none
Check which folder the message was delivered

    Question

  • Hi all,

    can we as admin trace if a message was delivered to inbox/junk or other folders without using inplace ediscovery?

    Thanks!


    Please mark as helpful if you find my contribution useful or as an answer if it does answer your question. That will encourage me - and others - to take time out to help you. Thank you! Off2work

    Thursday, September 22, 2016 7:54 AM

Answers

  • Hi Al and thanks for prompt reply. I forgot to mention we at using Exchange online so the commands are not the same. I tried with:

    get-messagetrace -RecipientAddress userdomain.com -MessageTraceId 4822f38d-95bf-4f94-26b8-08d3e2b
    09699999

    exported it to csv but it does not state where the message was delivered.

    I started advanced message trace from ECP to see if I get more info, It will take few hours before I receive it.

    thanks for other tips!


    Please mark as helpful if you find my contribution useful or as an answer if it does answer your question. That will encourage me - and others - to take time out to help you. Thank you! Off2work

    First do a message trace and get the messagetraceID.

    Then run powershell: Get-MessageTraceDetail 

    Example:

    Get-MessageTraceDetail -MessageTraceId  4822f38d-95bf-4f94-26b8-08d3e2b -RecipientAddress user@domain.com

    That will show what folder the message was delivered under the DELIVER event:

    Event            : Deliver
    Action           :
    Detail           : The message was successfully delivered to the folder: UserFolder


    Blog:    Twitter:   


    • Edited by Andy DavidMVP Thursday, September 22, 2016 12:15 PM
    • Marked as answer by Off2work Thursday, September 22, 2016 6:29 PM
    Thursday, September 22, 2016 12:14 PM

All replies

  • Messagetrace can do by checking RecipientStatus

    get-messagetrackinglog -Recipients:UserB@domain.com -Sender "user@example.com" -EventID "DELIVER" -Start "9/22/2016 3:54:00 PM" -End "9/22/2016 4:04:00 PM" | FL RecipientStatus

    If you have too many hub transport, you can pipe the command to your server and use wildcard e.g. all your servers starts with EXchange

    Get-TransportServer EXchange* | get-messagetrackinglog -Recipients:UserB@domain.com -Sender "user@example.com" -EventID "DELIVER" -Start "9/22/2016 3:54:00 PM" -End "9/22/2016 4:04:00 PM" | FL RecipientStatus
    EDIT: By the way, for Junk email, the email will be move to junk only when you open Outlook client, Outlook has its own filtering and will move emails that Outlook suspect as Junk. So message trace may not able to check if the email will be delivered automatically to Junk Email folder.


    Please remember to mark the replies as answers if they help.


    • Edited by Al Laurente Thursday, September 22, 2016 8:13 AM
    Thursday, September 22, 2016 8:10 AM
  • Hi Al and thanks for prompt reply. I forgot to mention we at using Exchange online so the commands are not the same. I tried with:

    get-messagetrace -RecipientAddress userdomain.com -MessageTraceId 4822f38d-95bf-4f94-26b8-08d3e2b
    09699999

    exported it to csv but it does not state where the message was delivered.

    I started advanced message trace from ECP to see if I get more info, It will take few hours before I receive it.

    thanks for other tips!


    Please mark as helpful if you find my contribution useful or as an answer if it does answer your question. That will encourage me - and others - to take time out to help you. Thank you! Off2work

    Thursday, September 22, 2016 10:18 AM
  • I dont think its possible without doing the discovery search.

    Transport logs contain limited logs for the time message arrived to the mailbox .

    Thursday, September 22, 2016 12:06 PM
  • Hi Al and thanks for prompt reply. I forgot to mention we at using Exchange online so the commands are not the same. I tried with:

    get-messagetrace -RecipientAddress userdomain.com -MessageTraceId 4822f38d-95bf-4f94-26b8-08d3e2b
    09699999

    exported it to csv but it does not state where the message was delivered.

    I started advanced message trace from ECP to see if I get more info, It will take few hours before I receive it.

    thanks for other tips!


    Please mark as helpful if you find my contribution useful or as an answer if it does answer your question. That will encourage me - and others - to take time out to help you. Thank you! Off2work

    First do a message trace and get the messagetraceID.

    Then run powershell: Get-MessageTraceDetail 

    Example:

    Get-MessageTraceDetail -MessageTraceId  4822f38d-95bf-4f94-26b8-08d3e2b -RecipientAddress user@domain.com

    That will show what folder the message was delivered under the DELIVER event:

    Event            : Deliver
    Action           :
    Detail           : The message was successfully delivered to the folder: UserFolder


    Blog:    Twitter:   


    • Edited by Andy DavidMVP Thursday, September 22, 2016 12:15 PM
    • Marked as answer by Off2work Thursday, September 22, 2016 6:29 PM
    Thursday, September 22, 2016 12:14 PM
  • Hi Andy and thanks for your tip. I did a you mentioned, but it only says message was successfully delivered.

    Don't seem like historical search will show more either.


    Please mark as helpful if you find my contribution useful or as an answer if it does answer your question. That will encourage me - and others - to take time out to help you. Thank you! Off2work

    Thursday, September 22, 2016 5:41 PM
  • I did further testing on my inbox (where I have many rules to move messages to another folders) and seems like it states correct as you mentioned.

    If the message was delivered to junk folder, will it also state so?

    thanks!


    Please mark as helpful if you find my contribution useful or as an answer if it does answer your question. That will encourage me - and others - to take time out to help you. Thank you! Off2work

    Thursday, September 22, 2016 5:49 PM
  • I did further testing on my inbox (where I have many rules to move messages to another folders) and seems like it states correct as you mentioned.

    If the message was delivered to junk folder, will it also state so?

    thanks!


    Please mark as helpful if you find my contribution useful or as an answer if it does answer your question. That will encourage me - and others - to take time out to help you. Thank you! Off2work

    Yes, it should. 

    Blog:    Twitter:   

    Thursday, September 22, 2016 6:07 PM
  • thanks, case closed :D

    Please mark as helpful if you find my contribution useful or as an answer if it does answer your question. That will encourage me - and others - to take time out to help you. Thank you! Off2work

    Thursday, September 22, 2016 6:29 PM
  • Hi,

    Have you tried using delivery reports feature in EAC?

    Populate the fields accordingly then hit Search!

    

    Thursday, September 22, 2016 8:21 PM
  • Hi Lanrray,

    yes I tried that in advanced mode, but the exported file doesn't contain info of where it was delivered. Andys solution is the way to go if message is not to old.


    Please mark as helpful if you find my contribution useful or as an answer if it does answer your question. That will encourage me - and others - to take time out to help you. Thank you! Off2work

    Friday, September 23, 2016 8:08 AM