Exchange mailbox attachment blocking problem

Problem definition: want to know why macro attachments are blocked, want to know about mail process records, problem analysis:

In Exchange 2013 and Outlook anti-spam filtering services, Microsoft provides SmartScreen "intelligent filtering" services. in general, messages sent from Outlook clients with macro attachments (VBA) (such as docm,xlsm, etc.) will be blocked. Since the macro virus can easily be activated to execute code to endanger the security of the client system, if you confirm that there is no problem with the attachment, you can use compression encryption to transmit it.

By default, Exchange's default OWA mailbox policy prevents some attachments from being displayed and downloaded for messages sent by OWA. You need to add a similar attachment format to the allowed list (AllowedFileTypes) on the premise of confirming security.

View the file types currently allowed by OWA:

(Get-OwaMailboxPolicy). AllowedFileTypes

If the attachment is not allowed, add a file extension.

The Identity name may be different and can be changed according to your own environment.

Set-OwaMailboxPolicy-Identity OwaMailboxPolicy-Default-AllowedFileTypes .xml

The following are common file types that you can add or block as needed.

'.rpmsg', '.xlsx', '.xlsm', '.xlsb', '.tiff', '.pptx', '.pptx', '.ppsx', '.ppsm', '.docx', '.docm', '.zip', '.xls', '.wmv', '.wma', '.wav', '.vsd', '.txt', '.tif', '.rtf', '.pub', '.ppt', '.png', '.pdf', '.one', '.m3' '.jpg', '.gif', '.doc', '.bmp', '.avi', '.xml'

Set-OwaMailboxPolicy-Identity OwaMailboxPolicy-Default-AllowedFileTypes' .rpmsg', '.xlsx', '.xlsm', '.xlsb', 'tiff', '.pptx', '.pptm', '.ppsx', '.ppsm', '.docx', '.docm', '.zip', '.xls', '.wmv', '.wma', '.wav', '.vsd', '.txt', '.tif', '.rtf', '.pub', '.ppt', '.png', '.pdf', '.wav', '.vsd', '.txt', '.tif', '.rtf', 'pub', '.ppt', '.png', '.pdf' '.one', '.mp3', '.jpg', '.gif', '.doc', '.bmp', '.avi', '.xml'

Https://technet.microsoft.com/zh-cn/library/bb124739(v=exchg.150).aspx

Https://blogs.technet.microsoft.com/exchange/2016/09/01/deprecating-support-for-smartscreen-in-outlook-and-exchange/

After the message is sent, you can query the mail flow record through EAC.

EAC Exchange Management Center > Mail flow > delivery report

Https://technet.microsoft.com/zh-cn/library/jj150554(v=exchg.150).aspx

If you need to check in detail when email attachments are deleted, you can use pipeline tracking to view the process of transmission within Exchange: (in general, in view of the prevalence of macro viruses, such as macro attachments are blocked, it is no longer necessary to do this, security considerations, or compression encryption to send)

Turn on Pipe tracking (Pipeline Trace)

Set-TransportService Mailbox01-PipelineTracingEnabled $true

Set pipe tracking for a sender

Set-TransportService Mailbox01-PipelineTracingSenderAddress chris@contoso.com

Configure the pipe path (optional). The default path is:% ExchangeInstallPath%TransportRoles\ Logs\ Hub\ PipelineTracing

Mailbox transfer service path:% ExchangeInstallPath%TransportRoles\ Logs\ Mailbox\ PipelineTracing

How to conduct advance screening:

After enabling pipeline tracking, ask the sender to reproduce the problem, and then grab the tracking log as follows:

The tracking log includes the original message and snapshots before and after each Transport Agent modification for comparison to determine whether changes are made to the content in a Transport Agent.

Configure pipe tracking:

Https://technet.microsoft.com/zh-cn/library/jj916678(v=exchg.150).aspx

Https://technet.microsoft.com/zh-cn/library/bb125018(v=exchg.150).aspx