Home

How to search sent mails in specific date from Exchange 2010 SP3

%3CLINGO-SUB%20id%3D%22lingo-sub-794753%22%20slang%3D%22en-US%22%3EHow%20to%20search%20sent%20mails%20in%20specific%20date%20from%20Exchange%202010%20SP3%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-794753%22%20slang%3D%22en-US%22%3E%3CP%3EAnyone%20who%20know%20how%20to%20search%20emails%20sent%20all%20external%20users%20in%20specific%20time%20from%20Exchange%20Server%202010%20SP3%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20am%20now%20trying%20to%20make%20powershell%20with%20both%20get-mailbox%20and%20search-mailbox%20%2C%20but%20even%20if%20I%20use%20search-mailbox's%20searchquery%2C%20I%20am%20now%20sure%20what%20option%20do%20I%20make%20it%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI've%20already%20multi%20mailbox%20search%20in%20ECP%2C%20but%20the%20screen%20is%20limited%2C%20so%20it%20is%20hard%20to%20make%20results%20which%20I%20want%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-794753%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3E2010%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EAdmin%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EExchange%20Server%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EHybrid%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-834170%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20search%20sent%20mails%20in%20specific%20date%20from%20Exchange%202010%20SP3%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-834170%22%20slang%3D%22en-US%22%3E%3CP%3EAre%20Message%20Tracking%20logs%20not%20an%20option%20for%20your%20scenario%2C%20as%20you%20cannot%20use%20search%20with%20wildcarded%20To%20condition%2C%20search%20cannot%20distinguish%20between%20internal%2Fexternal%20origin%2C%20and%20despite%20tracking's%20limited%20life%20span.%20E.g.%20something%20like%3CBR%20%2F%3EGet-ExchangeServer%20%7C%20where%20%7B%24_.isHubTransportServer%20-or%20%24_.isMailboxServer%7D%20%7C%20Get-MessageTrackingLog%20-ResultSize%20Unlimited%20-EventID%20Receive%20%7C%20Where%20%7B%24_.Source%20-eq%20'STOREDRIVER'%20-and%20%24_.Recipients%20-inotlike%20'*%40%3CCONTOSO.COM%3E'%7D%3C%2FCONTOSO.COM%3E%3C%2FP%3E%0A%3CP%3EYou%20can%20query%20the%20MessageIDs%20from%20those%20messages%2C%20and%20use%20those%20for%20further%20investigation.%3C%2FP%3E%3C%2FLINGO-BODY%3E
hongwoo_jin
Contributor

Anyone who know how to search emails sent all external users in specific time from Exchange Server 2010 SP3?

 

I am now trying to make powershell with both get-mailbox and search-mailbox , but even if I use search-mailbox's searchquery, I am now sure what option do I make it?

 

I've already multi mailbox search in ECP, but the screen is limited, so it is hard to make results which I want?

 

1 Reply

Are Message Tracking logs not an option for your scenario, as you cannot use search with wildcarded To condition, search cannot distinguish between internal/external origin, and despite tracking's limited life span. E.g. something like
Get-ExchangeServer | where {$_.isHubTransportServer -or $_.isMailboxServer} | Get-MessageTrackingLog -ResultSize Unlimited -EventID Receive | Where {$_.Source -eq 'STOREDRIVER' -and $_.Recipients -inotlike '*@<contoso.com>'}

You can query the MessageIDs from those messages, and use those for further investigation.

Related Conversations
Tabs and Dark Mode
cjc2112 in Discussions on
50 Replies
Extentions Synchronization
Deleted in Discussions on
3 Replies
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies
How to Prevent Teams from Auto-Launch
chenrylee in Microsoft Teams on
32 Replies
Security Community Webinars
Valon_Kolica in Security, Privacy & Compliance on
15 Replies
Dev channel update to 80.0.355.1 is live
josh_bodner in Discussions on
67 Replies