Link to home
Start Free TrialLog in
Avatar of vmich
vmichFlag for United States of America

asked on

Way to find out who in the organization has sent emails to a particlular external email address

We are running exchange 2016 and we need a way to search our entire email system, which has over 3500 users, to see who in the company has sent emails to external email address.
Which is the best way to accomplish this within exchange 2016?
Not sure if I can do it via the ECP or does it have to be run via powershell?
Thanks
Avatar of Amit
Amit
Flag of India image

Use powershell command. Make sure you have tracking logs available. Refer:
https://practical365.com/exchange-server/searching-message-tracking-logs-by-sender-or-recipient-email-address/
Get-MessageTrace -RecipientAddress <user’s address> -StartDate 11/07/2017 -EndDate 11/14/2017

Get-MessageTrace -RecipientAddress <user’s address> -StartDate 11/07/2017 -EndDate 11/14/2017 | Format-list -Property Received,SenderAddress,Status,MessageTraceId

You will get a list of all send emails and then you can find out.
You'll have to use message tracking.

Get-MessageTrackingLog | Where-Object {$_.recipients -like "Emailaddressinhere"}

Open in new window



that may work, you may need to stipulate a time frame.
Get-MessageTrace -RecipientAddress <user’s address> -StartDate 11/07/2017 -EndDate 11/14/2017

Get-MessageTrace -RecipientAddress <user’s address> -StartDate 11/07/2017 -EndDate 11/14/2017 | Format-list -Property Received,SenderAddress,Status,MessageTraceId

Won't work, cloud based only, he's on 2016 and thus going to be on prem.


Regards

Alex
Avatar of vmich

ASKER

So I see a couple different ways here. Which one is the best way?
Saif will yours work for exch 2016 onprem and if so, will it check all of our users emails, which we have over 3500
Avatar of vmich

ASKER

Alex,
How would I add a date range to your suggestion with the Get-MessageTrackingLog
Get-MessageTrackingLog -start "03/13/2018 09:00:00" -End "11/20/2019 17:00:00"| Where-Object {$_.recipients -like "Emailaddressinhere"}
Avatar of vmich

ASKER

Alex how do I add the unlimited results size to this because as I mentioned we have over 3500 email accounts to search
Avatar of vmich

ASKER

I think I got it.
I added the -Resultsize unlimited
Correct,

Sorry was grabbing a drink, that'll give you all the results rather than limiting it to 2000 I think it is.

Regards
Alex
Avatar of vmich

ASKER

Also I can dump this to a CSV file correct by adding the  >d:\export.csv
I wouldn't bother


Get-MessageTrackingLog -start "03/13/2018 09:00:00" -End "11/20/2019 17:00:00"| Where-Object {$_.recipients -like "Emailaddressinhere"} | Export-csv c:\temp\results.csv

that should do it, if it gives you crap out, I'll need to drop it into a report instead.

Regards
Alex
Avatar of vmich

ASKER

Ok dumber question.
The command completed but where does it put the info to look at to see who if anyone ahs sent an email to the external email address
Even dumber question, you did change

Get-MessageTrackingLog -start "03/13/2018 09:00:00" -End "11/20/2019 17:00:00"| Where-Object {$_.recipients -like "Emailaddressinhere"} | Export-csv c:\temp\results.csv

the in bold bit to your external mail as well as changing your time frames right?
Get-MessageTrackingLog -start "03/13/2018 09:00:00" -End "11/20/2019 17:00:00"| Where-Object {$_.recipients -eq "Emailaddressinhere"} | Export-csv c:\temp\results.csv

Open in new window


Change the -like to a -eq as well.
Get-MessageTrackingLog -start "03/13/2018 09:00:00" -End "11/20/2019 17:00:00" -recipients "emailinhere" | Export-csv c:\temp\results.csv

Open in new window



Another slightly different method, this way you don't need to do there where-object since it's not a wildcard parameter.
Avatar of vmich

ASKER

Yes I did make all of those changes.
Thanks I will run the command now with the CSV and let you know
Avatar of vmich

ASKER

Ok so I ran the command and it seemed to run just fine. But the CSV file had no data in it. So if I did the command correct, that means that none of our users have sent an email tot he external address that I put into the command and ran correct?
This is what I put into the command:

Get-MessageTrackingLog -Resultsize unlimited -start "01/01/2019 09:00:00" -End "11/14/2019 17:00:00" -recipients "abdcef@468.com" | Export-csv c:\temp\results.csv

This should search all of our over 3500 users to see if they sent email to   abdcef@468.com  correct?
Correct,

I'd say do this, do an email to your personal account, then put your own email address in and see if it returns it, if it does my code is sound and no one emailed that address. If it doesn't, then there is another issue and I think that could be down to your exchange logging.

regards
Alex
Avatar of vmich

ASKER

Ok I tired that with my own email and when I make the changes in the command and run it, it did not find my email...
run it without the export and see if you get the message back then.
Avatar of vmich

ASKER

Ok will do that now but I ran Get-TransportServer and it shows all the exchange servers have message tracking log enabled
Avatar of vmich

ASKER

when I run it without the export, it sits there for a couple of seconds and then drops back to the C prompt and does not show anything
ASKER CERTIFIED SOLUTION
Avatar of Alex
Alex
Flag of United Kingdom of Great Britain and Northern Ireland image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of vmich

ASKER

Alex,
Thanks for all your help with this. I got this command to work and I should be good to go..
get-MessageTrackingLog -Resultsize unlimited -Start "01/01/2019 09:00:00" -End "11/14/2019 17:00:00" | Where-Object {$_.recipients -like "*@gmail.com"} |export-csv d:\temp\results.csv
Thanks again for your help