Hi all,

We have an Exchange 2013 server and unhappy users whose OOF auto replies are not sending. I've confirmed OOF is enabled and a users OOF is switched on but no OOF replies are being sent to either internal nor external contacts.

Get-RemoteDomain | fl DomainName,*OOF*,*enabled*

DomainName                        : mydomain
AllowedOOFType                    : ExternalLegacy
AutoReplyEnabled                  : True
AutoForwardEnabled                : True
DeliveryReportEnabled             : True
NDREnabled                        : True
MeetingForwardNotificationEnabled : False
TNEFEnabled                       :
TrustedMailOutboundEnabled        : False
TrustedMailInboundEnabled         : False
NDRDiagnosticInfoEnabled          : True

DomainName                        : *
AllowedOOFType                    : ExternalLegacy
AutoReplyEnabled                  : True
AutoForwardEnabled                : True
DeliveryReportEnabled             : True
NDREnabled                        : True
MeetingForwardNotificationEnabled : False
TNEFEnabled                       :
TrustedMailOutboundEnabled        : False
TrustedMailInboundEnabled         : False
NDRDiagnosticInfoEnabled          : True

What I want to know is can I use the Get-MessageTrackingLog cmdlt to track "Automatic Replies" and prove these messages are being sent but being blocked by a firewall or another MTA of some sort? How do I prove disprove the exchange rules are working and the OOF replies are at least being generated?

Thanks in advance,

durrie.

I don't know of any specific way of scoping these messages other than by -MessageSubject

Get-MessageTrackingLog -MessageSubject "*Out Of Office*" -Sender <your sender's email address>

This should track what is being kicked out of their mailbox with that subject.

Hi Josh, this works. I had to change the search string to "Auto Reply" thanks a bunch!

This returns info but is there any way to enumerate the data with date and time the messages were send and received. Dates and times of this message traffic will help me...

This is what I get...is this a powershell setup issue or cmdlet switch missing issue?

EventId  Source   Sender                            Recipients                        MessageSubject                   
-------  ------   ------                            ----------                        --------------                   
HARED... SMTP     gfigueira@mydomain.com           {sender@sender.com}    Automatic reply:
RECEIVE  SMTP     gfigueira@mydomain.com           {sender@sender.com}    Automatic reply:
DROP     ROUTING  gfigueira@mydomain.com           {sender@sender.com}    Automatic reply:
AGENT... AGENT    gfigueira@mydomain.com           {sender@sender.com}    Automatic reply:
HARED... SMTP     gfigueira@mydomain.com           {sender@sender.com}    Automatic reply:
RECEIVE  SMTP     gfigueira@mydomain.com           {sender@sender.com}    Automatic reply:
AGENT... AGENT    gfigueira@mydomain.com           {sender@sender.com}    Automatic reply:
TRANSFER ROUTING  gfigueira@mydomain.com           {sender@sender.com}    Automatic reply:
SEND     SMTP     gfigueira@mydomain.com           {sender@sender.com}    Automatic reply:

• Edited by durrie 16 hours 16 minutes ago formatted txt

Ofcourse there is, try the below...

Get-MessageTrackingLog -MessageSubject "*Auto Reply*" -Sender <your sender's email address> | select Sender,EventID,Timestamp,Messagesubject  

Let me know if this is what you want

• Edited by Josh Lavely 15 hours 53 minutes ago Spelling

You can as well send it to a csv file for better readability, sorting and search. Here is what I use when tracking : 

Get-MessageTrackingLog -MessageSubject "*Auto Reply*" -Sender <your sender's email address> | Select-Object Timestamp,Clienthostname,eventid,source,totalbytes,sender,@{Name="Recipients";Expression={$_.recipients}},Recipientcount,MessageSubject,serverhostname,clientip,connectorid,messageid,InternalMessageId | Sort-object -Property timestamp | Export-Csv OutFile.csv -NoTypeInformation -delimiter ';'

Please note that I did not test it on Exchange 2013 but Exchange 2010, and that if you have more than one server with HubTransportServer role, you'll need to run the command for each one (or write a few line of codes to easier your furure trackings :) )

• Edited by Aurélien D 15 hours 33 minutes ago
• Proposed as answer by Peter Moys 15 hours 15 minutes ago
• Marked as answer by durrie 10 hours 12 minutes ago

$ExServers=Get-TransportServer
$Mastertable=@()
ForEach($server in $ExServers){
$track=Get-MessageTrackingLog -MessageSubject "*Auto Reply*" -Sender <your sender's email address> -Server $server 
 $table=[PSCustomObject][Ordered]@{
                                    "Server" =$Server
                                    "Sender" = $track.sender
                                    "EventID" = $track.eventid
                                    "TimeStamp" = $track.timestamp
                                    "Message Subject" = $track.messagesubject
                                  }
                                  $Mastertable+=$table
                               } 
$mastertable | Export-Csv c:\TrackingData.csv -NoTypeInformation

Try this :-)

Hi Josh, this works. I had to change the search string to "Auto Reply" thanks a bunch!

This returns info but is there any way to enumerate the data with date and time the messages were send and received. Dates and times of this message traffic will help me...

This is what I get...is this a powershell setup issue or cmdlet switch missing issue?

EventId  Source   Sender                            Recipients                        MessageSubject                   
-------  ------   ------                            ----------                        --------------                   
HARED... SMTP     gfigueira@mydomain.com           {sender@sender.com}    Automatic reply:
RECEIVE  SMTP     gfigueira@mydomain.com           {sender@sender.com}    Automatic reply:
DROP     ROUTING  gfigueira@mydomain.com           {sender@sender.com}    Automatic reply:
AGENT... AGENT    gfigueira@mydomain.com           {sender@sender.com}    Automatic reply:
HARED... SMTP     gfigueira@mydomain.com           {sender@sender.com}    Automatic reply:
RECEIVE  SMTP     gfigueira@mydomain.com           {sender@sender.com}    Automatic reply:
AGENT... AGENT    gfigueira@mydomain.com           {sender@sender.com}    Automatic reply:
TRANSFER ROUTING  gfigueira@mydomain.com           {sender@sender.com}    Automatic reply:
SEND     SMTP     gfigueira@mydomain.com           {sender@sender.com}    Automatic reply:

• Edited by durrie Friday, August 14, 2015 3:12 PM formatted txt

Hi Josh, this works. I had to change the search string to "Auto Reply" thanks a bunch!

This returns info but is there any way to enumerate the data with date and time the messages were send and received. Dates and times of this message traffic will help me...

This is what I get...is this a powershell setup issue or cmdlet switch missing issue?

EventId  Source   Sender                            Recipients                        MessageSubject                   
-------  ------   ------                            ----------                        --------------                   
HARED... SMTP     gfigueira@mydomain.com           {sender@sender.com}    Automatic reply:
RECEIVE  SMTP     gfigueira@mydomain.com           {sender@sender.com}    Automatic reply:
DROP     ROUTING  gfigueira@mydomain.com           {sender@sender.com}    Automatic reply:
AGENT... AGENT    gfigueira@mydomain.com           {sender@sender.com}    Automatic reply:
HARED... SMTP     gfigueira@mydomain.com           {sender@sender.com}    Automatic reply:
RECEIVE  SMTP     gfigueira@mydomain.com           {sender@sender.com}    Automatic reply:
AGENT... AGENT    gfigueira@mydomain.com           {sender@sender.com}    Automatic reply:
TRANSFER ROUTING  gfigueira@mydomain.com           {sender@sender.com}    Automatic reply:
SEND     SMTP     gfigueira@mydomain.com           {sender@sender.com}    Automatic reply:

• Edited by durrie Friday, August 14, 2015 3:12 PM formatted txt

Ofcourse there is, try the below...

Get-MessageTrackingLog -MessageSubject "*Auto Reply*" -Sender <your sender's email address> | select Sender,EventID,Timestamp,Messagesubject  

Let me know if this is what you want

• Edited by Josh Lavely Friday, August 14, 2015 3:34 PM Spelling

Ofcourse there is, try the below...

Get-MessageTrackingLog -MessageSubject "*Auto Reply*" -Sender <your sender's email address> | select Sender,EventID,Timestamp,Messagesubject  

Let me know if this is what you want

• Edited by Josh Lavely Friday, August 14, 2015 3:34 PM Spelling

You can as well send it to a csv file for better readability, sorting and search. Here is what I use when tracking : 

Get-MessageTrackingLog -MessageSubject "*Auto Reply*" -Sender <your sender's email address> | Select-Object Timestamp,Clienthostname,eventid,source,totalbytes,sender,@{Name="Recipients";Expression={$_.recipients}},Recipientcount,MessageSubject,serverhostname,clientip,connectorid,messageid,InternalMessageId | Sort-object -Property timestamp | Export-Csv OutFile.csv -NoTypeInformation -delimiter ';'

Please note that I did not test it on Exchange 2013 but Exchange 2010, and that if you have more than one server with HubTransportServer role, you'll need to run the command for each one (or write a few line of codes to easier your furure trackings :) )

• Edited by Aurélien D Friday, August 14, 2015 3:54 PM
• Proposed as answer by Peter Moys Friday, August 14, 2015 4:12 PM
• Marked as answer by durrie Friday, August 14, 2015 9:16 PM

You can as well send it to a csv file for better readability, sorting and search. Here is what I use when tracking : 

Get-MessageTrackingLog -MessageSubject "*Auto Reply*" -Sender <your sender's email address> | Select-Object Timestamp,Clienthostname,eventid,source,totalbytes,sender,@{Name="Recipients";Expression={$_.recipients}},Recipientcount,MessageSubject,serverhostname,clientip,connectorid,messageid,InternalMessageId | Sort-object -Property timestamp | Export-Csv OutFile.csv -NoTypeInformation -delimiter ';'

Please note that I did not test it on Exchange 2013 but Exchange 2010, and that if you have more than one server with HubTransportServer role, you'll need to run the command for each one (or write a few line of codes to easier your furure trackings :) )

• Edited by Aurélien D Friday, August 14, 2015 3:54 PM
• Proposed as answer by Peter Moys Friday, August 14, 2015 4:12 PM
• Marked as answer by durrie Friday, August 14, 2015 9:16 PM

Thank you very much Aurelien your suggestion worked perfectly! I added the -Start and -End parameters as I wanted to pull only data from today as I turned OOF on and off a few times today to test so wanted that Log data specifically to inspect. This is what I used...

Get-MessageTrackingLog -Start "08/13/2015 11:59PM" -End "08/14/2015 09:45PM" -MessageSubject "Automatic Reply" -Sender me@mydomain.com | Select-Object Timestamp,Clienthostname,eventid,source,totalbytes,sender,@{Name="Recipients";Expression={$_.recipients}},Recipientcount,MessageSubject,serverhostname,clientip,connectorid,messageid,InternalMessageId | Sort-object -Property timestamp | Export-Csv C:\Mytracking.csv -NoTypeInformation -delimiter ';'

At times when I had my OOF enabled the log shows the following object results...

EventId: RECEIVE

Source: MAILBOXRULE

SENDER: me@mydomain.com

Recipients: me@hotmail.com

MessageSubject: Automatic Reply: Testing OOF again.

This aligns with my email subject and suggests an Automatic Reply: rule is fired as an Exchange rule, or so it seems. Problem I have is the auto repies are still not getting to the original sender!!! Our Spam filtering service say their system will not stop auto replies...hmmm, play me another one DJ!

• Edited by durrie 10 hours 2 minutes ago txt correction

Thanks for you help Josh but I used Aurelien D's syntax with good effect. I now have some ammo to take back to our email gateway hosting company and the firewall guys because something is blocking the auto responses for sure it would seem!

Thank you very much Aurelien your suggestion worked perfectly! I added the -Start and -End parameters as I wanted to pull only data from today as I turned OOF on and off a few times today to test so wanted that Log data specifically to inspect. This is what I used...

Get-MessageTrackingLog -Start "08/13/2015 11:59PM" -End "08/14/2015 09:45PM" -MessageSubject "Automatic Reply" -Sender me@mydomain.com | Select-Object Timestamp,Clienthostname,eventid,source,totalbytes,sender,@{Name="Recipients";Expression={$_.recipients}},Recipientcount,MessageSubject,serverhostname,clientip,connectorid,messageid,InternalMessageId | Sort-object -Property timestamp | Export-Csv C:\Mytracking.csv -NoTypeInformation -delimiter ';'

At times when I had my OOF enabled the log shows the following object results...

EventId: RECEIVE

Source: MAILBOXRULE

SENDER: me@mydomain.com

Recipients: me@hotmail.com

MessageSubject: Automatic Reply: Testing OOF again.

This aligns with my email subject and suggests an Automatic Reply: rule is fired as an Exchange rule, or so it seems. Problem I have is the auto repies are still not getting to the original sender!!! Our Spam filtering service say their system will not stop auto replies...hmmm, play me another one DJ!

• Edited by durrie Friday, August 14, 2015 9:25 PM txt correction

Thank you very much Aurelien your suggestion worked perfectly! I added the -Start and -End parameters as I wanted to pull only data from today as I turned OOF on and off a few times today to test so wanted that Log data specifically to inspect. This is what I used...

Get-MessageTrackingLog -Start "08/13/2015 11:59PM" -End "08/14/2015 09:45PM" -MessageSubject "Automatic Reply" -Sender me@mydomain.com | Select-Object Timestamp,Clienthostname,eventid,source,totalbytes,sender,@{Name="Recipients";Expression={$_.recipients}},Recipientcount,MessageSubject,serverhostname,clientip,connectorid,messageid,InternalMessageId | Sort-object -Property timestamp | Export-Csv C:\Mytracking.csv -NoTypeInformation -delimiter ';'

At times when I had my OOF enabled the log shows the following object results...

EventId: RECEIVE

Source: MAILBOXRULE

SENDER: me@mydomain.com

Recipients: me@hotmail.com

MessageSubject: Automatic Reply: Testing OOF again.

This aligns with my email subject and suggests an Automatic Reply: rule is fired as an Exchange rule, or so it seems. Problem I have is the auto repies are still not getting to the original sender!!! Our Spam filtering service say their system will not stop auto replies...hmmm, play me another one DJ!

• Edited by durrie Friday, August 14, 2015 9:25 PM txt correction