You wont be able to find which rule is firing using message tracking with on-prem Exchange. That only works in Exchange Online.
https://learn.microsoft.com/en-us/archive/blogs/eopfieldnotes/auditing-transport-rules
This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
Hi experts,
I need help to find which transport rule was applied to a specific message, the following Get-MessageTrackingLog returned but no RuleID in EventData field.
Get-MessageTrackingLog -Start (Get-Date).AddDays(-2) -ResultSize Unlimited -EventId Fail | Where -Property Recipients -Like "tia@mydomain.com" |FL
EventData: {[E2ELatency, 0.813], [DeliveryPriority, Normal], [AccountForest, mydomain.local]}
what else can I do to find out which rule delete the email message?
{[{LED=550 5.2.1 Message deleted by the transport rules agent};{MSG=};{FQDN=};{IP=};{LRT=}]}
Thanks for your help!
pingatwork
You wont be able to find which rule is firing using message tracking with on-prem Exchange. That only works in Exchange Online.
https://learn.microsoft.com/en-us/archive/blogs/eopfieldnotes/auditing-transport-rules