none
How to conduct a Multi Mailbox Search in Exchange 2010 for any messages sent to *@hotmail.com RRS feed

  • Question

  • Trying to track all outbound messages from an organization to (wildcard)@hotmail.com or (wildcard)@gmail.com (as examples)

    I've tried the following fields:

    Messages To or From Specific Email Adresses  The example isn't clear as it refers to a domain search but when I entered @hotmail.com in the TO field, the search failed (as did *@hotmail.com)  I've seen it written that you cannot start the search with an asterisk but then how is one supposed to track any outgoing message?

    Keywords  I've tried *@hotmail.com , %@hotmail.com, the search failed

    Any suggestions?

    Wednesday, June 8, 2011 6:25 PM

Answers

  • Hi,

    Using get-messagetrackinglog need to be assigned the following permission:

    Organization Management

    Records Management

    Recipient Management

    then you can easily use the cmdlet to search all the message sent to the specific domain.

    get-messagetrackinglog -start "11/11/2010 11:00am" -resultsize 3000| where {[string]$_.recipients -like "*@domainname.com"}

    Your administrator also can grant which actions you can do and you cannot do through RBAC.


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    • Marked as answer by Novak Wu Friday, June 17, 2011 8:10 AM
    Friday, June 10, 2011 3:03 AM

All replies

  • On Wed, 8 Jun 2011 18:25:25 +0000, okthanx wrote:
     
    >
    >
    >Trying to track all outbound messages from an organization to (wildcard)@hotmail.com or (wildcard)@gmail.com (as examples)
    >
    >I've tried the following fields:
    >
    >Messages To or From Specific Email Adresses The example isn't clear as it refers to a domain search but when I entered @hotmail.com in the TO field, the search failed (as did *@hotmail.com) I've seen it written that you cannot start the search with an asterisk but then how is one supposed to track any outgoing message?
    >
    >Keywords I've tried *@hotmail.com , %@hotmail.com, the search failed
    >
    >Any suggestions?
     
    Use powershell. You can filter the property that contains the
    recipient addresses by piping the output of the Get-MessageTrackingLog
    cmdlet ito either a Where-Object cmdlet or into your own
    foreach-object script-block.
     
    ---
    Rich Matheisen
    MCSE+I, Exchange MVP
     

    --- Rich Matheisen MCSE+I, Exchange MVP
    Wednesday, June 8, 2011 11:57 PM
  • Thanks Rich.  I should have also explained that I am in Risk Management and not in IT.  I have been given very limited access (ie Discovery Management role only), I don't have access to the EMC so I don't know how/where I could use Powershell (and your answer is a bit above my technical expertise).  I need to be able to run these searches without the assistance of IT staff. 

    Thursday, June 9, 2011 2:26 PM
  • On Thu, 9 Jun 2011 14:26:10 +0000, okthanx wrote:
     
    >Thanks Rich. I should have also explained that I am in Risk Management and not in IT. I have been given very limited access (ie Discovery Management role only), I don't have access to the EMC so I don't know how/where I could use Powershell (and your answer is a bit above my technical expertise). I need to be able to run these searches without the assistance of IT staff.
     
    You're not going to be able to do that without their help. That help
    may be to write a powershell script that you can use, or to give you
    access to use the get-messagetrackinglog cmdlet in EMS (not EMC).
     
    You can certainly use other text-based tools to process the log files
    (perl, awk, grep, etc.), but they're more awkward to use than
    powershell for this.
     
    ---
    Rich Matheisen
    MCSE+I, Exchange MVP
     

    --- Rich Matheisen MCSE+I, Exchange MVP
    Friday, June 10, 2011 1:44 AM
  • Hi,

    Using get-messagetrackinglog need to be assigned the following permission:

    Organization Management

    Records Management

    Recipient Management

    then you can easily use the cmdlet to search all the message sent to the specific domain.

    get-messagetrackinglog -start "11/11/2010 11:00am" -resultsize 3000| where {[string]$_.recipients -like "*@domainname.com"}

    Your administrator also can grant which actions you can do and you cannot do through RBAC.


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    • Marked as answer by Novak Wu Friday, June 17, 2011 8:10 AM
    Friday, June 10, 2011 3:03 AM