Exchange Message Tracking Logs

[Jawloms]

I'm trying to search my on-site Exchange server for all emails received by any mailbox here from a particular external domain within the last week. I can find lots of examples of my mailboxes sending to a particular external domain, but none the other way around, and plenty which rely on a particular sender or recipient. I'm after a wildcard on the domain. Can anyone help please?

 

Thank you

 

Stuart

[djm968]

Quite easy to do with Powershell

 

Get-TransportServer |

Get-MessageTrackingLog -ResultSize Unlimited -Start “09-11-2020” -End “13-11-2020” |

where {$_.recipients -like "*domain1.com*"} |

select sender, {$_.Recipients}, timestamp |

export-csv -delimiter "," -path C:\andcombined.csv -notype

Edited November 19, 2020 by djm968

[howartp]

Quite easy to do with Powershell

You got a typo in the date filter.

[Jawloms]

Thanks, but this is showing me my recipients sending to a specified domain, I'm after the other way around. I want to see anyone I have on-site who has received an email from a specified domain. So I want to know all my mailboxes who have received an email from (for example) *.gmail.com.

[howartp]

Thanks, but this is showing me my recipients sending to a specified domain, I'm after the other way around. I want to see anyone I have on-site who has received an email from a specified domain. So I want to know all my mailboxes who have received an email from (for example) *.gmail.com.

 

I'm just testing it but in theory just change "$_.recipients -like" to "$_.sender -like"

 

I wish i'd known this command (about the transport logs) last week when i need to to track something for the cops!

[Jawloms]

Got it sorted now, thank you.

 

Stuart