4

When executing:

Get-MessageTrackingLog -sender <sender> -Start <date> |
  Select TimeStamp,EventID,Source,Sender,
      @{Name='Recipients';Expression={ [string]::join(";",($_.Recipients))}},MessageSubject |
  Export-csv <path>

the output expands the alleged DG(s) into a long list of recipients. Why? I want to see the DG(s) rather than the recipients.

Note: I say 'alleged', because I do not know for certain whether a DG was used or not, however common sense tells me the CEO did not keep a running list of all ~1K employees and type them, nor decided to expand the DG in his message.

1 Answers1

0

If a message was sent to DG, then there is a record with EventID 'Expand' in a tracking log. Events before this record show DG address in recipients field.

Vadim
  • 636