Hi... One of our employee have send an email and have added certain email groups in BCC - we would like to trace from Exchange 2010 - how can we trace that this user have send email to BCC users. I tried Exchange toolkit message tracking but couldn't able to find - i could only see email send (TO) Even through Outlook 2010 email header i couldn't Kindly assist... Thanks

Try this cmdlet: Get-ExchangeServer | where {$_.isHubTransportServer -eq $true -or $_.isMailboxServer -eq $true}| Get-MessageTrackingLog -Sender test@domain.com.br -Start "8/09/2012 2:00PM" -End "8/09/2012 6:00PM" | fl > Output.txt Please note in "Recipients" field we have 2 recipients and "RecipientStatus" shows "To" and "BCC" respectively: RunspaceId : 7e8be518-b174-411a-be4e-1358805e8066 Timestamp : 8/09/2012 2:31:03 PM ClientIp : 10.10.10.10 ClientHostname : SERVER01.domain.local ServerIp : 20.20.20.20 ServerHostname : SERVER01 SourceContext : 08CEEAC4B47B3415 ConnectorId : Source : STOREDRIVER EventId : RECEIVE InternalMessageId : 27201680 MessageId : <90F14C16A6187A438A2D3907556R63080DFC179D@server> Recipients : {gr@domain2.com.br, financeiro@domain.com.br} RecipientStatus : {To, BCC}Marcelo Lagden