How to setup a daily report of users which are sending more than a defined numer of email outside organization within 24h

Ornaldo 41 Reputation points
2021-08-20T13:11:25.947+00:00

I'm trying to create a script and schedule it on exchange in order to have a daily report for users which are sending more than a defined numer of email outside organization within 24h.

I found this similar script but it is not the same scenario as the one i'm trying. Also i'm using Exchange 2016:

add-pssnapin Microsoft.Exchange.Management.PowerShell.E2010

$output = Get-TransportServer | Get-MessageTrackingLog -Start (get-date).AddDays(-1) -EventID "SEND" -ResultSize Unlimited | Group-Object -Property Sender | %{ New-Object psobject -Property @{Sender=$.Name;Recipients=($.Group | Measure-Object RecipientCount -Sum).Sum}} | Where-Object {$_.Recipients -gt 100} | Sort-Object -Descending Recipients | Format-Table -AutoSize Sender,Recipients | Out-String

Send-MailMessage -From sysadmins@ssss .com -Subject "Exchange senders report: $(Get-Date -UFormat '%a, %D')" -To sysadmins@ssss .com -Body $output -SMTP mail.example.com

Exchange Server Management
Exchange Server Management
Exchange Server: A family of Microsoft client/server messaging and collaboration software.Management: The act or process of organizing, handling, directing or controlling something.
7,356 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Kael Yao-MSFT 37,496 Reputation points Microsoft Vendor
    2021-08-23T08:36:12.65+00:00

    Hi @Ornaldo

    I found this similar script but it is not the same scenario as the one i'm trying.

    This script would export not only the emails sent to external but also the emails sent to internal.
    I suppose this is the point.

    I have modified the script to filter only the external emails, please check if it can meet your need. 

    Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn  
$output = Get-TransportServer | Get-MessageTrackingLog -Start (get-date).AddDays(-1) -ResultSize Unlimited | where{$_.EventId -eq "SEND" -or $_.EventId -eq "SENDEXTERNAL" -and $_.Recipients -notlike "*@contoso.com*"}  
$result = $output | Group-Object -Property Sender  
$report = $result | %{ New-Object psobject -Property @{Sender=$_.Name;Recipients=($_.Group | Measure-Object RecipientCount -Sum).Sum}} | Where-Object {$_.Recipients -gt 100} | Sort-Object -Descending Recipients | Format-Table -AutoSize Sender,Recipients | Out-String  
Send-MailMessage -From admin@contoso.com -Subject "Exchange senders report: $(Get-Date -UFormat '%a, %D')" -To report@contoso.com -Body $report -SMTPserver smtp.contoso.com

    If the response is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.