This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(144, 88%, 23%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMQ%3C/text%3E%3C/svg%3E)
How to get the list of recipients along with the number of quarantine emails received by them in last 30 days.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(137.6, 91%, 23%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJR%3C/text%3E%3C/svg%3E)
To obtain the list of recipients along with the number of quarantine emails they have received in the last 30 days, you will need to access the quarantine management system or email security solution that you are using. The specific steps may vary depending on the system or solution you have in place. Here is a general process you can follow:
Access your quarantine management system or email security solution. This could be a web-based interface or a dedicated software application provided by your email security provider.
Look for options related to quarantine management or reporting. This is where you can typically find information about quarantined emails and recipient statistics.
Navigate to the reporting section or quarantine reports within your system.
Locate the option to generate a report based on recipient activity or quarantine emails.
Configure the report parameters to filter the data for the last 30 days.
Select the desired data fields to include in the report, such as recipient email addresses and the count of quarantine emails.
Initiate the report generation process.
Once the report is generated, review the results to obtain the list of recipients and the corresponding number of quarantine emails they have received within the last 30 days.
It's important to note that the specific steps and options may vary depending on the quarantine management system or email security solution you are using. Consult the documentation or support resources provided by your email security provider for detailed instructions specific to your setup.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(3.2, 23%, 10%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EDL%3C/text%3E%3C/svg%3E)
Hi @Microsoft Q & A
You can try to run the following command, it will list all recipients and quarantined emails from last 30 days.
Get-QuarantineMessage -StartReceivedDate (Get-Date).AddDays(-30) | Group-Object -Property RecipientAddress | Select-Object Name,Count | Export-Csv -Path .\quarantined.csv
For more details please check the link below.
https://learn.microsoft.com/en-us/powershell/module/exchange/get-quarantinemessage?view=exchange-ps
Best Regards,
Dezhi
If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation](https://aka.ms/msftqanotifications)"https://aka.ms/msftqanotifications)") to enable e-mail notifications if you want to receive the related email notification for this thread.
It is giving output for only 1 recipient. do we have any KQL query for advance hunting and we can get the output from there.
Hi @Microsoft Q & A
You can try the following script to figure out how many quarantine email each recipient has.
$StartDate = (Get-Date).AddDays(-30)
$QuarantineMessages = Get-QuarantineMessage -StartReceivedDate $StartDate
$RecipientStats = @{}
foreach ($Message in $QuarantineMessages) {
foreach ($Recipient in $Message.RecipientAddress) {
if ($RecipientStats.ContainsKey($Recipient)) {
$RecipientStats[$Recipient]++
} else {
$RecipientStats[$Recipient] = 1
}
}
}
$RecipientStats.GetEnumerator() | Sort-Object -Property Value -Descending | Format-Table -Property Name, Value -AutoSize
For more details please check the link below.
Manage quarantined messages and files as an admin | Microsoft Learn.
Get-QuarantineMessage (ExchangePowerShell) | Microsoft Learn.
Best Regards,
Dezhi
This command is not giving the correct details. I have cross checked for all recipients. For one user only it is showing more than 1 count and for rest users the value is only 1. It is even not closer to any value for any recipient. It is providing completely wrong values.
Hi @Microsoft Q & A,
Could you please provide a screenshot of the script running results, you can hide your sensitive data.
In my environment it gives me the number of quarantined emails for all recipients.
Best Regards,
Dezhi
please find the details.
Hi @Microsoft Q & A
When you run Get-QuarantineMessage -StartReceivedDate (Get-Date).AddDays(-30) | select-Object RecipientAddress,subject do you get all quarantined emails from the last 30 days?
Best Regards,
Dezhi
No, it is not giving all the quarantined emails. My organization is big..we are getting around 10-15k emails on the daily basis. Your command and script is giving the out for just only 100-200 emails.
Hi @Microsoft Q & A,
This can involve pagination issues if you have a large number of quarantined messages.
You can try the following script again, because we don't focus on script support, we can help you add tags for powershell and exchange server development. Thank you for your understanding.
$StartDate = (Get-Date).AddDays(-30)
$Page=1
$RecipientStats = @{}
do{
$QuarantineMessages = Get-QuarantineMessage -StartReceivedDate $StartDate -Page $Page
$Page++
if($QuarantineMessages){
foreach ($Message in $QuarantineMessages) {
foreach ($Recipient in $Message.RecipientAddress) {
if ($RecipientStats.ContainsKey($Recipient)) {
$RecipientStats[$Recipient]++
} else {
$RecipientStats[$Recipient] = 1
}
}
}
}
}while($QuarantineMessages.count -ne 0)
$RecipientStats.GetEnumerator() | Sort-Object -Property Value -Descending | Format-Table -Property Name, Value -AutoSize
Best Regards,
Dezhi