I'm trying to generate a query to search a users mailbox for any new messages sent to them over the last 4 hours. the list would be need to have the sender and the subject for each message. It would be nice to have in HTML format so it would be nice and pretty. So far I have

Not sure if using the Message Tracking logs or trying to make a direct connection to the users mailbox would be the best method for accomplishing the goal. but I'm leaning toward the tracking logs.

Do you have more than one hub transport server?[string](0..33|%{[char][int](46+("686552495351636652556262185355647068516270555358646562655775 0645570").substring(($_*2),2))})-replace " "

Hiya, This script I've written might be useful. It should be fairly easy to change it to just do 4 hours. SteveSteve Goodman Check out my Blog for more Exchange info or find me on Twitter

Yes we have 5 Hub servers.

Hi Rancehood, Have a look for these documents, hope can give you some help: Advanced Exchange 2007 Transport Logs Troubleshooting using Log Parser - Part 1 http://blogs.technet.com/b/exchange/archive/2007/11/12/3404342.aspx Advanced Exchange 2007 Transport Logs Troubleshooting using Log Parser - Part 2 http://blogs.technet.com/b/exchange/archive/2007/11/28/3404414.aspx Process Tracking Log tool for Exchange Server 2007 http://blogs.technet.com/b/exchange/archive/2008/02/07/3404839.aspx Thanks, Evan Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

I am still such a NOOB with powershell, I was able to run this but it pulled ALL of the mail for the mailbox, any idea on how to limit this to just the last four hours?

Hi Rancehood, I test in my lab (Exchange 2007 SP3 with only one Hub Server), I can use these commands to achieve the goal: $EndDate=Get-Date $StartDate=$EndDate.AddHours(-4) get-messagetrackinglog -Start $StartDate -End $EndDate –EventId DELIVER –ResultSize Unlimited | select-object sender, messagesubject | ConvertTo-HTML | out-file c:\reports\messagetracking.html Note: you need to create a folder (reports) under the out-file path. some related documents for you: Get-MessageTrackingLog http://technet.microsoft.com/en-us/library/aa997573(EXCHG.80).aspx How to Easily Export Message Tracking Results in Exchange Server 2007 http://blogs.technet.com/b/exchange/archive/2008/12/01/3406581.aspx Windows PowerShell Tip of the Week http://technet.microsoft.com/en-us/library/ff730960.aspx Windows PowerShell Tip of the Week http://technet.microsoft.com/en-us/library/ff730936.aspx Thanks, Evan

Hi Rancehood, Since now I didn’t have the environment (which have several Hub Servers), but maybe you can run this to have a try: $HubServers=Get-ExchangeServer | Where {$_.ServerRole -like "*Hub*"} foreach($HubTransport in $HubServers) { $EndDate=Get-Date $StartDate=$EndDate.Addhours(-4) $logs=Get-MessageTrackingLog -Server $HubTransport -Start $StartDate -End $EndDate -EventId DELIVER -ResultSize Unlimited $FileName=$HubTransport.Name $logs|select-object sender, messagesubject | ConvertTo-HTML | out-file c:\reports\$FileName.html } Thanks, Evan