PowerShell Script to Perform Message Trace By Subject

Script that allows you to search on a subject or variants of a subject going back X number of days. The output is logged to a CSV file showing the details of the trace log entry.

5 Star
13,480 times
Add to favorites
Office 365
E-mail Twitter del.icio.us Digg Facebook
  • Tracking mail to DL
    1 Posts | Last post February 16, 2020
    • Can I use the script to find the mails sent to DL
  • UK users - adjust date
    2 Posts | Last post November 19, 2019
    • For users in the UK, I found I had to adjust the DateEnd time to specifically call the US date format. Otherwise you end up with a conversion error. 
      [DateTime]$DateEnd = get-date -Format "MM.dd.yyyy HH:mm"
    • This needs to be adjusted on line 23. Script then runs without any issues. 
  • Message Count
    1 Posts | Last post December 01, 2018
    • When the script finishes, it outputs "X Entries Found & Logged in c:xyz". I have it saying 0 entries, but in the output file there is one message, so I think there is an error in the counting logic somewhere. Otherwise, the script works great and is exactly what I need. Thank you.
  • get a date error
    2 Posts | Last post October 27, 2016
    • Cannot convert value "16/08/2016 15:28" to type "System.DateTime". Error: "String was not recognized as a valid DateTime."
      At C:\O365_Scripts\Get-MessageTraceBySubject.ps1:45 char:1
      + [DateTime]$DateEnd = Get-Date -format g
      + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
          + CategoryInfo          : MetadataError: (:) [], ArgumentTransformationMetadataException
          + FullyQualifiedErrorId : RuntimeException
      You cannot call a method on a null-valued expression.
      At C:\O365_Scripts\Get-MessageTraceBySubject.ps1:46 char:1
      + [DateTime]$DateStart = $DateEnd.AddDays($Days * -1)
      + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
          + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
          + FullyQualifiedErrorId : InvokeMethodOnNull
    • Change this line:
      [DateTime]$DateEnd = Get-Date -format g
      To this:
      [DateTime]$DateEnd = Get-Date