none
Check for list of email messages awaiting moderation\approval

    Question

  • Hi all,

    I have an Exchange environment where, in order to protect against malware, some document types are quarantined. Occassionally, despite approving, the email seems to get stuck awaiting further approval but I dont see the notification.  Is there a powershell script that I can use to see what messages are awaiting moderation\approval?

    Thanks

    Craig

    Tuesday, October 25, 2016 2:15 PM

Answers

  • Hi Craig,

    Based on my searching, in message tracking logs, there is an event type in the event-id field called " INITMESSAGECREATED", it will show if the message has been sent to a moderated recipient or not.

    Event name

    Description

    INITMESSAGECREATED

    A message was sent to a moderated recipient, so the   message was sent to the arbitration mailbox for approval.

    we can try using this event type to list all messages are needed to approval:

    Get-ExchangeServer | where {$_.isHubTransportServer -eq $true -or $_.isMailboxServer -eq $true} | Get-MessageTrackingLog -ResultSize unlimited -Eventid INITMESSAGECREATED |fl Send*,Recipient*,*subject* > "D:\Approval message Search.txt" 

    Hope this helps,

    Best Regards,


    Niko Cheng
    TechNet Community Support


    Please remember to mark the replies as answers if they help and unmark them if they provide no help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Wednesday, October 26, 2016 7:07 AM
    Moderator
  • Hi Craig,

    We can use the following [start]and [end] parameters to limit for last x days, as below:

    Get-MessageTrackingLog -ResultSize unlimited -Eventid INITMESSAGECREATED -Start "10/21/2016 09:00:00" -End "10/31/2016 18:00:00"

    Best Regards,


    Niko Cheng
    TechNet Community Support


    Please remember to mark the replies as answers if they help and unmark them if they provide no help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Monday, October 31, 2016 2:14 AM
    Moderator

All replies

  • Hi Craig,

    Based on my searching, in message tracking logs, there is an event type in the event-id field called " INITMESSAGECREATED", it will show if the message has been sent to a moderated recipient or not.

    Event name

    Description

    INITMESSAGECREATED

    A message was sent to a moderated recipient, so the   message was sent to the arbitration mailbox for approval.

    we can try using this event type to list all messages are needed to approval:

    Get-ExchangeServer | where {$_.isHubTransportServer -eq $true -or $_.isMailboxServer -eq $true} | Get-MessageTrackingLog -ResultSize unlimited -Eventid INITMESSAGECREATED |fl Send*,Recipient*,*subject* > "D:\Approval message Search.txt" 

    Hope this helps,

    Best Regards,


    Niko Cheng
    TechNet Community Support


    Please remember to mark the replies as answers if they help and unmark them if they provide no help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Wednesday, October 26, 2016 7:07 AM
    Moderator
  • Hi Niko - Thanks for the great reply.  Is it possible to either: filter out those that have been approved, or only those for the last x days? 

    Regards

    Craig

    Friday, October 28, 2016 11:48 AM
  • Hi Craig,

    We can use the following [start]and [end] parameters to limit for last x days, as below:

    Get-MessageTrackingLog -ResultSize unlimited -Eventid INITMESSAGECREATED -Start "10/21/2016 09:00:00" -End "10/31/2016 18:00:00"

    Best Regards,


    Niko Cheng
    TechNet Community Support


    Please remember to mark the replies as answers if they help and unmark them if they provide no help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Monday, October 31, 2016 2:14 AM
    Moderator
  • Hi Craig,

    Is there any update on this thread?

    If the issue has been resolved, please mark the helpful replies as answers, this will make answer searching in the forum easier and be beneficial to other community members as well. 

    Thanks for your understanding.

    Best Regards,


    Niko Cheng
    TechNet Community Support


    Please remember to mark the replies as answers if they help and unmark them if they provide no help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Thursday, November 3, 2016 1:50 AM
    Moderator