A client recently asked me to run a few reports, they wanted me to extract who sent the most email from their organisation, daily, weekly and monthly. I know there are a ton of scripts out there but I just wanted to keep its simply and export the data to CSV.

To do this we can use the “Get-MessageTrackingLog” cmdlet, this command relies obviously on your message tracking logs being enabled and also that their are enough of them to actualy get the data out you would like. By default, the logs are enabled and go back 30 before being overwrote.

Increase Message Tracking Log length

If you would like to collect data beyond 30 days you can increase the retention of the logs with the followng command.

Set-TransportServer <Identity> -MessageTrackingLogMaxAge

This example changes the maximum age of a message tracking log file to 45 days on the Exchange 2010 computer Exchange01.

Set-TransportServer Exchange01 -MessageTrackingLogMaxAge 45.00:00:00

With that in mind we can run the following commands to extract the data we need.

Who Sends the Most Email from my Exchange Server

The script below requires editing based on the date rangers you would like to extract data from, it interogates the Message Tracking Logs for the Send Event ID and will then list how many times it occurs in that date range you specify doe the users. It also exports the data to CSV.

 Get-Exchangeserver|where{$_.site -match "Site in branch"}|Get-MessageTrackingLog -ResultSize unlimited -Start "20/06/2018" -End "20/06/2018" -EventId "send" |Group-Object -Property:sender |Select name,count -first 10|sort count -Descending | Export-CSV c:\exporteddata.csv

We can increase the ammount of users it lists by increasing the “first 10 to first whatever you like”

• Next
• Prev