PowerShell

---

Hi I was wondering if anyone can assist in setting up a script that will export last three months worth of emails that have hit the mailbox (inbox) to a CSV file?

Hello @Waqkas-Ahmed ,

Are you using Exchange? What version are you running?

Hi Mike, Yes, we are using Exchange 2010 with Office365

@mike-rodrick Any ideas on how we can create the script?

Waqkas are you just wanting tracking information? Date/Time Received, sender, recipient, subject etc?

@david-parkes yes that's right.

@Waqkas-Ahmed

I'm not the Exchange guy, but I will try to find some time to set up a test lab and see what I can do. In the meantime, take a look at these cmdlets to get you started:

For an on-premise Exchange Server
Get-MessageTrackingLog -Recipients mike@itpro.tv

For Exchange Online
Get-MessageTrace -RecipientAddress mike@itpro.tv

Mike pointed you in the right direction. Its pretty easy to work out how to script this. You need a get, a sort, and publish command.

........... however why invent the wheel. Have a look at this script which is available on the technet site. I'm sure I've ran this against Exchange 2010.

https://gallery.technet.microsoft.com/office/Exchange-2013-Message-875b3eeb

I would however urge you to look at how to build basic scripts.

@mike-rodrick I have setup the following script;

Get-MessageTrace -RecipientAddress email@123.com -StartDate 01/01/2018 -EndDate 08/22/2018 | Export-Csv C:\report.csv

I get the following error; The StartDate can't be greater than 30 days from today.

I need to export last 6 month worth of emails that have hit the Inbox.

I have also tried the following;

Start-HistoricalSearch -ReportTitle "Support Search" -StartDate 02/01/2018 -EndDate 08/22/2018 -ReportType MessageTrace -RecipientAddress | Export-Csv C:\report.csv

But get the following error; Specify a parameter of type 'System.Object' and try again. '-RecipientAddress'

Have you tried the utility i have suggested in the comment above?

@david-parkes We don't have this setup.

I need a PowerShell script that I can run in our Dirsync server (msonline)

Waqkas,

I hope all is well. Since you re using Exchange 2010, PowerShell may not be the best way to go about this directly. I would suggest to you that a better way to about this would be to use the Import/Export cmdlets specific to Exchange 2010.

Take a look at this url:

https://docs.microsoft.com/en-us/previous-versions/office/exchange-server-2010/ee633455(v=exchg.141)

Focus on the Export cmdlets at the bottom of the web page. Let me know if you have any questions once you take a look.

Cheers,

Adam

@adam-gordon I'm testing this against Office 365 at the moment.

I have the following setup;

Start-HistoricalSearch -ReportTitle "Support Search" -StartDate 05/26/2018 -EndDate 08/24/2018 -ReportType MessageTrace -RecipientAddress email@123.co.uk : Export-Csv C:\report.csv

This exports a csv file but does not have all the data exported, just the tabs.

@waqkas-ahmed said in PowerShell:

Start-HistoricalSearch

Waqkas,

I hope all is well. I think that you have 1 of 2 issues with the syntax for the Start-HistoricalSearch cmdlet above.

1. It could be a permissions issue that is preventing the export of the actual data, but I am not too confident that this is the issue. You should check the permissions associated with the account being used to execute the script and ensure that you have full permissions for Exchange as an administrator.

2. the other issue could be that the last part of the cmdlet syntax : Export-Csv C:\report.csv may be the issue.

Take a look at the following, if you have not already done so:

https://docs.microsoft.com/en-us/powershell/module/exchange/mail-flow/start-historicalsearch?view=exchange-ps

I am not sure if the syntax to export is correct, and as a result, I think that may be causing the issue. It does not appear as if the syntax you are using is supported according to the documentation.

I would read through the documentation and perhaps switch your solution to match the example in the documentation, attempting to use a notification e-mail address instead of the export-csv output and see if that helps.

Hi @Waqkas-Ahmed

One thing that I'm not seeing anyone mentioning here or asking about is if the mailbox you are looking to get this information for is on prem, or if it's in O365.

You had specified that you are in a hybrid O365 config with Exchange 2010 on prem. In my experience, most organizations that have this setup have the majority of the mailboxes in O365, and the on prem Exchange server is mainly a management box.

If that's the case and the mailbox you are looking to get information on is in O365, then your local Exchange server isn't going to have what you're looking for. You'll want to connect to O365 via PowerShell and use the get-messagetrace command as your starting point, or you can probably just use the O365 Exchange Admin Centre, or Security and Compliance Centre to get the info you're looking for. If you use the Security and Compliance centre you can export the results to CSV, and I believe that you can download a CSV via the Exchange Admin Centre GUI on message traces dealing with items greater than 7 days old as well.

The trace will take a while since you're going back further than 10 days, I generally run it and then grab it the next day. There are some enhanced traces you can do if the default doesn't have what you're looking for. I seem to remember that there is some limit to how far back you can go, but I don't remember exactly what that limit is and I'm having some trouble tracking it down right now, you can definitely do the last 90 days though.

Here's some articles to help you out:

Message trace article from MS: https://docs.microsoft.com/en-us/exchange/monitoring/trace-an-email-message/run-a-message-trace-and-view-results

Using Security and Compliance Centre to do a message trace: https://support.office.com/en-us/article/message-trace-in-the-office-365-security-compliance-center-3e64f99d-ac33-4aba-91c5-9cb4ca476803

Message trace FAQ including all related powershell commands: https://docs.microsoft.com/en-us/exchange/monitoring/trace-an-email-message/message-trace-faq

How to connect to O365 via powershell: https://docs.microsoft.com/en-us/powershell/exchange/exchange-online/connect-to-exchange-online-powershell/connect-to-exchange-online-powershell?view=exchange-ps

Hope this helps you get what you need.