Yes, the easiest way is to use message tracking. However, message tracking is not enabled by default. To enable message tracking open your Exchange System Manager (ESM), navigate to each Exchange server in your organization, view Properties and enable message tracking on the right on the General page.
It is important to enable message tracking on each server in order to be able to track any message sent to and from your organization. After message tracking is enabled, you can use the Message Tracking Center, which is located under the Tools folder in the ESM to search for firstname.lastname@example.org.
If this is something that you need to be able to do on an ongoing basis, you might want to jump on the archiving bandwagon. Many companies are now implementing e-mail archiving systems not just for data retention but also for the forensic capabilities.
MEMBER FEEDBACK TO THIS ASK THE EXPERT Q&A:
So are you saying that, if message tracking was not previously turned on, there is no way to track that specific message?
You are correct. Unless something like message tracking is enabled, the events that occur during the transport of a message will not be captured and will not be available retroactively.
Richard Luckett, Security expert
Do you have comments on this Ask the Expert Q&A? Let us know.
Related information from SearchExchange.com:
Dig Deeper on Exchange Server Security
Related Q&A from Richard Luckett
Some folders in a mailbox on Exchange Server 2013 are not showing up on the folder list in the OWA virtual directory but do appear in other views. Continue Reading
We have a Client Access Server and Mailbox Server on Exchange 2013 and we want to install an Edge Transport role on another machine. I joined the ... Continue Reading
How can I enable Outlook Anywhere to allow internal use for all users and external use for only some users in Exchange 2013? Continue Reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.