Aug 08 2019 02:02 AM
Anyone who know how to search emails sent all external users in specific time from Exchange Server 2010 SP3?
I am now trying to make powershell with both get-mailbox and search-mailbox , but even if I use search-mailbox's searchquery, I am now sure what option do I make it?
I've already multi mailbox search in ECP, but the screen is limited, so it is hard to make results which I want?
Sep 03 2019 02:29 AM - edited Sep 04 2019 12:59 AM
Are Message Tracking logs not an option for your scenario, as you cannot use search with wildcarded To condition, search cannot distinguish between internal/external origin, and despite tracking's limited life span. E.g. something like
Get-ExchangeServer | where {$_.isHubTransportServer -or $_.isMailboxServer} | Get-MessageTrackingLog -ResultSize Unlimited -EventID Receive | Where {$_.Source -eq 'STOREDRIVER' -and $_.Recipients -inotlike '*@<contoso.com>'}
You can query the MessageIDs from those messages, and use those for further investigation.