Report of all Emails sent from a single IP

I recently needed to generate a report of all emails sent from a single application that I knew was the only application sending from a unique IP address.  Initial attempts lead to some problems getting the recipients email address into the csv export, until I found this blog post from the exchange team.

Here is the powershell command I used to filter by clientIP

Get-MessageTrackingLog -ResultSize unlimited -Start "4/8/2013 12:00AM" -End "7/8/2013 11:59PM" | Select Timestamp,  messagesubject, sender, {$_.recipients}, Clientip, {$_.recipientsstatus} | Where {$_.ClientIp -eq ''} | Export-CSV C:reports.csv


1 comment

  1. great blog
    do you know how i could look at which mailbox is syncing like: IP address/hostname or email address
    i have this problem where mail sync is using most of my bandwidth which is coming from outside via our internet facing CAS server. We want to figure out who that person is therefore my humble request

Leave a Reply

Your email address will not be published. Required fields are marked *