Exchange 2010 BCC Email Recipient Email Trace


  • Hi...

    One of our employee have send an email and have added certain email groups in BCC - we would like to trace from Exchange 2010 - how can we trace that this user have send email to BCC users.

    I tried Exchange toolkit message tracking but couldn't able to find - i could only see email send (TO)

    Even through Outlook 2010 email header i couldn't

    Kindly assist... 


    Sunday, July 22, 2012 1:06 PM


All replies

  • Hi,

    You may use a cmdlet like

    Get-MessageTrackingLog -Start "MM/DD/YYYY 6:00AM" -End "MM/DD/YYYY 6:00PM" -Sender -EventId RECEIVE > C:\BCC.txt

    Then, search for the text “bcc” in the text. If user sends a BCC message, “RecipientStatus” field will have “bcc” value

    Regards from |

    Sunday, July 22, 2012 2:11 PM
  • Hello,

    Please use journal rules to trace the user who have sent email to BCC users.

    Best Regards,


    Monday, July 23, 2012 6:28 AM
  • Try this cmdlet:

    Get-ExchangeServer | where {$_.isHubTransportServer -eq $true -or
    $_.isMailboxServer -eq $true}| Get-MessageTrackingLog -Sender  -Start "8/09/2012 2:00PM" -End "8/09/2012 6:00PM" |
    fl > Output.txt

    Please note in "Recipients" field we have 2 recipients and "RecipientStatus" shows "To" and "BCC" respectively:

    RunspaceId              : 7e8be518-b174-411a-be4e-1358805e8066
    Timestamp               : 8/09/2012 2:31:03 PM
    ClientIp                :
    ClientHostname          : SERVER01.domain.local
    ServerIp                :
    ServerHostname          : SERVER01
    SourceContext           : 08CEEAC4B47B3415
    ConnectorId             :
    Source                  : STOREDRIVER
    EventId                 : RECEIVE
    InternalMessageId       : 27201680
    MessageId               : <90F14C16A6187A438A2D3907556R63080DFC179D@server>
    Recipients              : {,}
    RecipientStatus         : {To, BCC}

    Marcelo Lagden

    Thursday, August 09, 2012 1:47 PM