to find which transport rule was applied to a specific message, Get-MessageTrackingLog returned no RuleID in EventData

Pingatwork 61 Reputation points
2021-01-04T10:13:35.173+00:00

Hi experts,

I need help to find which transport rule was applied to a specific message, the following Get-MessageTrackingLog returned but no RuleID in EventData field.

Get-MessageTrackingLog -Start (Get-Date).AddDays(-2) -ResultSize Unlimited -EventId Fail | Where -Property Recipients -Like "tia@mydomain.com" |FL

EventData: {[E2ELatency, 0.813], [DeliveryPriority, Normal], [AccountForest, mydomain.local]}

what else can I do to find out which rule delete the email message?

{[{LED=550 5.2.1 Message deleted by the transport rules agent};{MSG=};{FQDN=};{IP=};{LRT=}]}

Thanks for your help!
pingatwork

Exchange Server Management
Exchange Server Management
Exchange Server: A family of Microsoft client/server messaging and collaboration software.Management: The act or process of organizing, handling, directing or controlling something.
7,662 questions
{count} votes

Accepted answer
  1. Andy David - MVP 149.1K Reputation points MVP
    2021-01-05T01:16:38.763+00:00

    You wont be able to find which rule is firing using message tracking with on-prem Exchange. That only works in Exchange Online.

    https://learn.microsoft.com/en-us/archive/blogs/eopfieldnotes/auditing-transport-rules


0 additional answers

Sort by: Most helpful

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.