[Exchange On-Premise]List risky attachments

mbandurski18 1 Reputation point
2021-03-02T13:33:23.067+00:00

Hello,
I have transport rule which blocking attachments with specific extension. How to check which attachments are dangerous while sending message which rejected by transport rule? In message track i can check only which rule rejected the message.

Regards, Mateusz

Exchange Server Management
Exchange Server Management
Exchange Server: A family of Microsoft client/server messaging and collaboration software.Management: The act or process of organizing, handling, directing or controlling something.
7,445 questions
0 comments No comments
{count} votes

3 answers

Sort by: Most helpful
  1. Xzsssss 8,861 Reputation points Microsoft Vendor
    2021-03-03T06:22:45.247+00:00

    Hi @mbandurski18 ,

    According to my research, seems like there is no way to 'list' the rejected attachments.
    Since you could check the rule that blocked the message, you can use Get-TransportRule to check the details.

    Also the best practice is to add a notification to Sender or Recipient when the rule is doing it's job.
    73636-image.png

    Regards,
    Lou


    If the response is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.


  2. Andy David - MVP 143.8K Reputation points MVP
    2021-03-05T13:17:07.727+00:00

    Why not generate an incident report in the rule and send it to another mailbox so you can view the original email that was blocked and see what attachment was in there?

    74769-image.png

    for the Content, select "Original Mail"

    74775-image.png

    0 comments No comments

  3. mbandurski18 1 Reputation point
    2021-03-05T13:25:53.2+00:00

    Dear AnyDavid,
    I only has been received report in which no have information which attachment has been dangerous.