You seem to be mixing Get-MessageTrackingLog parameters (-Property) with the Where-Object cmdlet. So we'll move that back to the Get-MessageTrackingLog part of the oneliner (if Recipients is a default property, we don't need it at all). Then we can use Recipients in the Where-Object filter.
First, confirm that Recipients is not a default property, use:
Get-MessageTrackingLog | Get-Member
If it is not, use:
Get-MessageTrackingLog –ResultSize Unlimited -Property Recipients |
Where Recipients -Like “suspectacct@gmail.com”
Else, if it IS a default property use:
Get-MessageTrackingLog –ResultSize Unlimited |
Where Recipients -Like “suspectacct@gmail.com”
This command would get all the message tracking logs and pipe them to the where-object command including the Recipients property. The Where-Object clause would look for messages with recipients including "suspectacct@gmail.com".
docs.microsoft reference for Get-Object.
-ResultSize Unlimited is going to give you a very large data set. Highly recommend using some of the other properties to limit it.
docs.microsoft reference for Get-MessageTrackingLog
A quick rundown of the parameters shows that there's a parameter that lets you specify recipients. Named -Recipients. So you might be able to simplify this to:
Get-MessageTrackingLog -ResultSize Unlimited -Recipients "suspectacct@gmail.com*"
If this works it will be significantly more time and processor efficient than a full dump and that's exactly what Get-MessageTrackingLog -ResultSize Unlimited with no constraints will give you.
I have found that Where-Ojbect aka where is one of the most powerful cmdlets in PowerShell, along with the import/export CSV cmdlets and Get-Help and Get-Member.
