A while ago, I needed to find the recipients of a message sent out to a distribution list. Simple enough task until you realize that the Distribution list recipients may have been compromised at the time the message was sent to it.
An accurate way of getting a list of exactly who was sent the message at the time is to run a cmdlet which will export all of the recipients that received the message to a csv file.
If you do not have EDGE servers just remove: |? {-NOT $_.Name.Contains("EDGE")}
All other input (sender, subject and time, file location), you will have to change for your own message tracking are in red.
Get-transportserver | ? {-NOT $_.Name.Contains("EDGE")} | Get-MessageTrackinglog -ResultSize unlimited -Sender user@domain.com -MessageSubject "SUBJECT" -Start "MM/DD/YYYY HH:MMPM" | Select Sender, @ {N="Recipients";E={$_.Recipients}}, MessageSubject, MessageID, RecipientCount, RelatedRecipientAddress, Client*, Server*,EventID,Time* | Export-CSV -Encoding "ASCII" C:\users\<username>\desktop\new_MSG-TrackingResult.csv -Notype
An accurate way of getting a list of exactly who was sent the message at the time is to run a cmdlet which will export all of the recipients that received the message to a csv file.
If you do not have EDGE servers just remove: |? {-NOT $_.Name.Contains("EDGE")}
All other input (sender, subject and time, file location), you will have to change for your own message tracking are in red.
Get-transportserver | ? {-NOT $_.Name.Contains("EDGE")} | Get-MessageTrackinglog -ResultSize unlimited -Sender user@domain.com -MessageSubject "SUBJECT" -Start "MM/DD/YYYY HH:MMPM" | Select Sender, @ {N="Recipients";E={$_.Recipients}}, MessageSubject, MessageID, RecipientCount, RelatedRecipientAddress, Client*, Server*,EventID,Time* | Export-CSV -Encoding "ASCII" C:\users\<username>\desktop\new_MSG-TrackingResult.csv -Notype
Interesting. Sounds complicated but Im glad you were able to figure it out.
ReplyDelete-Jackie @ eDiscovery
Thanks very much Jackie, 1 powershell script saved a lot of time and hardship.
ReplyDelete