Dim oSession,sSHIDName,sFoundFolderName,sMsgID if wscript.arguments.count <> 4 then usage if instr(wscript.arguments(0),"?") then usage sServer=wscript.arguments(0) sAlias=wscript.arguments(1) sFldID=wscript.arguments(2) sMsgId=wscript.arguments(3) if instr(sFldID,"-") then sFldID=split(sFldId,"-")(1) if instr(sMsgID,"-") then sMsgID=split(sMsgId,"-")(1) Quicklogin sServer,sAlias 'wscript.echo TypeName(oSession.Inbox) sName="Mailbox - "&oSession.CurrentUser set oMbxRoot=oSession.Infostores.Item(sName).RootFolder 'wscript.echo "Folder,ID" FindID oMbxRoot,sFldId 'wscript.echo 'wscript.echo "Parent folder name: "&sFoundFolderName oSession.Logoff Sub FindID(oSHIDFolder,sSHID) sSHIDOrig=sSHIDName sSHIDName=sSHIDName&"\"&oSHIDFolder.Name 'wscript.echo sSHIDName&","&oSHIDFolder.id if instr(1,oSHIDFolder.ID,sSHID,1) > 0 then sFoundFolderName=sSHIDName wscript.echo vbcrlf&"Parent folder name: "&sFoundFolderName 'in case of duplicates FindMsgId oSHIDFolder else 'wscript.stdout.write "." end if if oSHIDFolder.Folders.Count>0 then for each oSHIDSubFolder in oSHIDFolder.Folders FindID oSHIDSubFolder,sSHID next end if sSHIDName=sSHIDOrig End Sub Sub FindMsgId (oFMIFolder) for each oMsg in oFMIFolder.messages 'wscript.stdout.write "." if instr(1,oMsg.id,sMsgID,1) then 'wscript.echo wscript.echo "Message subject: "&oMsg.Subject wscript.echo "Message Date: "&oMsg.TimeSent wscript.echo "Message Size: "&oMsg.size 'wscript.echo """"&oMsg.Subject&""","""&oMsg.TimeSent&""","""&oMsg.size&""","&oMsg.id if err.number <> 0 then wscript.echo "Error: 0x"&cstr(hex(err.number))&" "&err.description err.clear end if end if next End Sub Sub Quicklogin(sServer,sMailboxAlias) set oSession = createobject("MAPI.Session") oSession.logon "","",false,true,true,true,sServer & vbLf & sMailboxAlias End Sub Sub Usage wscript.echo wscript.echo "Usage:" wscript.echo wscript.echo "cscript FindMsg.vbs server mbxalias folderid msgid" wscript.echo wscript.echo "Where folderid and msgid come from 8507 event." wscript.echo "i.e. cscript findmsg.vbs usgcte00 nwjefferk 1-2FFAC4A 1-116F85E9" wscript.quit End Sub