Utilizing PowerShell in Exchange 2019 to Identify the Top Email Senders by Displaying Mailboxes with the Highest Activity in a 24-Hour Period

A common question that Senior Management ask Exchange Administrators is, “Please can you tell us who is sending the most emails in a day”. If you are using a 3rd party solution that can run reports for you then you are able to achieve this easily but PowerShell can do the same for you.

I put together a script that will show the top senders in 24 hours. The script has the Exchange Snapin so can be run from PowerShell ISE for example or directly from your Exchange 2019 Server. Below is the output of the script:

Here is the same output, just run from PowerShell ISE:

Script

To get all the information, we need to search the Message Tracking Logs. The script is setup to go through every Exchange Server and pull the information and once complete, it will display the information on screen. Here is the script:

# Import the Exchange module
Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn

# Get a list of users and the number of sent emails for the last 24 hours
$StartDate = (Get-Date).AddDays(-1)
$EndDate = Get-Date

$TopSenders = Get-ExchangeServer | Get-MessageTrackingLog -ResultSize Unlimited -Start $StartDate -End $EndDate |
    Where-Object { $_.EventId -eq "SEND" } |
    Group-Object -Property Sender |
    Select-Object Name, @{Name='EmailsSent';Expression={$_.Count}} |
    Sort-Object -Property EmailsSent -Descending

# Display the top senders
$TopSenders | Format-Table -AutoSize

You can modify the last line to export it to a CSV or format of choice. If you don’t want a days information, change the number by the $StartDate.

Hope it helps.