Skip to main content

WizBang Exchange 2007 Message Tracking Powershell Gui Version 1

Unlocking the secrets from the depths of the Message Tracking Logs is an ever recurring theme on this blog and in general an important area of Exchange Server Management. In this latest incarnation we boldly go where no Message Tracking application has gone before as well as the normal aggregation, graphing and exports bits and pieces. The new functionality this script introduces expands on post I was talking about a couple of weeks ago which is Using Exchange Web Services to Enhance Exchange Message Tracking. So what we end up is a GUI that does aggregation and filtering and then the ability to look at the content of a particular message by using EWS to find the message based on its message-ID and then being able to see the Subject,Body and then export attachments or the whole message as an EML file. As this is version one i haven't quite go around to making the message search do a Deleted Item Scan (Dumpster Dive) and there is also an issue with Sent Items where the Clients in using Outlook in Cache mode. This is because when you are using Outlook in Cached Mode Items saved to the Sent Items receive a different MessageID which is described in this KB. So this mean you cant find messasges that where sent if the client is using Outlook in Cache mode (if the mesage was sent internally you would be able to get if from the Inbox of the recipient).

This script produces a Multi-Tabbed Winform with different functionality provided by each tab

  1. Tab1 - Setup tab this allows you to specify the parameter for the search of the message tracking logs
  2. Tab2 - Graphs and Summarised tables this tab shows some Google chart's graphs of the Last 6 hours of Message Tracking activity. Graphs of the total Aggregates of Internal/External and Sent/Received Messages. Last hour top 5 Message Sent/Receivers and Organization Totals
  3. Tab3 - Email Summaries per Internal User for Internal Sent/Receive, External Sent/Received and the ability to show the section of the Message Tracking logs for those particular messages. Also Find these message from these filtered Tracking logs via EWS and the Tab5 message Find function. (expot to csv for filtering and aggregated logs)
  4. Tab4 - Raw Message Tracking view
  5. Tab5 - EWS Message Find tab This use EWS to find messages based on message ID invoked from Tab 3 (show message button). Allows export of attachments and message to eml.
To do the search of the Message Tracking logs the script using the get-messagetrackinglogs Exchange powershell cmdlet to return all the Logs entries and then filters based on Send and Receive Entries. To ensure that a log entry is not counted twice the recipients of a message are expanded and a Hastable is used to ensure that the combination of MessageID-Sender and Recipient isn't counted more then once. Being version one this process hasn't been well test so there are probably lots of bugs with this method but so far it seems to work okay.

The graphing functions are provided using Google charts online service and a winform picture control which is the method I've described in the past. The one issue with the method is that it does require that you have a direct Internet connection from the client (eg NAT etc). If your going out through proxies then generally you may see that the graphs don't draw properly this is because the Picture control cant deal with Internet proxies.

The aggregate functions are all done through using a combination of hashtable and custom powershell objects.

The EWS Find functionality is done using the EWS powershell library which i've been using a fair bit and changing and adding more bits and pieces too. The library will handle Autodiscover and allow for both delegate and impersonation access method. The Form allows for all of these combinations and also allows you to specify overrides for both authentication and the URL for the CAS server to use (you need to use the full url to the EWS if you going to use eg https://servername/ews/exchange.asmx).

To use EWS find message function you need a copy of the EWSUtil.dll in c:\temp you can download this from here. You also need rights on the mailboxes you are searching either via delegation or Impersonation.

I've put a download of the script here the code itself is a little large to post.
Labels:

Popular posts from this blog

The MailboxConcurrency limit and using Batching in the Microsoft Graph API

If your getting an error such as Application is over its MailboxConcurrency limit while using the Microsoft Graph API this post may help you understand why. Background   The Mailbox  concurrency limit when your using the Graph API is 4 as per https://docs.microsoft.com/en-us/graph/throttling#outlook-service-limits . This is evaluated for each app ID and mailbox combination so this means you can have different apps running under the same credentials and the poor behavior of one won't cause the other to be throttled. If you compared that to EWS you could have up to 27 concurrent connections but they are shared across all apps on a first come first served basis. Batching Batching in the Graph API is a way of combining multiple requests into a single HTTP request. Batching in the Exchange Mail API's EWS and MAPI has been around for a long time and its common, for email Apps to process large numbers of smaller items for a variety of reasons.  Batching in the Gr...
Read more

Sending a Message in Exchange Online via REST from an Arduino MKR1000

This is part 2 of my MKR1000 article, in this previous post  I looked at sending a Message via EWS using Basic Authentication.  In this Post I'll look at using the new Outlook REST API  which requires using OAuth authentication to get an Access Token. The prerequisites for this sketch are the same as in the other post with the addition of the ArduinoJson library  https://github.com/bblanchon/ArduinoJson  which is used to parse the Authentication Results to extract the Access Token. Also the SSL certificates for the login.windows.net  and outlook.office365.com need to be uploaded to the devices using the wifi101 Firmware updater. To use Token Authentication you need to register an Application in Azure https://msdn.microsoft.com/en-us/office/office365/howto/add-common-consent-manually  with the Mail.Send permission. The application should be a Native Client app that use the Out of Band Callback urn:ietf:wg:oauth:2.0:oob. You ...
Read more

How to test SMTP using Opportunistic TLS with Powershell and grab the public certificate a SMTP server is using

Most email services these day employ Opportunistic TLS when trying to send Messages which means that wherever possible the Messages will be encrypted rather then the plain text legacy of SMTP.  This method was defined in RFC 3207 "SMTP Service Extension for Secure SMTP over Transport Layer Security" and  there's a quite a good explanation of Opportunistic TLS on Wikipedia  https://en.wikipedia.org/wiki/Opportunistic_TLS .  This is used for both Server to Server (eg MTA to MTA) and Client to server (Eg a Message client like Outlook which acts as a MSA) the later being generally Authenticated. Basically it allows you to have a normal plain text SMTP conversation that is then upgraded to TLS using the STARTTLS verb. Not all servers will support this verb so if its not supported then a message is just sent as Plain text. TLS relies on PKI certificates and the administrative issue s that come around certificate management like expired certificates which is why ...
Read more
All sample scripts and source code is provided by for illustrative purposes only. All examples are untested in different environments and therefore, I cannot guarantee or imply reliability, serviceability, or function of these programs.

All code contained herein is provided to you "AS IS" without any warranties of any kind. The implied warranties of non-infringement, merchantability and fitness for a particular purpose are expressly disclaimed.