Message Trace

Question

Hi All

One of my user user1@Company portal .com has sent an email to a DL. The users who are members of the DL have received the email. Some DL members have forwarded those emails to other users. I want to get the report of the users who have forwarded the emails to other users, How can i fetch this report. i am using below syntax but i am getting error please guide me.

Start-HistoricalSearch -ReportTitle "MT1" -MessageSubject "TEST1" -ReportType MessageTraceDetail -StartDate 10/01/2021 -EndDate 10/12/2021 -NotifyAddress "myuser@Company portal .com"

Answer 1

Hi @Roger Roger

According to the link, "MessageSubject" isn't an available parameter when using the Start-HistoricalSearch command.
And you may also need to specify a value to the SenderAddress or RecipientAddress or MessageID parameter to create this search.

In this case, I suppose you may need to pull all the messages sent by the users in your tenant (you can add *@Company portal .com to the SenderAddress parameter)
And then filter the result with the specific message subject.
For forwarded messages, by default the subject should be "FW: TEST1".

In addition, it can also be done using the Message trace feature in Exchange Admin Center.
Here is the direct link to it: https://admin.exchange.microsoft.com/#/messagetrace

---

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.