locked
Inbox rules creation time RRS feed

  • Question

  • I need to know when the inbox rules for a certain users were created

    when i run ger-inboxrule -mailbox XXXXXX | fl       i get a lot of info but not the time the rule was created.

    Is there a way to know that?

    Thanks

    Friday, September 9, 2016 1:53 PM

Answers

  • You can check the Audit logs for that, although if the rule wasn't created recently you'll probably find no entry there.
    • Proposed as answer by Jason.Chao Monday, September 12, 2016 7:38 AM
    • Marked as answer by Jason.Chao Friday, September 23, 2016 2:04 AM
    Friday, September 9, 2016 6:48 PM
  • Hi,

    Agree with Vasil, please take the following articles for mailbox audit logging:

    https://technet.microsoft.com/en-us/library/ff459237(v=exchg.160).aspx

    https://technet.microsoft.com/en-us/library/ff522360(v=exchg.160).aspx

    In addition, you can try the below steps via MFCMapi:

    Steps to see property info in MFCMapi:

    1. Download MFCMapi to a folder on your computer - http://mfcmapi.codeplex.com/

    2. Open the folder to which you extracted MFCMapi, double-click mfcmapi, and then click OK.

    3. Click on the Tools menu, select Options, and ensure the “use the MDB_Online flag when calling OpenMesgStore” is checked.

    4. On the Session menu, click Logon and Display Store Table.

    5. If you are prompted to select a profile, click the profile name in the Profile Name list, and then click OK.

    6. Double-click the mailbox that contains the inbox rules that you want to review.

    7. Expand Root Container, and then expand Top of information Store.

    8. Right-click Inbox, and then click Open Associated Contents Table.

    9. The Open Associated Contents Table contains the hidden messages of the Inbox.  Within this dialog under the “Message Class” column any message class of type IPM.Rule.Message represents one of the rules.  Double click on this to open that specific rule.

    10. Within the rule, you will see several properties including Name and Create time

    Hope it helps.


    Jason Chao
    TechNet Community Support


    Please remember to mark the replies as an answer if they help and unmark them if they provide no help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com

    • Proposed as answer by Jason.Chao Monday, September 19, 2016 4:15 AM
    • Marked as answer by Jason.Chao Friday, September 23, 2016 2:04 AM
    Monday, September 12, 2016 7:47 AM

All replies

  • You can check the Audit logs for that, although if the rule wasn't created recently you'll probably find no entry there.
    • Proposed as answer by Jason.Chao Monday, September 12, 2016 7:38 AM
    • Marked as answer by Jason.Chao Friday, September 23, 2016 2:04 AM
    Friday, September 9, 2016 6:48 PM
  • Hi,

    Agree with Vasil, please take the following articles for mailbox audit logging:

    https://technet.microsoft.com/en-us/library/ff459237(v=exchg.160).aspx

    https://technet.microsoft.com/en-us/library/ff522360(v=exchg.160).aspx

    In addition, you can try the below steps via MFCMapi:

    Steps to see property info in MFCMapi:

    1. Download MFCMapi to a folder on your computer - http://mfcmapi.codeplex.com/

    2. Open the folder to which you extracted MFCMapi, double-click mfcmapi, and then click OK.

    3. Click on the Tools menu, select Options, and ensure the “use the MDB_Online flag when calling OpenMesgStore” is checked.

    4. On the Session menu, click Logon and Display Store Table.

    5. If you are prompted to select a profile, click the profile name in the Profile Name list, and then click OK.

    6. Double-click the mailbox that contains the inbox rules that you want to review.

    7. Expand Root Container, and then expand Top of information Store.

    8. Right-click Inbox, and then click Open Associated Contents Table.

    9. The Open Associated Contents Table contains the hidden messages of the Inbox.  Within this dialog under the “Message Class” column any message class of type IPM.Rule.Message represents one of the rules.  Double click on this to open that specific rule.

    10. Within the rule, you will see several properties including Name and Create time

    Hope it helps.


    Jason Chao
    TechNet Community Support


    Please remember to mark the replies as an answer if they help and unmark them if they provide no help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com

    • Proposed as answer by Jason.Chao Monday, September 19, 2016 4:15 AM
    • Marked as answer by Jason.Chao Friday, September 23, 2016 2:04 AM
    Monday, September 12, 2016 7:47 AM
  • I followed the above mentioned steps. However under the “Message Class” column I am unable to locate any message class of type IPM.Rule.Message. 
    Thursday, November 14, 2019 4:02 PM