Exchange 2010 - Get a list of emails received and sent by domain

Question

I have an Exchange 2010 server listening on a couple of different domains. So it receives and sends emails destinated and originating from several domains.

Now we want to get rid of a specific domain gradually and what I would like to do now is get a list of all the emails received or sent using that specific domain that we wants to get rid of. So we can figure how this domain is still getting used before getting rid of it.

Thanks.

Solution

You can use Powershell to retrieve this and dump it to a log file if you want.

Search for messages sent TO any users at domain.com:

Get-MessageTrackingLog -ResultSize Unlimited -Start "10/1/2013" -End "10/25/2013" | where{$_.recipients -like "*@domain.com"} | select-object Timestamp,SourceContext,Source,EventId,MessageSubject,Sender,{$_.Recipients} | export-csv C:\ExchangeLogResults.txt

Search for messages sent FROM users at domain.com:

Get-MessageTrackingLog -ResultSize Unlimited -Start "10/1/2013" -End "10/25/2013" | where{$_.sender -like "*@domain.com"} | select-object Timestamp,SourceContext,Source,EventId,MessageSubject,Sender,{$_.Recipients} | export-csv C:\ExchangeLogResults.txt

Comments

[kralyk]

check the message tracking logs

[user3114802]

C:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\Logs\MessageTracking

[kralyk]

In the EMC itself. No need to manually check them.

[user3114802]

Where in the EMC? I cannot find a way to tell from a specific domain, it only allows me to search by users.

[Admin]

what if you wanted to do both send and receive?

[kralyk]

@JoshuaBernstein - for a given message? You can combine the "where" so that it includes sender and recipient. See here for some examples that may assist you: msexchangeguru.com/2015/03/10/message-tracking