Monday, 30 November 2015

Exchange - What type of client sent an email?


In this post, I'll show you how to work out which client was used to send a particular email by using the Message Tracking Logs in Exchange 2010, Exchange 2013 or Exchange 2016. See below.

Message Tracking Logs

In the message tracking logs, there is a SourceContext field which reports the ClientType property for SUBMIT events. SUBMIT events are where the Mailbox Transport Submission service passes on a message to the Transport service, i.e. when the Exchange server picks up the email from the mailbox outbox and passes it on for delivery. 

There's no SUBMIT event when an external sender sends an email to one of your users. This means that there's no ClientType property for these emails. 

To do some testing, I sent emails using ActiveSync, OWA and Outlook and then did some message tracking to see what I could find.


In this example email, I’ve sent an email using ActiveSync (with the subject ActiveSync) and you can see the message tracking log output shows the ClientType as AirSync highlighted at the bottom:

Get-MessageTrackingLog -Start "11/24/2015 10:00" -MessageSubject ActiveSync | fl TimeStamp,Sender,Recipients,MessageSubject,SourceContext


Outlook Web Access

Emails sent using OWA has a ClientType of OWA. That’s good. That makes sense:

Get-MessageTrackingLog -Start "11/24/2015 10:00" -MessageSubject OWA | fl TimeStamp,Sender,Recipients,MessageSubject,SourceContext



As for Outlook, the ClientType came up as Outlook right? Ahem. No. MOMT. MOMT is MAPI on the Middle Tier which basically includes clients that connect using Outlook or any other application that connects using RPC/HTTP or MAPI/HTTP. See below:

Get-MessageTrackingLog -Start "11/24/2015 10:00" -MessageSubject "Outlook 2253" | fl TimeStamp,Sender,Recipients,MessageSubject,SourceContext


Windows 10 Mail App

If you haven’t yet come across this, you’ll soon find out that it connects using ActiveSync. See below:

Get-MessageTrackingLog -Start "11/24/2015 10:00" -MessageSubject "Windows 10 Mail" | fl TimeStamp,Sender,Recipients,MessageSubject,SourceContext


Monitoring emails

Monitoring emails also have a ClientType and this is Monitoring. See below:

Get-MessageTrackingLog -Start "11/25/2015 21:00" -MessageId | fl TimeStamp,Sender,Recipients,SourceContext


Get client type for an email

I’ve written a small PowerShell function that you can use to pipe your message tracking log into and it will give you a more user friendly output. Instructions for use are below:

1 - Copy this PowerShell function into your Exchange Management Shell window:

function Get-MessageClientType
        $MessageTrackingLog = @($input) | ? {$_.SourceContext -match "ClientType"}
        $Output = @()
        foreach ($Message in $MessageTrackingLog)
                $ClientType = $Message.SourceContext -split "," | ? {$_ -match "ClientType"}
                $ClientType = $ClientType -replace (" ClientType:","")             
                $OutputLine = New-Object System.Object
                $OutputLine | Add-Member -Type NoteProperty -Name TimeStamp -Value $Message.TimeStamp
                $OutputLine | Add-Member -Type NoteProperty -Name Sender -Value $Message.Sender
                $OutputLine | Add-Member -Type NoteProperty -Name Recipients -Value $Message.Recipients
                $OutputLine | Add-Member -Type NoteProperty -Name MessageSubject -Value $Message.MessageSubject
                $OutputLine | Add-Member -Type NoteProperty -Name ClientType -Value $ClientType
                $Output += $OutputLine

2 - Use Get-MessageTrackingLog to get the messages you need and then pipe it into Get-MessageClientType to get the ClientType. See below:

Get-MessageTrackingLog -Start "11/24/2015 10:00" -Recipients -ResultSize Unlimited | Get-MessageClientType | ft


You can also use this command to get all the emails sent using one of the client types. See below for how to get just the emails sent using ActiveSync clients: 

Get-MessageTrackingLog -Start "11/24/2015 10:00" -Recipients -ResultSize Unlimited | Get-MessageClientType | ? {$_.ClientType -eq "AirSync"} | ft


In this post, we've gone through how to identify whether an email was sent using Outlook, OWA or ActiveSync. This should prove to be quite useful when troubleshooting users' email issues. 


  1. Thanks for Sharing your experience with Us...!
    Interesting and beautiful blog lovely presentation thanks for sharing your views.

    For query related to Microsoft Outlook Tech Support Number, please follow the link.

  2. Dude this is golden!!! Well done and thanks for this.

  3. Dude this is golden!!! Well done and thanks for this.

  4. Dude this is golden!!! Well done and thanks for this.