Exchange Message Tracking PowerShell CMDlets
Search by Message ID
Get-ExchangeServer | get-messagetrackinglog -MessageID “<messageID>” -Start “5/16/2012 12:01:00 AM” -End “5/16/2012 11:59:00 PM” | fl Timestamp,ClientIp,ClientHostname,ServerIp,ServerHostname,Source,EventId,MessageId, @{Name=”Recipients”;Expression={$_.recipients}},@{Name=”Recipientstatus”;Expression={$_.recipientstatus}},TotalBytes,MessageSubject,Sender,ReturnPath,MessageLantency
Search by Sender
Get-ExchangeServer | get-messagetrackinglog -sender user@domain.com -Start “11/15/2012 12:00:00 AM” -End “11/16/2012 11:59:00 PM” | fl Timestamp,ClientIp,ClientHostname,ServerIp,ServerHostname, Source,EventId,MessageId, @{Name=”Recipients”;Expression={$_.recipients}},@{Name=”Recipientstatus”;Expression={$_.recipientstatus}},TotalBytes,MessageSubject,Sender
Search by Recipient
Get-ExchangeServer | get-messagetrackinglog -recipient user@domain.com -sender user@domain.com -Start “11/15/2012 12:00:00 AM” -End “11/16/2012 11:59:00 PM” | fl Timestamp,ClientIp,ClientHostname,ServerIp,ServerHostname, Source,EventId,MessageId, @{Name=”Recipients”;Expression={$_.recipients}},@{Name=”Recipientstatus”;Expression={$_.recipientstatus}},TotalBytes,MessageSubject,Sender
Get Message Size of messages in MB
fl Sender,@{label=”size”;Expression={$_.Totalbytes/1mb}}
Search by Sender, Recipient and Subject
Get-ExchangeServer | get-messagetrackinglog -sender user@domain.com -recipient user@domain.com -Start “12/13/2012 12:01:00 AM” -End “12/13/2012 11:59:00 PM” -messagesubject ‘test’ | fl Timestamp,ClientIp,ClientHostname,ServerIp,ServerHostname, Source,EventId,MessageId, @{Name=”Recipients”;Expression={$_.recipients}},@{Name=”Recipientstatus”;Expression={$_.recipientstatus}},TotalBytes,MessageSubject,Sender,ReturnPath,MessageLantency
Search by Sender and Subject
Get-ExchangeServer | get-messagetrackinglog -sender user@domain.com -messagesubject ‘subject’ -Start “5/16/2012 12:00:00 AM” -End “5/16/2012 11:59:00 PM” | fl Timestamp,ClientIp,ClientHostname,ServerIp,ServerHostname, Source,EventId,MessageId, @{Name=”Recipients”;Expression={$_.recipients}},@{Name=”Recipientstatus”;Expression={$_.recipientstatus}},TotalBytes,MessageSubject,Sender,ReturnPath,MessageLantency
Search by Recipient, Subject where the Event ID is failed
Get-ExchangeServer | get-messagetrackinglog -recipient user@domain.com -messagesubject “subject” -Start “10/10/2012 3:01:00 PM” -End “10/10/2012 9:59:00 PM” | where {$_.EventID -eq “Failed”}| fl Timestamp,MessageID, @{Name=”Recipients”;Expression={$_.recipients}},MessageSubject,EventID,Sender,ReturnPath
Search for messages blocked by transport rule
Get-ExchangeServer | get-messagetrackinglog -recipient user@domain.com -Start “10/10/2012 3:01:00 PM” -End “10/10/2012 9:59:00 PM” | where {$_.SourceContext -eq “Transport Rule Agent”}| fl Timestamp,Sender,MessageSubject,Source,EventId,MessageId, @{Name=”Recipients”;Expression={$_.recipients}},TotalBytes,SourceContext
Search by Subject
Get-ExchangeServer | get-messagetrackinglog -messagesubject ‘subject’ -Start “5/16/2012 12:00:00 AM” -End “5/16/2012 11:59:00 PM”| fl Timestamp,ClientIp,ClientHostname,ServerIp,ServerHostname, Source,EventId,MessageId, @{Name=”Recipients”;Expression={$_.recipients}},@{Name=”Recipientstatus”;Expression={$_.recipientstatus}},TotalBytes,MessageSubject,Sender,ReturnPath,MessageLantency
Search by Server and Recipient
get-messagetrackinglog -Server “server” -recipient user@domain.com -Start “9/22/2011 11:15:00 AM” -End “9/22/2011 12:15:00 PM” | fl Timestamp,ClientIp,ClientHostname,ServerIp,ServerHostname, Source,EventId,MessageId, @{Name=”Recipients”;Expression={$_.recipients}},@{Name=”Recipientstatus”;Expression={$_.recipientstatus}},TotalBytes,MessageSubject,Sender,ReturnPath,MessageLantency
Search all Hub Servers for Messages sent to Recipient
Get-ExchangeServer | Get-MessageTrackingLog -sender user@domain.com -Recipient user@domain.com -EventID “RECEIVE” -Start “9/30/2011 12:01:00 AM” -End “9/30/2011 11:59:00 PM” | fl Timestamp,MessageId, @{Name=”Recipients”;Expression={$_.recipients}},TotalBytes,MessageSubject,Sender,ReturnPath
Search all Hub Servers for Messages via MessageID
Get-ExchangeServer | get-messagetrackinglog -MessageID “<messageID>” -Start “12/13/2012 12:01:00 AM” -End “12/13/2012 11:59:00 PM” | fl Timestamp,ClientIp,ClientHostname,ServerIp,ServerHostname, source,EventId,MessageId, @{Name=”Recipients”;Expression={$_.recipients}},@{Name=”Recipientstatus”;Expression={$_.recipientstatus}},TotalBytes,MessageSubject,Sender,ReturnPath,MessageLantency ,sourcecontext
Search for Rejected Messages by searching agent logs
Get-AgentLog |?{ ($_.p1fromaddress -match “domain.com” -or $_.p2fromaddresses -match “domain.com”) -and $_.action -eq “RejectMessage”
Search for all mail sent between a specific time from a sender from the ‘contoso.com’ domain
get-messagetrackinglog -start “7/20/2011 6:00pm” -End “7/21/2011 4:30pm” -resultsize unlimited -eventid “SEND” | where {[string]$_.sender -like “*@contoso.com”}
Search for all mail sent between a specific time from a sender from the ‘contoso.com’ domain to recipients on the ‘contoso.com’ domain
get-messagetrackinglog -start “7/20/2011 6:00pm” -End “7/21/2011 4:30pm” -resultsize unlimited -eventid “SEND” | where { [string]$_.sender -like “*contoso.com” -and [string]$_.recipients -like “*@contoso.com” } | fl Sender,TimeStamp, @{Name=”Recipients”;Expression={$_.recipients}},MessageSubject
