Running Exchange 2007 SP2. Management have circulated some confidential information and they want to ensure it's not forwarded, so they want to block any emails containing the phrase "Financial Results 2010" (example).
I know I can use a Transport rule to carry this out.
But, does anyone know how this actually works? Our topology is global but always:
CMS > Local Hub Transport > HQ Hub 1 > HQ Hub 2 > SMTP Gateway
I had some questions
i. On which Hub does the message get blocked at? The first one the message encounters or at the CMS itself?
ii. If I was to run Message Tracking if a user sent a message with that phrase, what would I expect to see as the Event if the Hub blocked it?
iii. What actually happens to the message?
iv. If a user happened to send a message with that phrase in it innocently and it was blocked, how could we find this out by checking Message Tracking?