How to search sent mails in specific date from Exchange 2010 SP3

%3CLINGO-SUB%20id%3D%22lingo-sub-794753%22%20slang%3D%22en-US%22%3EHow%20to%20search%20sent%20mails%20in%20specific%20date%20from%20Exchange%202010%20SP3%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-794753%22%20slang%3D%22en-US%22%3E%3CP%3EAnyone%20who%20know%20how%20to%20search%20emails%20sent%20all%20external%20users%20in%20specific%20time%20from%20Exchange%20Server%202010%20SP3%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20am%20now%20trying%20to%20make%20powershell%20with%20both%20get-mailbox%20and%20search-mailbox%20%2C%20but%20even%20if%20I%20use%20search-mailbox's%20searchquery%2C%20I%20am%20now%20sure%20what%20option%20do%20I%20make%20it%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI've%20already%20multi%20mailbox%20search%20in%20ECP%2C%20but%20the%20screen%20is%20limited%2C%20so%20it%20is%20hard%20to%20make%20results%20which%20I%20want%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-794753%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3E2010%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EAdmin%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EExchange%20Server%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EHybrid%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-834170%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20search%20sent%20mails%20in%20specific%20date%20from%20Exchange%202010%20SP3%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-834170%22%20slang%3D%22en-US%22%3E%3CP%3EAre%20Message%20Tracking%20logs%20not%20an%20option%20for%20your%20scenario%2C%20as%20you%20cannot%20use%20search%20with%20wildcarded%20To%20condition%2C%20search%20cannot%20distinguish%20between%20internal%2Fexternal%20origin%2C%20and%20despite%20tracking's%20limited%20life%20span.%20E.g.%20something%20like%3CBR%20%2F%3EGet-ExchangeServer%20%7C%20where%20%7B%24_.isHubTransportServer%20-or%20%24_.isMailboxServer%7D%20%7C%20Get-MessageTrackingLog%20-ResultSize%20Unlimited%20-EventID%20Receive%20%7C%20Where%20%7B%24_.Source%20-eq%20'STOREDRIVER'%20-and%20%24_.Recipients%20-inotlike%20'*%40%3CCONTOSO.COM%3E'%7D%3C%2FCONTOSO.COM%3E%3C%2FP%3E%0A%3CP%3EYou%20can%20query%20the%20MessageIDs%20from%20those%20messages%2C%20and%20use%20those%20for%20further%20investigation.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Contributor

Anyone who know how to search emails sent all external users in specific time from Exchange Server 2010 SP3?

 

I am now trying to make powershell with both get-mailbox and search-mailbox , but even if I use search-mailbox's searchquery, I am now sure what option do I make it?

 

I've already multi mailbox search in ECP, but the screen is limited, so it is hard to make results which I want?

 

1 Reply
Highlighted

Are Message Tracking logs not an option for your scenario, as you cannot use search with wildcarded To condition, search cannot distinguish between internal/external origin, and despite tracking's limited life span. E.g. something like
Get-ExchangeServer | where {$_.isHubTransportServer -or $_.isMailboxServer} | Get-MessageTrackingLog -ResultSize Unlimited -EventID Receive | Where {$_.Source -eq 'STOREDRIVER' -and $_.Recipients -inotlike '*@<contoso.com>'}

You can query the MessageIDs from those messages, and use those for further investigation.