Table of Contents

Using the Exchange Shell to Track Messages

Exchange Message Tracking from the Command Line

:!: The -match comparison operator does not require the wildcard character.

Track Failed Message Delivery

You can use the Exchange shell to track messages that could not be delivered because of message size issues. The RecipientStatus field in Message Tracking logs is used to store the SMTP response and enhanced status codes. The Message Tracking EventID we’re looking for is FAIL.

To track messages that failed because of recipient’s MaxReceiveSize:

Get-MessageTrackingLog -ResultSize Unlimited -EventID FAIL | where {$_.RecipientStatus -like “*RecipSizeLimit*”}

To track messages that failed because of the sender’s MaxSendSize:

Get-MessageTrackingLog -ResultSize Unlimited -EventID FAIL | where {$_.RecipientStatus -like “*SendSizeLimit*”}

Track Messages by Message Subject

https://practical365.com/exchange-server/searching-message-tracking-logs-by-email-subject/

:!: This command returns partial match results, so there is no need for wildcard searches.

Get-MessageTrackingLog -MessageSubject "Important: Password Expiration Notification"

Track Messages by Sender

Get-MessageTrackingLog -sender "foo@somedomain.com"

Get-MessageTrackingLog -Sender foo@somedomain.com -Start (Get-Date).AddHours(-1)

Get-MessageTrackingLog -Sender foo@somedomain.com -Recipients foo@mydomain.com

Get-MessageTrackingLog -Sender foo@somedomain.com -Recipients foo@mydomain.com,another@mydomain.com

Get-MessageTrackingLog -ResultSize Unlimited -Start "01-01-2019" -End "01-15-2019" | where{$_.sender -like "*@senderdomain.tld"} | Sort TimeStamp

Track Messages by Recipient

Get-MessageTrackingLog -Recipients "foo@mydomain.com"

Get-MessageTrackingLog -Recipients *@gmail.com

Get-MessageTrackingLog -Start (Get-Date).AddHours(-1) | Where-Object {$_.recipients -like "*@gmail.com"}

Get-MessageTrackingLog -Start (Get-Date).AddHours(-1) | Where-Object {$_.recipients -match "gmail"}

Get-MessageTrackingLog -ResultSize Unlimited -Start "05-19-2019" -End "05-21-2019" -Recipients "recipientaddress@yourdomain.tld" | Sort TimeStamp

Track Messages by Message-ID

Get-MessageTrackingLog -MessageId "MESSAGE_ID"

Get-MessageTrackingLog -MessageId "MESSAGE_ID" -Start "05-01-2021" -End "06-03-2021"

Track Messages by Date and Time

Last 10 days:

Get-MessageTrackingLog -Start (Get-Date).AddDays(-10) -ResultSize Unlimited | Where -Property Recipients -NotLike "*HealthMailbox*"

Specify start and stop:

Get-MessageTrackingLog -Start "03/13/2020 09:00:00" -End "03/13/2020 09:10:00" | Where -Property Recipients -NotLike "*HealthMailbox*"