Hi there - I was wondering if there's a way for me to run a report of all of my distribution list that had no activity for the past xx amount of days? The goal is to search for DLs that are no longer being utilized. Please advise. Cheers! DB

If you hae Exchange 2007 or 2010 you can find out how often they have been used within the history depth of your message tracking logs (usually 30 days) using get-messagetrackinglog from the EMS. If it's 2003, someone else will have to answer.[string](0..33|%{[char][int](46+("686552495351636652556262185355647068516270555358646562655775 0645570").substring(($_*2),2))})-replace " "

If you hae Exchange 2007 or 2010 you can find out how often they have been used within the history depth of your message tracking logs (usually 30 days) using get-messagetrackinglog from the EMS. If it's 2003, someone else will have to answer. [string](0..33|%{[char][int](46+("686552495351636652556262185355647068516270555358646562655775 0645570").substring(($_*2),2))})-replace " " Sorry I have Exch 2003. ... perhaps the same command will work dont you think? cheers!

Nope. They changed the format of the message tracking logs radically between Exchange 2003 and 2007. I'm afraid the Exchange 2007 cmdlets won't make any sense of them. You might try logparser. http://www.microsoft.com/downloads/en/details.aspx?FamilyID=890cd06b-abf8-4c25-91b2-f8d975cf8c07&displaylang=en I believe it will handle Exchange 2003 logs. In Exchange 2007/2010 you'd be looking for the Expand events. Here's the message tracking log reference for 2003: http://support.microsoft.com/kb/821905 but I don't see anything there that looks like it corresponds to the Expand events. You may be looking at searching for individual smtp addresses in the Message Transfer In events.[string](0..33|%{[char][int](46+("686552495351636652556262185355647068516270555358646562655775 0645570").substring(($_*2),2))})-replace " "

Nope. They changed the format of the message tracking logs radically between Exchange 2003 and 2007. I'm afraid the Exchange 2007 cmdlets won't make any sense of them. You might try logparser. http://www.microsoft.com/downloads/en/details.aspx?FamilyID=890cd06b-abf8-4c25-91b2-f8d975cf8c07&displaylang=en I believe it will handle Exchange 2003 logs. In Exchange 2007/2010 you'd be looking for the Expand events. Here's the message tracking log reference for 2003: http://support.microsoft.com/kb/821905 but I don't see anything there that looks like it corresponds to the Expand events. You may be looking at searching for individual smtp addresses in the Message Transfer In events. [string](0..33|%{[char][int](46+("686552495351636652556262185355647068516270555358646562655775 0645570").substring(($_*2),2))})-replace " " Can I use logparser pulling logs from a remote exchange server? If so can you please show me a sample command from my local machine to the remote exchange server by any chance? My exchange logs are shared via \\email-srv23\emailogs Cheers.

I'm afraid I don't have any Exchange 2003 servers left. You would be reading the raw logs files, so I don't see any reason (other than performance) it wouldn't work from a remote machine using a UNC path to the log files, but I don't have anything to give you and example from.[string](0..33|%{[char][int](46+("686552495351636652556262185355647068516270555358646562655775 0645570").substring(($_*2),2))})-replace " "

I'm afraid I don't have any Exchange 2003 servers left. You would be reading the raw logs files, so I don't see any reason (other than performance) it wouldn't work from a remote machine using a UNC path to the log files, but I don't have anything to give you and example from. [string](0..33|%{[char][int](46+("686552495351636652556262185355647068516270555358646562655775 0645570").substring(($_*2),2))})-replace " " Dont you think I can achieve this through my exch2003 message tracking (see link)? If so am I inputting the right parameters as shown in my sample picture? http://ukm2rw.bay.livefilestore.com/y1pvj0ybqJ6MbRRA1u7cssmPA65Ora4SWjVYsvvthwlPBUbMdxPoZjseq2uVwKYCL924NCGTWFZO2qWRJuBLf4AasvAfU4xmnPo/messagetracking.JPG?psid=1

Sorry, I can't access your link from work. You can probably get the information from your message tracking, but I'd think it would be tedious ( I could be wrong about that). I haven't seen Exchange 2003 message tracking in a long time, and I don't know your environment, but I'd think you'd want to track the DL useage over a period of at least a few months before you start deleteing them, and that seems like a lot of manual work from the GUI.[string](0..33|%{[char][int](46+("686552495351636652556262185355647068516270555358646562655775 0645570").substring(($_*2),2))})-replace " "

Hi, If you would like to use Message Tracking, you will get the information you want. And before you do that, I suggest that you read the article below first. It introduces how to enable message tracking and grant the proper permission to perform message tracking. Exchange 2003 Message Tracking and Logging: http://www.msexchange.org/tutorials/Exchange-2003-Message-Tracking-Logging.html For your sample picture, you has inputted the right parameters when you want to track the messages send to my_obsolete_DL_here@csaa.com. Best regards, SerenaPlease remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Hi, If you would like to use Message Tracking, you will get the information you want. And before you do that, I suggest that you read the article below first. It introduces how to enable message tracking and grant the proper permission to perform message tracking. Exchange 2003 Message Tracking and Logging: http://www.msexchange.org/tutorials/Exchange-2003-Message-Tracking-Logging.html For your sample picture, you has inputted the right parameters when you want to track the messages send to my_obsolete_DL_here@csaa.com. Best regards, Serena Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread. Great, thank you! Cheers.