Exchange Server: Trace emails sent with BCC option by end users

  • Article

At times we might run into a situation where we need to track the emails for users sent in BCC field.

This article contains some troubleshooting steps that can be helpful during these scenarios.

Steps

Below are the steps to create a transport rule for tracing emails with BCC option sent from users.

Create a new Transport Rule with Name and comment

https://exchangequery.files.wordpress.com/2015/01/bcc.png?w=600&h=513

 Choose the below option as shown below.

 https://exchangequery.files.wordpress.com/2015/01/bcc1.png?w=600

 Specify header if the message:’X-MS-Exchange-Organization-BCC’ header matches the following patterns.

https://exchangequery.files.wordpress.com/2015/01/bcc2.png?w=600

 Take the following actions: Forward the message to the sender’s manager for moderation.

https://exchangequery.files.wordpress.com/2015/01/bcc4.png?w=600&h=399

 Click Finish.

 https://exchangequery.files.wordpress.com/2015/01/bcc5.png?w=600&h=329

Message tracking logs

Also, we can use the message tracking logs to track the emails sent by end users with BCC option.

Below is an example for tracing the emails with BCC in Message Tracking logs.

Sent a test email with BCC with the below users as shown below.

https://exchangequery.files.wordpress.com/2015/01/bcc6.png?w=600

 Navigate to the below location to get the message tracking logs.

https://exchangequery.files.wordpress.com/2015/01/bcc7.png?w=600&h=209

 

Copy the logs from the below location.  Possibly the logs during the time period when you want to trace the emails sent with BCC.

Now copy and paste them into an Excel sheet as shown below.

https://exchangequery.files.wordpress.com/2015/01/bcc8.png?w=600&h=214

 

Now we need to look into recipient address and recipient status value as shown below.

https://exchangequery.files.wordpress.com/2015/01/bcc9.png?w=600&h=46

 

Now having a closer look at the two parameters recipient address and recipient status will give us the information of the user TO, BCC and CC information in the correct order as shown below.

https://exchangequery.files.wordpress.com/2015/01/bcc10.png?w=600&h=43

First user Administrator@exchangequery.com is in TO field which is mapped to To field in recipient status as shown above.

Second user Sathish@exchangequery.com is in BB field which is mapped to BCC field in recipient status.

Similarly, it shows the corresponding users in the BCC field.

Additional reading

In addition to above two suggestions as well, you can collect information about BCC recipients if you implement message journaling in the environment.

Look at the following TechNet article for Configuring Envelope Journaling in Exchange: http://technet.microsoft.com/en-us/library/gg191797.aspx