Exchange Transport Rule - Auditing Last Execution

Question

I am trying to determine if there is a way with Powershell that I can audit transport rules that may no longer have activity. I see in the admin center a column called "last execution". Is there a way to get this VIA Powershell?

Answer 1

Hello,

Unfortunately, I don't have any further troubleshooting to offer.

Many knowledgeable users are active on the forum, and I hope someone else can offer further insight into your issue.

Thanks.

Ajibola.

Answer 2

Yeah, I tried that one. Did not see a way to get the "last executed" results.

Answer 3

Hello,

It seems that this cmdlet is not available in the cloud-based service, but only in on-premises Exchange. If you are using Exchange Online, you can use the Get-MailDetailTransportRuleReport cmdlet instead, which can provide similar information about the messages that match the transport rules in your organization.

Note: You might need to translate the page content in the link shared below.

https://learn.microsoft.com/powershell/module/exchange/get-maildetailtransportrulereport?view=exchange-ps

If you have any further questions or need additional assistance, please feel free to ask. I'm here to help!

Give back to the Community. Help the next person with this issue by indicating if this reply solved your problem. Click Yes or No below.

Kind regards.

Ajibola.

Answer 4

Get-TransportRuleStatistics seems like the command that would get what I am looking for but does not appear to be a valid Powershell command.

Answer 5

Greetings! I am Ajibola, and I am eager to assist you with confidence and assertiveness. I guarantee to provide you with exceptional support.

You can use the Get-TransportRule cmdlet to get a list of all transport rules in your organization. Then, you can use the Get-MailDetailTransportRuleReport cmdlet to get a report of the actions and events associated with each rule. You can filter the report by date, sender, recipient, or rule name. You can also use the Get-MessageTrace and Get-MessageTraceDetail cmdlets to get more information about the messages that triggered the rules.

You can use the Get-AdminAuditLogConfig cmdlet to get the configuration settings for the administrator audit log. This log records any changes made to the transport rules by administrators or users who have been assigned administrative privileges. You can use the Search-AdminAuditLog cmdlet to search for and view specific actions, based on Exchange Online PowerShell cmdlets, performed by these users. You can filter the search by date, user, object, or cmdlet.

You can use the Get-TransportRuleStatistics cmdlet to get statistics for the transport rules in your organization. This cmdlet returns information such as the name, identity, priority, state, and last hit time of each rule. The last hit time indicates the last time the rule was applied to a message. You can use this information to identify the rules that may no longer have activity.

Note: You might need to translate the page content in the link shared below.

https://learn.microsoft.com/powershell/module/exchange/get-transportrule?view=exchange-ps

https://learn.microsoft.com/exchange/security-and-compliance/mail-flow-rules/manage-mail-flow-rules

If you have any further questions or need additional assistance, please feel free to ask. I'm here to help!

Give back to the Community. Help the next person with this issue by indicating if this reply solved your problem. Click Yes or No below.

Kind regards.

Ajibola.