Powershell cmdlet to track emails send to one specific email id/mailbox/DL
This is not a new cmdlet but I customized it a bit so that we get some “presentable” output
Scenario:
We need to track all emails send to a mailbox/mail enabled DL with the name – team@msexchangeguru.com
Condition 1 – Get all failed/undeliverable emails: Get-Messagetrackinglog -Recipients: team@msexchangeguru.com -EventID "FAIL" -Start "5/4/2011 9:00:00 AM" -End "5/10/2011 5:00:00 PM" |ft Timestamp, Source, Sender, Recipients, MessageSubject >>C:output.txt
Condition 2 – Get all success emails Get-Messagetrackinglog -Recipients: team@msexchangeguru.com -EventID "RECEIVE" -Start "5/4/2011 9:00:00 AM" -End "5/10/2011 5:00:00 PM" |ft Timestamp, Source, Sender, Recipients, MessageSubject >>C:output.txt
This will give you the output in the form:
| Timestamp | Source | Sender | Recipients | MessageSubject |
Source “SMTP” means it’s an external email and “STOREDRIVER” means processed internally
Again remember to edit the properties of the powershell window to make it 400×300.
Ratish Nair
MVP Exchange
Team@ MSExchangeGuru.com
May 20th, 2011 at 4:53 pm
You are a life saver my friend. Great script…
February 6th, 2014 at 2:12 pm
not working for me, did i miss something??
PS C:\Windows\system32> Get-Messagetrackinglog -Recipients: User.name@mydomainname.com -EventID “RECEIVE” -Start ” 2/1/2014 9:00:00 AM” -End ” 2/05/2014
5:00:00 PM” |ft Timestamp, Source, Sender, Recipients, MessageSubject >>C:\output.txt
March 29th, 2014 at 1:41 pm
that was very useful.Thanks.
September 2nd, 2014 at 1:42 am
Mike you need to run this from hub server the it will get the results from that specific server.
if you have multiple servers try below..
Get-TransportServer |Get-Messagetrackinglog -Recipients: User.name@mydomainname.com -EventID “RECEIVE” -Start ” 2/1/2014 9:00:00 AM” -End ” 2/05/2014 5:00:00 PM” |ft Timestamp, Source, Sender, Recipients, MessageSubject >>C:output.txt
February 24th, 2015 at 6:35 am
I got a few errors with this, so Ive changed it somewhat:
Get-Messagetrackinglog -Recipients: user@mydomain.com -EventID “RECEIVE” -Start (get-date).AddDays(-1) -End (get-date)| ft Timestamp, Source, Sender, Recipients, MessageSubject >>C:\Script\output.txt
By changing to (get-date).AddDays(-1) I avoid having to do any string conversions. The (-1) is easily changeable – changing to (-7) will give all messages for the past 7 days.
I also had a permissions error, with the original script trying to write to the root of C:, so I created a new folder and changed the output file accordingly.
Thanks for sharing an otherwise great script!
March 12th, 2015 at 12:39 pm
Can we use same script to see sent mail.
March 12th, 2015 at 12:58 pm
Take a look at the cmdlets in this article:
https://msexchangeguru.com/2015/03/10/message-tracking/
April 21st, 2016 at 3:40 pm
You can cheat and do this through the EMC in the exchange toolbox, under message tracking. It produces similar powershell code at the bottom for you. You could also pipe this through a csv instead of a txt file using ” | export-csv C:\filename.csv”. Its a little bit easier to manage.