Attachment trace

%3CLINGO-SUB%20id%3D%22lingo-sub-780618%22%20slang%3D%22en-US%22%3EAttachment%20trace%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-780618%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Experts%3C%2FP%3E%3CP%3Efor%20one%20of%20my%20user%20attachment%20was%20held%20on%20email%20gateway.%20i%20have%20later%20released%20the%20attachment.%20the%20user%20claims%20that%20he%20did%20not%20receive%20the%20attachment%20but%20i%20can%20see%20on%20email%20gateway%20that%20attachment%20was%20released.%20Experts%20help%20me%20how%20to%20check%20whether%20user%20has%20received%20the%20attachment%20or%20not.%20from%20the%20below%20syntax%20i%20dont%20see%20anything%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CPRE%3E%3CSPAN%20class%3D%22nb%22%3EGet-MessageTrace%3C%2FSPAN%3E%20%3CSPAN%20class%3D%22n%22%3E-sender%3C%2FSPAN%3E%20%3CSPAN%20class%3D%22n%22%3Eabc%3C%2FSPAN%3E%3CSPAN%20class%3D%22nv%22%3E%40externaldomain%3C%2FSPAN%3E%3CSPAN%20class%3D%22p%22%3E.%3C%2FSPAN%3E%3CSPAN%20class%3D%22n%22%3Ecom%3C%2FSPAN%3E%20%3CSPAN%20class%3D%22n%22%3E-recipient%3C%2FSPAN%3E%20%3CSPAN%20class%3D%22n%22%3Emyuser%3C%2FSPAN%3E%3CSPAN%20class%3D%22nv%22%3E%40mydomain%3C%2FSPAN%3E%3CSPAN%20class%3D%22p%22%3E.%3C%2FSPAN%3E%3CSPAN%20class%3D%22n%22%3Ecom%3C%2FSPAN%3E%20%3CSPAN%20class%3D%22n%22%3E-start%3C%2FSPAN%3E%20%3CSPAN%20class%3D%22s2%22%3E%2207%2F20%2F2019%2000%3A00%22%3C%2FSPAN%3E%20%3CSPAN%20class%3D%22n%22%3E-end%3C%2FSPAN%3E%20%3CSPAN%20class%3D%22s2%22%3E%2207%2F20%2F2019%2023%3A59%22%3C%2FSPAN%3E%20%3CSPAN%20class%3D%22p%22%3E%7C%3C%2FSPAN%3E%20%3CSPAN%20class%3D%22n%22%3Eselect%3C%2FSPAN%3E%20%3CSPAN%20class%3D%22n%22%3ESubject%3C%2FSPAN%3E%3CSPAN%20class%3D%22p%22%3E%2C%3C%2FSPAN%3E%3CSPAN%20class%3D%22n%22%3EReceived%3C%2FSPAN%3E%3CSPAN%20class%3D%22p%22%3E%2C%3C%2FSPAN%3E%3CSPAN%20class%3D%22n%22%3ESenderAddress%3C%2FSPAN%3E%3CSPAN%20class%3D%22p%22%3E%2C%3C%2FSPAN%3E%3CSPAN%20class%3D%22n%22%3ERecipientAddress%3C%2FSPAN%3E%3CSPAN%20class%3D%22p%22%3E%2C%3C%2FSPAN%3E%3CSPAN%20class%3D%22n%22%3EMessageID%3C%2FSPAN%3E%3CSPAN%20class%3D%22p%22%3E%2C%3C%2FSPAN%3E%3CSPAN%20class%3D%22n%22%3EStatus%3C%2FSPAN%3E%3CSPAN%20class%3D%22p%22%3E%2C%3C%2FSPAN%3E%3CSPAN%20class%3D%22n%22%3EMessageTraceID%3C%2FSPAN%3E%20%3CSPAN%20class%3D%22p%22%3E%7C%3C%2FSPAN%3E%20%3CSPAN%20class%3D%22nb%22%3EOut-Gridview%3C%2FSPAN%3E%3C%2FPRE%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-780618%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAdmin%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EExchange%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EHybrid%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-780864%22%20slang%3D%22en-US%22%3ERe%3A%20Attachment%20trace%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-780864%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F144450%22%20target%3D%22_blank%22%3E%40Roger%20Roger%3C%2FA%3E%26nbsp%3B%20Which%20Gateway%20are%20you%20referring%20to%20here.%20%3F%20ProofPoint%20or%20IronPort%20%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EBTW%2C%20when%20you%20release%20an%20attachment%20from%20a%20AntiSpam%20whatever%20it%20is%2C%20it%20is%20still%20with%20user%20to%20retrieve%20it%20from%20Protection%20center%20themselve.%20They%20get%20an%20email%20stating%2C%20an%20email%20need%20to%20be%20released%20(Click%20here%20)%20to%20release%20it%2C%20that%20click%20here%20hyperlink%20takes%20them%20to%20Protection%20Center%20where%20they%20can%20release%20those%20individual%20emails.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAdditional%2C%20if%20you%20suspect%20the%20email%2Fattachment%20is%20still%20stuck%20somewhere%2C%20you%20do%20a%20Mailbox%20Search%20or%20E-Discovery%20to%20see%20the%20actual%20content%20of%20the%20email%20that%20user%20has%20received.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ECheers%20!!%3C%2FP%3E%3CP%3EAnkit%20Shukla%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Frequent Contributor

Hi Experts

for one of my user attachment was held on email gateway. i have later released the attachment. the user claims that he did not receive the attachment but i can see on email gateway that attachment was released. Experts help me how to check whether user has received the attachment or not. from the below syntax i dont see anything

 

Get-MessageTrace -sender abc@externaldomain.com -recipient myuser@mydomain.com -start "07/20/2019 00:00" -end "07/20/2019 23:59" | select Subject,Received,SenderAddress,RecipientAddress,MessageID,Status,MessageTraceID | Out-Gridview
1 Reply
Highlighted

@Roger Roger  Which Gateway are you referring to here. ? ProofPoint or IronPort ?

 

BTW, when you release an attachment from a AntiSpam whatever it is, it is still with user to retrieve it from Protection center themselve. They get an email stating, an email need to be released (Click here ) to release it, that click here hyperlink takes them to Protection Center where they can release those individual emails.

 

 

Additional, if you suspect the email/attachment is still stuck somewhere, you do a Mailbox Search or E-Discovery to see the actual content of the email that user has received.

 

Cheers !!

Ankit Shukla