Dear Sir, 

    A user received a return message from Outlook 2010:

==================

From: Boss1@domain1.net
Sent: Tuesday, June 23, 2015 11:02 AM
To: joe@domain1.net
Subject: RE: Service work re-arrangement

This message contains content that is prohibited by organization policy. The message will not be downloaded.

Original Message ID:  3EA487EC-E34B-4CA4-53A0-43635F8A3530

Action:Quarantine

Status:::::action exception handling:: 

==================

       Do it has any method to trace what kind of organization policy blocked this message?  Is it possible to trace in Exchange server with message ID?

Regards,

Joe Tam

Dear Sir, 

    A user received a return message from Outlook 2010:

==================

From: Boss1@domain1.net
Sent: Tuesday, June 23, 2015 11:02 AM
To: joe@domain1.net
Subject: RE: Service work re-arrangement

This message contains content that is prohibited by organization policy. The message will not be downloaded.

Original Message ID:  3EA487EC-E34B-4CA4-53A0-43635F8A3530

Action:Quarantine

Status:::::action exception handling:: 

==================

       Do it has any method to trace what kind of organization policy blocked this message?  Is it possible to trace in Exchange server with message ID?

Regards,

Joe Tam

Yes, Message tracking logs

get-messagetrackinglog in powershell ( I am assuming Exchange 2013)

Dear Andy,

I have tried the command

get-messagetrackinglog -messageID 3EA487EC-E34B-4CA4-53A0-43635F8A3530

However, no result return.

Is it blocked by exchange before delivered so not messageID will not exist?

Do you know how to check where is to set the "prohibited by organization policy"?

Regards,

Joe

• Edited by Joe Tam 19 hours 27 minutes ago

Dear Andy,

I have tried the command

get-messagetrackinglog -messageID 3EA487EC-E34B-4CA4-53A0-43635F8A3530

However, no result return.

Is it blocked by exchange before delivered so not messageID will not exist?

Do you know how to check where is to set the "prohibited by organization policy"?

Regards,

Joe

Was this message sent to an external domain? If so, then you would need to contact them. 

If this message was sent to an internal user, then you would need to check with your Exchange Admin.

For the end user, then can open up the message in sent items, go to the back stage and choose "Open Delivery Report". That will show the path the message took up to where it leaves the Exchange org.

Blocked by organization policy can be due to anti-spam, content filtering or a hub transport rule.

Dear Andy,

    I have checked that message hasn't blocked by Symantec Anti-spam software, Hub transport rule just has a dis-claimer policy only.  Do it has any log that the track whether it is blocked by Exchange content filtering?

Joe

Dear Andy,

    I have checked that message hasn't blocked by Symantec Anti-spam software, Hub transport rule just has a dis-claimer policy only.  Do it has any log that the track whether it is blocked by Exchange content filtering?

Joe

That would be in message tracking as well. 

As the message mentioned that the Action:Quarantine, where is the quarantine placed?

Regards,

Joe Tam

That depends if you are using an Edge Server or 3rd party software or if this was generated by an external recipient. You will need to contact your Exch Admin for details.