Does your Transport think it's Squeaky Lobster Day in your CountryOrRegion?

Today is the magical day when parents tell their tucked-in children the story of the Squeaky Lobster. So here's a Squeaky Lobster-ish post to celebrate the day.

In Exchange 2007, we introduced transport rules – a powerful feature that allows you to inspect different parts of a message such as sender, recipient, subject and headers and take actions like rejecting a message, deleting it, redirecting it to another recipient, adding a message header or a disclaimer. In previous versions of Exchange, you would need to write a transport event sink to accomplish similar things. With an easy-to-use interface in the EMC, transport rules make such tasks as easy as creating Inbox rules (created by users using Outlook/OWA). Command-line jockeys can create and manage transport rules using *-TransportRule cmdlets from the Shell. More about transport rules in Understanding Transport Rules.

In Exchange 2010, we added a number of new predicates (which are used to create conditions and exceptions), including the ability to inspect attachment content and predicates to evaluate Active Directory attributes of the sender or recipients. A complete list of predicates can be found in Transport Rule Predicates.

Ability to inspect Active Directory attributes of the sender or recipients dramatically increases the number of things you can check and the type of rules you can create. For example, you can check if the sender or recipients are in the same department, report to the same manager, check if the sender is the recipients’ manager (or the other way round), check the sender's title, city, state or country, amongst other things. The list of supported attributes is included in the Predicate Properties table in Transport Rule Predicates, or you can also see them in the New Transport Rule and Edit Transport Rule wizards in the EMC.

Evaluate the sender's country or region

You can use the predicate to evaluate the sender's country. This can be useful in many scenarios - for example, applying a disclaimer to messages based on the sender's country.

Important: When using Active Directory attributes to meet business requirements, you must have appropriate processes in place to ensure the necessary attributes are populated and up-to-date.

You can add the country/region property to a user or contact using ADUC, the EMC, the Shell or by using LDAP utilities. If you use ADUC or EMC, you’re greeted with a nice little drop-down list to pick a country/region from. If you use the Shell, you must use the corresponding cmdlet to populate the CountryOrRegion property – Set-User for user accounts, Set-Contact for contacts.

Fig 1: You can select a recipient’s country or region from recipient’s properties in EMC

You need to create a rule to check if message sender is from a specified country – let’s continue with Germany as the example, to apply a disclaimer. You can use the when the sender’s properties contain specific words predicate from the New Transport Rule wizard in EMC to check the CountryOrRegion property. The predicate allows you to pick a supported property and you can type in a string to match. For example, if you’re trying to match senders from Germany, you instinctively type in Germany.

But the transport rule doesn’t fire on any messages sent by recipients from Germany!

You check the rule in EMC – it says Germany. It’s spelt correctly, no typos. You use the Shell to retrieve the properties:

(Get-TransportRule MyRule).Conditions | fl *

The value correctly displays as Germany:

Words : {countryorregion:Germany}
Name : SenderAttributeContains
Rank : 36
LinkedDisplayText : when the sender's properties contain specific words
IsValid : True

You check the recipient’s country property using the Shell.

Get-User bsuneja | select cou*

Squeaky Lobster! The value is Germany! Why wouldn't the rule fire?

The CountryOrRegion Property

Although the CountryOrRegion property displays the country’s name (think of it as a display name), what’s stored in the Country-Name attribute (ldapDisplayName: c) in the recipient object in Active Directory is the 2-letter ISO 3166-1 country/region identifier for the country. For Germany, it’s DE. The full list of ISO codes can be found in the ISO 3166-1 decoding table . (Update: A better-formatted list can be found in ISO 3166-1 on Wikipedia).

Note: Active Directory objects also have two more attributes to identify country or region:
1) Country-Code (ldapDisplayName: countryCode), which corresponds to the ISO 3166-1 numeric code
2) Text-Country (ldapDisplayName: co), which is the country name.
However, only the Country-Name attribute is replicated to the Global Catalog.

Update the rule

Armed with this information, you can fix the rule in EMC.

Or use this command from the Shell to update the SenderADAttributeContains predicate.

Set-TransportRule MyRule –SenderADAttributeContains “CountryOrRegion:DE”

Happy Squeaky Lobster Day!

Bharat Suneja