Skip to main content

WizBang Exchange 2007 Message Tracking Powershell Gui Version 1

Unlocking the secrets from the depths of the Message Tracking Logs is an ever recurring theme on this blog and in general an important area of Exchange Server Management. In this latest incarnation we boldly go where no Message Tracking application has gone before as well as the normal aggregation, graphing and exports bits and pieces. The new functionality this script introduces expands on post I was talking about a couple of weeks ago which is Using Exchange Web Services to Enhance Exchange Message Tracking. So what we end up is a GUI that does aggregation and filtering and then the ability to look at the content of a particular message by using EWS to find the message based on its message-ID and then being able to see the Subject,Body and then export attachments or the whole message as an EML file. As this is version one i haven't quite go around to making the message search do a Deleted Item Scan (Dumpster Dive) and there is also an issue with Sent Items where the Clients in using Outlook in Cache mode. This is because when you are using Outlook in Cached Mode Items saved to the Sent Items receive a different MessageID which is described in this KB. So this mean you cant find messasges that where sent if the client is using Outlook in Cache mode (if the mesage was sent internally you would be able to get if from the Inbox of the recipient).

This script produces a Multi-Tabbed Winform with different functionality provided by each tab

  1. Tab1 - Setup tab this allows you to specify the parameter for the search of the message tracking logs
  2. Tab2 - Graphs and Summarised tables this tab shows some Google chart's graphs of the Last 6 hours of Message Tracking activity. Graphs of the total Aggregates of Internal/External and Sent/Received Messages. Last hour top 5 Message Sent/Receivers and Organization Totals
  3. Tab3 - Email Summaries per Internal User for Internal Sent/Receive, External Sent/Received and the ability to show the section of the Message Tracking logs for those particular messages. Also Find these message from these filtered Tracking logs via EWS and the Tab5 message Find function. (expot to csv for filtering and aggregated logs)
  4. Tab4 - Raw Message Tracking view
  5. Tab5 - EWS Message Find tab This use EWS to find messages based on message ID invoked from Tab 3 (show message button). Allows export of attachments and message to eml.
To do the search of the Message Tracking logs the script using the get-messagetrackinglogs Exchange powershell cmdlet to return all the Logs entries and then filters based on Send and Receive Entries. To ensure that a log entry is not counted twice the recipients of a message are expanded and a Hastable is used to ensure that the combination of MessageID-Sender and Recipient isn't counted more then once. Being version one this process hasn't been well test so there are probably lots of bugs with this method but so far it seems to work okay.

The graphing functions are provided using Google charts online service and a winform picture control which is the method I've described in the past. The one issue with the method is that it does require that you have a direct Internet connection from the client (eg NAT etc). If your going out through proxies then generally you may see that the graphs don't draw properly this is because the Picture control cant deal with Internet proxies.

The aggregate functions are all done through using a combination of hashtable and custom powershell objects.

The EWS Find functionality is done using the EWS powershell library which i've been using a fair bit and changing and adding more bits and pieces too. The library will handle Autodiscover and allow for both delegate and impersonation access method. The Form allows for all of these combinations and also allows you to specify overrides for both authentication and the URL for the CAS server to use (you need to use the full url to the EWS if you going to use eg https://servername/ews/exchange.asmx).

To use EWS find message function you need a copy of the EWSUtil.dll in c:\temp you can download this from here. You also need rights on the mailboxes you are searching either via delegation or Impersonation.

I've put a download of the script here the code itself is a little large to post.

Popular posts from this blog

Downloading a shared file from Onedrive for business using Powershell

I thought I'd quickly share this script I came up with to download a file that was shared using One Drive for Business (which is SharePoint under the covers) with Powershell. The following script takes a OneDrive for business URL which would look like https://mydom-my.sharepoint.com/personal/gscales_domain_com/Documents/Email%20attachments/filename.txt This script is pretty simple it uses the SharePoint CSOM (Client side object Model) which it loads in the first line. It uses the URI object to separate the host and relative URL which the CSOM requires and also the SharePointOnlineCredentials object to handle the Office365 SharePoint online authentication. The following script is a function that take the OneDrive URL, Credentials for Office365 and path you want to download the file to and downloads the file. eg to run the script you would use something like ./spdownload.ps1 ' https://mydom-my.sharepoint.com/personal/gscales_domain_com/Documents/Email%20attachments/filena

Export calendar Items to a CSV file using EWS and Powershell

Somebody asked about this last week and while I have a lot of EWS scripts that do access the Calendar I didn't have a simple example that just exported a list of the Calendar events with relevant information to a CSV file so here it is. I've talked on this one before in this howto  but when you query the calendar folder using EWS you need to use a CalendarView which will expand any recurring appointments in a calendar. There are some limits when you use a calendarview in that you can only return a maximum of 2 years of appointments at a time and paging will limit the max number of items to 1000 per call. So if you have a calendar with a very large number of appointments you need to break your query into small date time blocks. In this example script I'm just grabbing the next 7 days of appointments if you want to query a longer period you need to adjust the following lines (keeping in mind what I just mentioned) #Define Date to Query $StartDate = (Get-Date) $EndDate

How to test SMTP using Opportunistic TLS with Powershell and grab the public certificate a SMTP server is using

Most email services these day employ Opportunistic TLS when trying to send Messages which means that wherever possible the Messages will be encrypted rather then the plain text legacy of SMTP.  This method was defined in RFC 3207 "SMTP Service Extension for Secure SMTP over Transport Layer Security" and  there's a quite a good explanation of Opportunistic TLS on Wikipedia  https://en.wikipedia.org/wiki/Opportunistic_TLS .  This is used for both Server to Server (eg MTA to MTA) and Client to server (Eg a Message client like Outlook which acts as a MSA) the later being generally Authenticated. Basically it allows you to have a normal plain text SMTP conversation that is then upgraded to TLS using the STARTTLS verb. Not all servers will support this verb so if its not supported then a message is just sent as Plain text. TLS relies on PKI certificates and the administrative issue s that come around certificate management like expired certificates which is why I wrote th
All sample scripts and source code is provided by for illustrative purposes only. All examples are untested in different environments and therefore, I cannot guarantee or imply reliability, serviceability, or function of these programs.

All code contained herein is provided to you "AS IS" without any warranties of any kind. The implied warranties of non-infringement, merchantability and fitness for a particular purpose are expressly disclaimed.