Find users who sent emails to one specific domain
This is a quick one. This cmdlet will help you search the message tracking logs on the hub transport server to see who send emails to external email domains.
Set $FormatEnumerationLimit to -1 following this
Edit properties of Powershell window to width = 120 and height = 500
Run the following cmdlet:
Get-MessageTrackingLog -resultsize unlimited |where-object {$_.Recipients -like “*@gmail.com, *@yahoo.com” -AND $_.EventId -eq “Send”} |ft -auto >>C:\External mails.txt
Thanks,
Ratish Nair
MVP Exchange
Team@ MSExchangeGuru
Search Message Tracking Logs, Who sent email to a particular domain, track external emails in exchange
July 27th, 2011 at 8:14 am
Is that anythung availble in e2k3.
April 26th, 2012 at 9:50 pm
Excellent – just tested this and it works very well!, it helps to use the tracking log explorer to generate a EMS command and determine the required parameters and adjust the cmdlet to taste.
April 28th, 2012 at 11:16 pm
Not working in Exchange 2007 with sp1.
October 1st, 2014 at 3:52 pm
Works great in Exchange 2010. But an even better way to export the report is like this:
Get-MessageTrackingLog -resultsize unlimited | where-object {$_.Recipients -like “*@gmail.com, *@yahoo.com” -AND $_.EventId -eq “Send”} | ConvertTo-Csv > “C:\Maillog.csv”
By exporting directly to CSV, it includes even more details, is easier to review the data in Excel, and also eliminates the need to modify the properties of the Powershell window width.
October 6th, 2015 at 8:41 am
not working on Exchange 2010 + SP3.
October 6th, 2015 at 4:16 pm
Run in the Exchange management shell.