HOW TO: Expose original senders and recipients of quarantined messages

by Bharat Suneja

The Content Filter Agent in Exchange Server 2007 allows you to quarantine messages above the SCLQuarantineThreshold. Messages so quarantined are delivered to a quarantine mailbox, specified in the Content Filter configuration. [Read previous post for more info, “Exchange 2007 Content Filter: How to move messages to users’ Junk Mail folder“]

Messages arriving in the quarantine mailbox look like NDRs. They appear to be sent from the postmaster address of the default domain. As such, you can’t easily see the original sender and recipient’s addresses, as shown in the screenshot below:


Figure 1: By default, messages in the quarantine mailbox show the envelope sender— the postmaster address

How to Recover Quarantined Messages from the Spam Quarantine Mailbox” in the Exchange Server 2007 documentation shows how to use a custom Outlook form to expose the original sender – the doc has code that can be copied to a text editor like Notepad and saved as a custom form (QTNE.CFG), which can be used in Outlook to expose the relevant MAPI property as a field that can be added to the view.

This exposes the original sender, but doesn’t expose the original recipient of the message. To expose the recipient, you need to modify the form from the above link and add the relevant MAPI properties.

1 Download the modified QTNE.CFG file
Download the modified form file and save it in the correct Forms folder for your locale.

For US English, the path is: \Program Files\Microsoft Office\Office12\Forms\1033. You can find out the locale ID (LCID) for your locale from KB 221435: List of supported locale identifiers in Word..

What was added in my Modified Quarantine Extension Form:
Under [Properties]

Property02=OriginalRecipient

After [Property.OriginalSender] section:

[Property.OriginalRecipient]
Type=30
NmidInteger=0x0E04
DisplayName=Original Recipient

2 Install the form in Microsoft Outlook

1. Tools | Options | Other tab | Advanced Options | Custom Forms | Manage Forms | Install.
2. Navigate to the path where you saved the QTNE.CFG file, and select the file.


Figure 2: Installing the Modified Quarantine Extension form (QTNE.cfg) in Microsoft Outlook

3. Click OK a few times till all the dialog boxes are closed. The form is now installed.

3 Add the fields
With the form installed in Outlook, it’s time to make the fields show up!

1. In the Outlook messages pane, right-click the column heading on the top | select Custom.
2. In the Custom View dialog box, click Fields | from the “Select available fields from:” drop-down (which says “Frequently-used fields” by default), select Forms [screenshot].
3. Select the Modified Quarantine Extension Form | click Add
4. In the Show Fields dialog box, select Original Sender and Original Recipient | click Add.


Figure 3: Adding the Original Sender and Original Recipient fields to the view

5. Additionally, you can remove unnecessary fields and order the fields the way you want [screenshot of fields I have selected].

Once you’re done, the Original Sender and Original Recipient fields are displayed as shown in the screenshot below:


Figure 4: The updated view after adding the Original Sender and Original Recipient columns

When the message list pane is expanded in Outlook, this is what it looks like.


Figure 5: Expanding the columns in the updated view

Exposing these fields makes managing the quarantine mailbox easier.

Update: Adding the Original SCL column
08/19/2008 7:39 PM

Exchange 2007 SP1 also exposes the original SCL. The Outlook form file (QTNE.cfg) can be updated by adding the following.

– In the [Properties] section:

Property03=OriginalSCL

– After the [Property.OriginalRecipient] section:

[Property.OriginalSCL]
Type=3
NmidPropset={41F28F13-83F4-4114-A584-EEDB5A6B0BFF}
NmidString=OriginalScl
DisplayName=Original SCL

You can download the updated QTNE.cfg form or manually updated your own file. Now you can add the Original SCL column.

Screenshot: Displaying the Original SCL
Figure 6: The original SCL for messages in the quarantine mailbox can be displayed using the updated Outlook form.

The pr
evious version
of QTNE.cfg is still available.

{ 17 comments… read them below or add one }

Franc May 19, 2007 at 5:32 pm

Hi,

and what about exposing the SCL rating ? This way it makes it easier to fine tune the filter. But now, you can’t see what was the SCL rating of the message being quarantined. Only after delivering to the original sender, you can see the SCL rating in the message headers. I would like to see them in the quarantine mailbox.

Franc.

Reply

Zee June 25, 2007 at 5:41 pm

Hi,
Can we expose the original senders and recipients at the outlook web access?

Reply

Bharat Suneja August 19, 2008 at 10:28 pm

@franc: The post has been updated to include original SCLs. This was exposed in SP1.

Reply

Anonymous August 20, 2008 at 2:15 pm

Where do we get QTNE from link broken

Reply

Bharat Suneja August 20, 2008 at 2:41 pm

@anonymous: Thanks for reporting— it was a permissions issue.

Fixed.

Reply

Jakob H. Heidelberg September 19, 2008 at 5:54 am

Hi, great article!

Is the any way to do kinda the same for the Subject line – a client we have does not want the “Undeliverable:” part to be displayed i Outlook when browsing the Anti-SPAM mailbox.

I’m thinking like picking up on “OriginalSubject” or something?

Reply

Anonymous October 6, 2008 at 5:10 am

Hi,

just the feature i was looking for.

thanks for posting this howto.

/Bo

Reply

Rich Staples December 2, 2008 at 2:08 pm

This is important and should be included in the help files of exchane like the originalsender is. Unless I missed it, they stopped at that and left out SCL.
Thanks guys!

Reply

jpeevey January 22, 2009 at 11:42 am

I have downloaded the QTNE.CFG file and the option to show the original recipient is not there. I double checked the code.

What am I missing?

Also, I am having the issue of not being to see the original SCL.

Thanks

Reply

Anonymous May 26, 2009 at 9:34 pm

Thanks, great post and very useful.

Reply

Anonymous November 27, 2009 at 3:07 pm

This is amazing !! a Real Blast !!
-Original Sender, TO, Original SCL ! everything i needed!
It was Very difficult to find it in internet as a lot of posts concerns Outlook2003.

I do not where you live but i own you a few beers!

Thanks Thanks

Ps: This should be hard coded in Outlook !!!!!

*http://fmenigault.gandi-web.net/

Reply

Anonymous December 22, 2009 at 8:48 pm

Thats great!!! Thanks alot, you rock!

Reply

Anonymous February 18, 2010 at 4:33 am

Now how can I display in a Column the Internet header Sender: field. The one that will put in the From as "Username on behalf of Group mailbox"

I am trying to find this PR value but still can not find it. Is there a database of PR values we can find somewhere?

Reply

caypen.com April 22, 2016 at 3:24 am

Superb, what a blog it is! This web site gives helpful information to us, keep it up.

Reply

Joshua July 11, 2017 at 3:22 pm

Is this supposed to work for Exchange 2010 and Outlook 2007 ? I am not seeing any values in the SCL column.

Reply

Annett May 17, 2018 at 2:31 am

Hallo,
we habe configured our display the fields Original Sender and Original Recipient. Now we try to display the field ReplyTo, can you please help us with the values?

Reply

Bharat Suneja May 18, 2018 at 4:25 pm

I haven’t looked at behavior in the current versions in a long time – the post is more than 10 years old.

Reply

Leave a Comment

Previous post:

Next post: