Sembee:

I think this is the Outlook rule you were referring to, found on forums.msexchange.org.

My apologies (and thanks!) to the original poster, EdwardLHall:

After some additional research and experimentation we think we've found an acceptable solution that relies on the following 3 premises,

1. Most NDRs can be filtered using a small set of subject phrases.

2. Most legitimate NDRs will reference the IP address or Postmaster account of our mailserver somewhere in the message header or body.

3.  Spoof generated NDRs will reference the FQDN of our mailserver (as configured in the advanced Virtual SMTP properties) in the message header as the final recipient, but never the IP address or Postmaster account.

Using these premises we crafted a simple Outlook rule, exported it to a file and distributed it to our affected users along with import instructions.  The rule runs server-side so once its entered theres no further reliance on the Outlook client.

We would have preferred a centralized solution but none of our current products gave us the level of filtering control found in the Outlook client rules.

Heres an example of what were using,

Apply this rule after the message arrives
with undeliverable or undelivered mail or delivery failed or delivery failure or failure notice or returned mail or notification (failure) in the subject
move it to the Junk E-mail folder
except if the body contains our mailserver IP address
or except if the message header contains our mailserver IP address or postmaster@ourdomain


We tested this on a set of 200 spoof generated NDRs and it was about 95% effective, we then sent 20 random test emails to the same addresses generating legitimate NDRs all of which passed the rule correctly.

That looks like it.
I work so many forums that I forget where I have seen things.

Simon.

This rule is something I did create for my own email account, then exported it and sent it to all of the company employees and recommended they imort it if they are having the same problems.  

Why is this not something that can implemented from the server for all users, and save us, the administrators all these headaches.

Rules are client side in most cases because Outlook has to read the message. The closest you can get to server side rules is event sinks, but that will require some programming skills and may not detect everything.
Exchange 2007 introduces a rules system, but even that would struggle to pick up everything.

Simon.