How to Track Email Attachments in Exchange Server 2013
Question details
The user needs a reliable method to track and count emails that contain specific file attachments in Exchange Server 2013.
- Product
- Exchange Server 2013
- Device & OS
- not provided
- Scenario
- Monitoring outbound or internal mail flow to identify and report on messages containing specific file attachments like DOC, XLSX, or ZIP.
- Observed behavior
- Exchange Server 2013 message-tracking logs do not provide a simple, reliable attachment flag for counting messages with files.
Ensure you have administrator privileges to access the Exchange Admin Center (EAC) and make a list of the specific file extensions (e.g., DOC, XLSX, PPT, ZIP, TXT) you intend to track.
Create a Mail-Flow Rule for Incident Reports
Use the Exchange Admin Center to generate automatic incident reports whenever an email matching your specific attachment extensions is sent.
Since standard message-tracking logs lack a dedicated attachment flag, configuring a mail-flow rule allows you to actively monitor specific file types. The rule will send a notification report to an administrator mailbox without disrupting the original email delivery.
Log in to the Exchange Admin Center (EAC). In the left navigation pane, click on 'mail flow', and then select the 'rules' tab.
Click the Add (+) icon and select 'Create a new rule' from the dropdown menu to open the new rule window.
Click 'More options' at the bottom. Under 'Apply this rule if...', select 'The sender is located...' and choose either 'Outside the organization' or 'Inside the organization' depending on your tracking needs.
Click 'add condition'. Select 'Any attachment' and then choose 'file extension includes these words'. Enter the extensions you want to track (e.g., DOC, XLSX, PPT, ZIP, TXT) and click the plus (+) icon for each.
Under 'Do the following...', select 'Generate incident report and send it to...'. Click 'Select one' to choose the administrator mailbox that will receive the tracking reports, and specify the message properties to include.
Click 'Save'. We recommend creating an inbox rule in the administrator's mailbox to organize incoming reports into a dedicated folder. Test the rule by sending a test email with a matching attachment.
Easily View and Edit Tracked Email Attachments with WPS Office
When managing incident reports and analyzing tracked email attachments (like DOC, XLSX, and PPT) from Exchange Server, you need a reliable suite to open them. WPS Office provides a free, lightweight, and highly compatible alternative to Microsoft Office, ensuring you can review attachments seamlessly.
- 1. Download and Install: Download WPS Office Free from the official website and run the lightweight installer.
- 2. Set as Default: Configure WPS Office as your default application for Word, Excel, and PowerPoint file extensions.
- 3. Open Tracked Attachments: Double-click any tracked email attachment from your administrator mailbox to view or edit it instantly.
Frequently Asked Questions
Why can't I use message-tracking logs to count attachments in Exchange 2013?
Exchange 2013 message-tracking logs are designed to track message delivery status and routing, but they do not include a simple, reliable flag specifically for counting attachments. Using a mail-flow rule is the Microsoft-recommended workaround.
Will this mail-flow rule delay the delivery of the original email?
No. Generating an incident report via a mail-flow rule acts as a parallel action. It does not block, hold, or delay the original email from reaching its intended recipient.
How can I prevent my administrator inbox from being overwhelmed with reports?
You should create an Inbox rule in your Outlook or Outlook on the web client that automatically moves messages with the subject 'Incident Report' into a designated folder. This keeps your main inbox clean while preserving the tracking data.
