How to search sent mails in specific date from Exchange 2010 SP3

Brass Contributor

Anyone who know how to search emails sent all external users in specific time from Exchange Server 2010 SP3?


I am now trying to make powershell with both get-mailbox and search-mailbox , but even if I use search-mailbox's searchquery, I am now sure what option do I make it?


I've already multi mailbox search in ECP, but the screen is limited, so it is hard to make results which I want?


1 Reply

Are Message Tracking logs not an option for your scenario, as you cannot use search with wildcarded To condition, search cannot distinguish between internal/external origin, and despite tracking's limited life span. E.g. something like
Get-ExchangeServer | where {$_.isHubTransportServer -or $_.isMailboxServer} | Get-MessageTrackingLog -ResultSize Unlimited -EventID Receive | Where {$_.Source -eq 'STOREDRIVER' -and $_.Recipients -inotlike '*@<>'}

You can query the MessageIDs from those messages, and use those for further investigation.