none
get-messagetrackinglog Distribution Group Expand Group

    Question

  • Hi All,

    Is there a way, to get the logs form a Distribution Group. I would like to view the users that were in the group at the time the email was sent?

    The below command is useful, but I would like to see which users recieved an email. i.e on Monday a user/email could be a member of DG@xyz.com, but on Tuesday they could have been removed and therefore wouldnt have received the email sent to the DG. 

    Get-TransportServer | get-messagetrackinglog -Recipients DG@xyz.com -EventId RECEIVE -Start 12/04/2014 -ResultSize Unlimited | ft -AutoSize

    Thank you in advance

    Monday, May 12, 2014 11:54 AM

Answers

  • Try this:

    $messages = get-messagetrackinglog -recipients dg@xyz.com -eventid receive -start "5/12/2014 00:00:00" -end "5/12/2014 12:00:00"


    ForEach ($Message in $Messages) {get-messagetrackinglog -start "5/12/2014" -eventid expand -resultsize unlimited | where {$_.messageid -eq "$($message.messageid)"} | select messageid, recipients}

    There's several properties you can filter on, but in this example I'm finding all the messages sent to the DL.  Then for each of those messages matching them again in message tracking log based on the messageid property and selecting the EXPAND eventid which shows the DL expansion.

    • Marked as answer by biziee Wednesday, May 14, 2014 3:28 PM
    Monday, May 12, 2014 1:07 PM

All replies

  • The EventID "expand" will show you the list of recipients in the distribution list which received the message.  I haven't really had time to think about how you would cross reference that into the searching for the DL as the recipient, but I'm sure there is a way to tie it together.  If you are looking for a specific user/date/message subject it shouldn't be too difficult to narrow it down.

    Monday, May 12, 2014 12:30 PM
  • Try this:

    $messages = get-messagetrackinglog -recipients dg@xyz.com -eventid receive -start "5/12/2014 00:00:00" -end "5/12/2014 12:00:00"


    ForEach ($Message in $Messages) {get-messagetrackinglog -start "5/12/2014" -eventid expand -resultsize unlimited | where {$_.messageid -eq "$($message.messageid)"} | select messageid, recipients}

    There's several properties you can filter on, but in this example I'm finding all the messages sent to the DL.  Then for each of those messages matching them again in message tracking log based on the messageid property and selecting the EXPAND eventid which shows the DL expansion.

    • Marked as answer by biziee Wednesday, May 14, 2014 3:28 PM
    Monday, May 12, 2014 1:07 PM
  • Thank you for your responce. Below is the error I get back. Its like the script at first was using the local computer. I tried the script using Client Access Server i.e -Server XY -CAS-01. I still got Exchange server; Exchange server "XY-CAS-01.xyz.local" was not found.

    Exchange server "computername.xyz.local" was not found.

    At C:\exchange.ps1:1 char:1

    + $messages = get-messagetrackinglog -recipients dg@xyz.com -even ...

    + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

        + CategoryInfo          : InvalidArgument: (computername.xyz.local:ServerIdParameter) [], LocalizedException

        + FullyQualifiedErrorId : 3683AB6E



    • Edited by biziee Tuesday, May 13, 2014 11:59 AM *
    Tuesday, May 13, 2014 11:53 AM
  • Please post your entire script.  Also are you running it from a non-Exchange server?

    Tuesday, May 13, 2014 3:29 PM
  • Thank you.

    I now have this working. I was performing the commands remotely. The script works when running it directly from a server, in my case I ran the script on a CAS for it to work

    Wednesday, May 14, 2014 3:31 PM