This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(83.2, 97%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EM%3C/text%3E%3C/svg%3E)
Hello,
I have transport rule which blocking attachments with specific extension. How to check which attachments are dangerous while sending message which rejected by transport rule? In message track i can check only which rule rejected the message.
Regards, Mateusz
Hi @mbandurski18 ,
According to my research, seems like there is no way to 'list' the rejected attachments.
Since you could check the rule that blocked the message, you can use Get-TransportRule to check the details.
Also the best practice is to add a notification to Sender or Recipient when the rule is doing it's job.
Regards,
Lou
If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Hi @mbandurski18 ,
Do the suggestions above help? If the issue has been resolved, please click “Accept as answer” to mark helpful reply as an answer, this will make answer searching in the forum easier and be beneficial to other community members as well.
Regards,
Lou
If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Dear ZhengqiLou-MSFT,
No, I have information that it possible. Can you have other idea? I only found this article: https://gsexdev.blogspot.com/2013/09/exchange-attachment-statistics.html but is not resolve my problem.
Regards, Mateusz
Why not generate an incident report in the rule and send it to another mailbox so you can view the original email that was blocked and see what attachment was in there?
for the Content, select "Original Mail"
Dear AnyDavid,
I only has been received report in which no have information which attachment has been dangerous.
It doesnt work that way. Transport rules can only look for the files. Your anti-malware product can tell what is "dangerous" and it will block or allow based on their signatures.
Hi @mbandurski18 ,
Are these dangerous attachments judged by the Transport rule or the anti-spam/anti-virus?
Sorry I still couldn't found how to list these items, I see no related EMS cmdlets...
Regards,
Lou
If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Hi @mbandurski18 ,
Do the suggestions above help? If the issue has been resolved, please click “Accept as answer” to mark helpful reply as an answer, this will make answer searching in the forum easier and be beneficial to other community members as well.
If this issue is still there, please share more info so we can better found the resolution.
Regards,
Lou
If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.