Sometimes you need to know specifically who a message was sent to and there may be no obvious way to determine that (such as it may have been sent to a distribution group, or the sender may have used BCC, or in my case that prompts this post – an external user). In these situations, the message tracking log in Exchange can be helpful but capturing the output in a format that you can send to your HR or Legal department may be a bit of a challenge, as the recipient field in the message tracking log is an array – and any type of collection object doesn’t export cleanly with the built-in cmdlets such as export-csv.
What you first need to to is establish what criteria will allow you to uniquely identify the message(s) you need to track for management. The best criteria is the message ID, but you can use a combination of criteria such as sender and message subject. These will become arguments to the Get-MessageTrackingLog Exchange Management Shell cmdlet.
In this case we are interested in who the message was actually delivered to, so you can further filter by the event ID of “deliver”.
Putting all that together, you end up with a Get-MessageTrackingLog command that will look something like this:
That’s simple enough, and it will return a stream of objects that match your filter criteria. But you need to give someone a report of who received this message. Unfortunately, it’s not as easy as piping the output to Export-CSV or Out-File. First you have to extract all of the recipients. The solution I used was a foreach-object loop on the results to create a CSV formatted result that I could then pipe to out-file. This allowed me to capture the recipients as a simple string successfully.
The ForEach-Object loop uses the -Begin code block to create the header records for the file, and the -process code block to actually capture the tracking log fields that we were interested in. The fields were placed in a sub-expression to allow for proper expansion of their values.
Take the previous two examples, combine them with a list of transport servers to retrieve logs from and feed the output to out-file, and you can construct a one-liner that will provide you with a simple report of who received a given email that you can share with your management.