• 1. London, UK
  • 2. New York, NY
  • 3. Sydney, Australia
  • 4. Melbourne, Australia
  • 5. Moscow, Russia
  • 6. Singapore
  • 7. Paris, France
  • 8. Chicago, IL
  • 9. Hong Kong
  • 10. Houston, TX

Friday, May 11, 2007

 

HOW TO: Expose original senders and recipients of quarantined messages

Posted by Bharat Suneja at 11:17 AM
The Content Filter Agent in Exchange Server 2007 allows you to quarantine messages above the SCLQuarantineThreshold. Messages so quarantined are delivered to a quarantine mailbox, specified in the Content Filter configuration. [Read previous post for more info, "Exchange 2007 Content Filter: How to move messages to users' Junk Mail folder"]

Messages arriving in the quarantine mailbox look like NDRs. They appear to be sent from the postmaster address of the default domain. As such, you can't easily see the original sender and recipient's addresses, as shown in the screenshot below:


Figure 1: By default, messages in the quarantine mailbox show the envelope sender— the postmaster address

"How to Recover Quarantined Messages from the Spam Quarantine Mailbox" in the Exchange Server 2007 documentation shows how to use a custom Outlook form to expose the original sender - the doc has code that can be copied to a text editor like Notepad and saved as a custom form (QTNE.CFG), which can be used in Outlook to expose the relevant MAPI property as a field that can be added to the view.

This exposes the original sender, but doesn't expose the original recipient of the message. To expose the recipient, you need to modify the form from the above link and add the relevant MAPI properties.

1 Download the modified QTNE.CFG file
Download the modified form file and save it in the correct Forms folder for your locale.

For US English, the path is: \Program Files\Microsoft Office\Office12\Forms\1033. You can find out the locale ID (LCID) for your locale from KB 221435: List of supported locale identifiers in Word..

What was added in my Modified Quarantine Extension Form:
Under [Properties]

Property02=OriginalRecipient

After [Property.OriginalSender] section:

[Property.OriginalRecipient]
Type=30
NmidInteger=0x0E04
DisplayName=Original Recipient


2 Install the form in Microsoft Outlook

1. Tools | Options | Other tab | Advanced Options | Custom Forms | Manage Forms | Install.
2. Navigate to the path where you saved the QTNE.CFG file, and select the file.


Figure 2: Installing the Modified Quarantine Extension form (QTNE.cfg) in Microsoft Outlook

3. Click OK a few times till all the dialog boxes are closed. The form is now installed.


3 Add the fields
With the form installed in Outlook, it's time to make the fields show up!

1. In the Outlook messages pane, right-click the column heading on the top | select Custom.
2. In the Custom View dialog box, click Fields | from the "Select available fields from:" drop-down (which says "Frequently-used fields" by default), select Forms [screenshot].
3. Select the Modified Quarantine Extension Form | click Add
4. In the Show Fields dialog box, select Original Sender and Original Recipient | click Add.


Figure 3: Adding the Original Sender and Original Recipient fields to the view

5. Additionally, you can remove unnecessary fields and order the fields the way you want [screenshot of fields I have selected].

Once you're done, the Original Sender and Original Recipient fields are displayed as shown in the screenshot below:


Figure 4: The updated view after adding the Original Sender and Original Recipient columns

When the message list pane is expanded in Outlook, this is what it looks like.


Figure 5: Expanding the columns in the updated view

Exposing these fields makes managing the quarantine mailbox easier.

Update: Adding the Original SCL column
08/19/2008 7:39 PM

Exchange 2007 SP1 also exposes the original SCL. The Outlook form file (QTNE.cfg) can be updated by adding the following.

- In the [Properties] section:

Property03=OriginalSCL

- After the [Property.OriginalRecipient] section:

[Property.OriginalSCL]
Type=3
NmidPropset={41F28F13-83F4-4114-A584-EEDB5A6B0BFF}
NmidString=OriginalScl
DisplayName=Original SCL


You can download the updated QTNE.cfg form or manually updated your own file. Now you can add the Original SCL column.

Screenshot: Displaying the Original SCL
Figure 6: The original SCL for messages in the quarantine mailbox can be displayed using the updated Outlook form.

The previous version of QTNE.cfg is still available.

Labels: , , , ,

13 Comments:

May 19, 2007 5:32 PM
Blogger Franc said...

Hi,

and what about exposing the SCL rating ? This way it makes it easier to fine tune the filter. But now, you can't see what was the SCL rating of the message being quarantined. Only after delivering to the original sender, you can see the SCL rating in the message headers. I would like to see them in the quarantine mailbox.

Franc.

 
June 25, 2007 5:41 PM
Anonymous Zee said...

Hi,
Can we expose the original senders and recipients at the outlook web access?

 
August 19, 2008 10:28 PM
Blogger Bharat Suneja said...

@franc: The post has been updated to include original SCLs. This was exposed in SP1.

 
August 20, 2008 2:15 PM
Anonymous Anonymous said...

Where do we get QTNE from link broken

 
August 20, 2008 2:41 PM
Blogger Bharat Suneja said...

@anonymous: Thanks for reporting— it was a permissions issue.

Fixed.

 
September 19, 2008 5:54 AM
Blogger Jakob H. Heidelberg said...

Hi, great article!

Is the any way to do kinda the same for the Subject line - a client we have does not want the "Undeliverable:" part to be displayed i Outlook when browsing the Anti-SPAM mailbox.

I'm thinking like picking up on "OriginalSubject" or something?

 
October 6, 2008 5:10 AM
Anonymous Anonymous said...

Hi,

just the feature i was looking for.

thanks for posting this howto.

/Bo

 
December 2, 2008 2:08 PM
Anonymous Rich Staples said...

This is important and should be included in the help files of exchane like the originalsender is. Unless I missed it, they stopped at that and left out SCL.
Thanks guys!

 
January 22, 2009 11:42 AM
Anonymous jpeevey said...

I have downloaded the QTNE.CFG file and the option to show the original recipient is not there. I double checked the code.

What am I missing?

Also, I am having the issue of not being to see the original SCL.

Thanks

 
May 26, 2009 9:34 PM
Anonymous Anonymous said...

Thanks, great post and very useful.

 
November 27, 2009 3:07 PM
Anonymous Anonymous said...

This is amazing !! a Real Blast !!
-Original Sender, TO, Original SCL ! everything i needed!
It was Very difficult to find it in internet as a lot of posts concerns Outlook2003.

I do not where you live but i own you a few beers!

Thanks Thanks

Ps: This should be hard coded in Outlook !!!!!

*http://fmenigault.gandi-web.net/

 
December 22, 2009 8:48 PM
Anonymous Anonymous said...

Thats great!!! Thanks alot, you rock!

 
February 18, 2010 4:33 AM
Anonymous Anonymous said...

Now how can I display in a Column the Internet header Sender: field. The one that will put in the From as "Username on behalf of Group mailbox"

I am trying to find this PR value but still can not find it. Is there a database of PR values we can find somewhere?

 

Post a Comment

Links to this post:

Create a Link

<< Home