Track use of distribution groups

Question

question

GarethDavies-6974 asked Dec 11, '20 EnterpriseArchitect commented Feb 24, '22

Track use of distribution groups

I am in the process of cleaning up an inherited AD setup. Previous admins (and managers for that matter) did not follow any of the recommended standards when it came to structure so it is challenging.
Part of this clean up is establishing if distribution groups and mail enabled security groups are being used for email. Problem is, if I try to search for messages sent to these groups using message trace they all come back saying nothing has been sent to them, even though I know I have sent test messages to some of them.
I went into Powershell and tried using Get-MessageTrace and Get-MessageTrackingLog but I get weird results.
Get_MessageTrace returns the same number for every group, Get-MessageTrackingLog returs zero for every group. Message Tracking log is enabled.

The code I am using is: Get-MessageTrackingLog -start "12/01/2020 12:00:00" -End "12/10/2020 12:00:00" -Recipients "group email address" | measure-object
Results for this:
even though I have sent several test messages to the target group used to test the code

and Get-MessageTrace -Status expanded -startdate (get-date).AddDays(-10) -EndDate (Get-Date) | group <group email address> | select name,count

Results:

This number changed depending on the number of days, but EVERY group gives the exact same result, even a test group I created yesterday that only I am a member of that has received zero email

What am I missing here?

windows-server-powershell office-exchange-server-administration office-exchange-server-mailflow

image.png (2.5 KiB)

image.png (777 B)

· 3

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

RichMatheisen-8856 · Dec 11, 2020 at 07:47 PM

Remove the -Recipients parameter and use -EventID instead. Look for EXPAND event IDs and then see what you get. You can check the data in the columns of the file and fine-tune your parameter set using what you find.

I retired six years ago and haven't touched an Exchange server since then, so things are growing dimmer -- but are you using the SMTP address of the group in question as the "<group email address>"?

1 ·

GarethDavies-6974 RichMatheisen-8856 · Dec 11, 2020 at 08:30 PM

I'm not sure I understand how this would help.
Removing the -Recipients parameter would mean I get results for all groups, number of messages received by any group in the timeframe I specify, which would be of no use. Without setting the results limit above the default 1000 all it does is return the number 1000. I am looking for the use of specific groups so I have to use -Recipients or at least filter it in some way
Yes, I am using the smtp address

1 ·

EnterpriseArchitect GarethDavies-6974 · Feb 24 at 01:49 AM

Yes, me too, I'm facing the issue with the result always returning 1000

0 ·

image.png (25.2 KiB)

Answer 1 · 2020-12-13T08:23:42.427Z

AshokM-8240 answered Dec 13, '20 AshokM-8240 commented Dec 15, '20

Hi,

Are you using Exchange server on-premise or office 365?

For Exchange on-premise, please try the below command to check the number of emails sent to the distribution groups,

Get-TransportService | Get-MessageTrackingLog -Start <starttime> -End <endtime> | ? {$_.RelatedRecipientAddress -like "distributiongroup@domain.com"} | measure-object | fl count

Messagetrackinglog maxage is 30days by default. To increase, please check https://docs.microsoft.com/en-us/exchange/mail-flow/transport-logs/configure-message-tracking?view=exchserver-2019

For Office365,

Get-MessageTrace -StartDate <starttime> -EndDate <endtime> -RecipientAddress "distributiongroup@domain.com" | measure-object | fl count

Get-MessageTrace will return results for 10days in Office365 and to get data for 90 days, use Start-HistoricalSearch and Get-HistoricalSearch. Alternatively, Message trace under Security & Compliance Center can be used to retrieve results for 90days.

Start-HistoricalSearch -ReportTitle "DL Name" -StartDate MM/DD/YYYY -EndDate MM/DD/YYYY -ReportType MessageTrace -RecipientAddress DLemailaddress -NotifyAddress admin@yourdomain.com

Get-HistoricalSearch

Message trace in the Security & Compliance Center:
https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/message-trace-scc?view=o365-worldwide

If the above suggestion helps, please click on "Accept Answer" and upvote it

· 1

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

AshokM-8240 · Dec 15, 2020 at 06:25 AM

Hi,

Just to check if there are any updates. If the above suggestion helps, please click on "Accept Answer" and upvote it. Thanks for understanding.

0 ·

Answer 2 · 2020-12-14T06:47:16.413Z

YukiSun-MSFT answered Dec 14, '20 YukiSun-MSFT commented Dec 17, '20

Hi @GarethDavies-6974,

As far as I know, Get-MessageTrackingLog is available only in on-premises Exchange while the Get-MessageTrace cmdlet only works in the cloud-based service, so are you in a Hybrid setup with both Exchange Online and the on-prem Exchange in your environment?

If this describes your situation, based on my research, it's recommended to use message trace. I tried to run the get-messagetrace command in your post and it seems to me that the returned count is the number of emails sent to all the distribution lists. The command provided above by AshokM works at my end:

 Get-MessageTrace -StartDate (get-date).AddDays(-10) -EndDate (Get-Date)-RecipientAddress <group email address> | measure-object | fl count

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

1.png (7.2 KiB)

· 1

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

YukiSun-MSFT · Dec 17, 2020 at 04:36 AM

@GarethDavies-6974,
I'd like to follow up to see if you have had a chance to read the replies above. Feel free to post back if you still have further questions on this. Thanks.

0 ·

question