Tracking an internal email?

[JBruyet]

Hey all, is there a way to track an internal email to see if it had been seen and then deleted by the recipient? I don't have any auditing or tracking turned on and this is for an email that was sent last week.

Thanks,

Joe B

 

[LePivert]

(If this is not too late...)

Message Tracking should be enabled by default. So unless you disabled it (intentionally) for some reason, you should be able to see if the message was DELIVERED. SEEN is another matter (and DELETED).

Open EMC (Management Console)
Toolbox
Mail Flow Tools
Message Tracking

Enter the Recipient email address
Select the "Receive" option

Doing this, I can see messages that where delivered to me but that I deleted later (that are no longer in my inbox).

If you can logon as the user, you could look for the message in deleted items or in "Recover Deleted items" under "Tools" in Outlook (assuming Outlook is being used - there's something comparable in OWA).

You might be able to see all this from the server end, but I'm not sure how. I don't believe a cmdlet like Get-mailBoxFolderStatistics would show anything but the number of messages in various folders (and not the messages themselves).

 

[LePivert]

You might want to use the Deliver option to see which messages were delivered to the mailbox.

Receive and deliver are similar but not quite the same.

 

[JBruyet]

Thanks LePivert, I'll check it out.

Thanks,

Joe B

 

[58sniper]

And you can never prove that a user saw/read a message. Only that it was opened.

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.exchangeblogs.com/

 

[JBruyet]

--> 58sniper, hmmm... good point. And after telling people to not open emails that look suspicious or don't have recognizable FROM addresses I guess that could be his out too.

Thanks,

Joe B