Dump all email metadata from Microsoft Exchange

Question

I'm trying to get a dump of the following information from a hypothetical Exchange server:

• Email Sender(s)
• Email Recipient(s)
• Time Sent

I'm a real Exchange novice here, but I found this article that says some of that information may be in transaction logs. I've also found a few PowerShell scripts that conduct searches, but nothing that does what I'm looking for.

I have no problem parsing plaintext to get this information if it's in logs, but I don't know where to look!

Answer 1

With so less information its not easy to give you a full option here. However what you can do is to use powershell and searching the Message Tracking logfiles. For example

Get-MessageTrackingLog -Start (Get-Date).AddHours(-1) | Where-Object {$_.recipients -like "*@gmail.com"}

Which will show all messages in the past hour for gmail.com users.

More infos can be found inside the Microsoft documentation here.

You might therefore start with something like:

Get-MessageTrackingLog -Start (Get-Date).AddHours(-1) | FT Recipients, TimeStamp, MessageSubject > "C:\temp\MySearchResult.txt" 

or

Get-MessageTrackingLog -Start "2008-12-09" | Select Recipients, Timestamp, Sender, @{Name='Recipients';Expression={[string]::join(";", ($_.Recipients))}} | Export-CSV c:\Temp\MailStat.csv

Just to give you some options.

Keep noted that the results are limited for the first 1,000 events as written here! So you need to specify some smaller time frames to export everything.