Exchange MessageTrackingLogs get recipients list

From time to time we need to get a list of all persons to whom the email was sent with a given subject.

The list of recipients in a fairly simple way we can get from the transaction logs which are located on Exchange servers with HT roles.

Of course, before you do this, you have to configure your environment so that the transaction logs are kept for a few days on the servers.

The following script returns a list of recipients to whom the email was sent with the subject “Test mail”, but we are interested in the time of dispatch of the last day.

Number of days is defined in $DAYS and subject in $SUBJECT.

Script you can find below:

Add-PSSnapin Microsoft.Exchange.Management.PowerShell.E2010
Set-AdServerSettings -ViewEntireForest $True

$DAYS = 1
$SUBJECT = "*Test email*"

$msg = Get-TransportServer | Get-MessageTrackingLog -resultsize unlimited -start (get-date).adddays(-$DAYS) -end (get-date) -EventId Receive | ? {$_.source -eq "STOREDRIVER" -and $_.messagesubject -like $SUBJECT} | Select recipients

foreach($email in $msg){
 $tmp+= $email.recipients
}

$recipients = $tmp | group-object | select name

Write-Host "Recipients: $($recipients.count)"
Write-Host "Recipients list:"
$recipients

First we search logs for specified emails with subject.
Then we get all recipients of those emails and save them in variable $tmp.

Because sometimes we can get repeated recipients, we need to group recipients to get list of unique recipients stored in $recipients

Of course, to further refine your search you can add the e-mail information by whom it was sent :

 $_.sender -like "user@domain.com"

so the line to search transaction logs can looks like below:

{$_.sender -like "user@domain.com" -and $_.source -eq "STOREDRIVER" -and $_.messagesubject -like $SUBJECT}

This script can be useful at the moment when someone will ask you for a list of all recipients of a particular e-mail, where they will be taken into account in the recipient internal or external.