that could be down to your exchange logging.

regards
Alex

Author

Commented:
Ok I tired that with my own email and when I make the changes in the command and run it, it did not find my email...
AlexA lack of information provides a lack of a decent solution.

Commented:
run it without the export and see if you get the message back then.

Author

Commented:
Ok will do that now but I ran Get-TransportServer and it shows all the exchange servers have message tracking log enabled

Author

Commented:
when I run it without the export, it sits there for a couple of seconds and then drops back to the C prompt and does not show anything
A lack of information provides a lack of a decent solution.
Commented:
Right

get-MessageTrackingLog -Start (Get-Date).AddHours(-1) | Where-Object {$_.recipients -like "*@gmail.com"}

Open in new window

That works on my exchange, if this doesn't work on yours I have no idea.

Author

Commented:
Alex,
Thanks for all your help with this. I got this command to work and I should be good to go..
get-MessageTrackingLog -Resultsize unlimited -Start "01/01/2019 09:00:00" -End "11/14/2019 17:00:00" | Where-Object {$_.recipients -like "*@gmail.com"} |export-csv d:\temp\results.csv
Thanks again for your help

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial