4

When executing:

Get-MessageTrackingLog -sender <sender> -Start <date> |
  Select TimeStamp,EventID,Source,Sender,
      @{Name='Recipients';Expression={ [string]::join(";",($_.Recipients))}},MessageSubject |
  Export-csv <path>

the output expands the alleged DG(s) into a long list of recipients. Why? I want to see the DG(s) rather than the recipients.

Note: I say 'alleged', because I do not know for certain whether a DG was used or not, however common sense tells me the CEO did not keep a running list of all ~1K employees and type them, nor decided to expand the DG in his message.

PorLosTacos
  • 41
  • 4
  • 4
    If a message was sent to DG, then there is a record with EventID 'Expand' in a tracking log. Events before this record show DG address in recipients field. – Vadim Dec 13 '19 at 22:03
  • Good stuff. You're spot on. Thanks bro. Enjoy some tacos at your nearby taqueria. For reference: https://docs.microsoft.com/en-us/exchange/mail-flow/transport-logs/message-tracking?view=exchserver-2019 – PorLosTacos Dec 14 '19 at 00:36
  • @Vadim sounds like your comment should be an answer. – anx Jun 23 '21 at 22:33

0 Answers0