Forum Discussion
Safe Links - Report on users to have attempted to click on a malicious link
Hi - How can I find out who has clicked on a link that was blocked?
There was an obvious spam email doing the rounds, and I'd like to know who has fallen for it?
Thanks
- Be aware that this command only goes 7 days back!
- That’s right!
And if you have specific users you think clicked through have you tried the full command as shown in the example for particular users -
Get-UrlTrace -RecipientAddress "michelle@contoso.com" -StartDate "5/9/2016" -EndDate "5/11/2016"
Best, Chris
- Hi Antonio13286,
You can use Get-UrlTrace
https://docs.microsoft.com/en-us/powershell/module/exchange/advanced-threat-protection/get-urltrace?view=exchange-ps
As described in the article, this is designed to determine who clicked through to a malicious web site in the past 7 days. To note, it’s currently limited to 7 days
Hope that answers your question!
Best, Chris- Thanks Chris, I’ve run that command, but still not getting the results. There’s some users whom I know got the blocking page, but they didn’t show up?
- Thanks Adam. I’ve had a look through the dashboards, but can’t find any reports that specifically list the users?
