Journaling and Transport Rules in Exchange 2007

During a recent webcast I did, an attendee asked a question that I hadn't thought of before: What are the essential differences between Exchange Server 2007's journaling rules and transport rules? If you're not familiar with the various kinds of rules that Exchange 2007 implements, these might seem fairly similar—but there are actually significant differences between what these two types of rules can do and how you implement them.

Let's start with journaling rules, which are fairly easy to understand even though there's no counterpart to them in earlier versions of Exchange. A journaling rule specifies three things:

Journaling rules are run on the Hub Transport role; they're automatically propagated to all of the Hub Transport servers in the organization. There's one twist you should be aware of: Per-user journaling (the ability to turn journaling on or off for individual users instead of for all users in a given mailbox store) is available only for mailboxes for which you've bought an Exchange Enterprise CAL.

Transport rules are quite a bit different. The Exchange 2007 transport rule mechanism provides a general-purpose way to inspect messages at the Hub Transport server and take action based on the sender, recipient, or content of the message. Transport rules have three parts:

You can combine multiple instances of each of these three items in a single rule. For example, you could create a transport rule that would bounce any message sent to the company's law firm that doesn't originate from a member of the Legal organizational unit, and include a custom delivery status notification that explains why the message bounced. You can also use transport rules for mundane tasks such as adding disclaimers, copying messages sent from or to certain addresses for archival purposes, and so on. Rules can fire based on a wide variety of criteria, including familiar patterns such as Social Security numbers or customer IDs. You can also use UNIX-style regular expressions to specify arbitrary patterns to match. There's even a mechanism for writing your own transport agents that can inspect and modify messages, but it's fairly complex.

There are two types of transport rules: Hub Transport rules are stored in Active Directory and are run on all Hub Transport servers in the organization; Edge Transport rules are specific to an individual Edge Transport server and run only on that server—they aren't automatically replicated or shared. Because you can create and manage transport rules with Windows PowerShell, you can easily write a script that creates a consistent list of transport rules on all of your Edge Transport servers if you need to.

Both journaling and transport rules are quite powerful—and a big step up from the functionality available in previous Exchange versions. Learn to use them effectively, and you'll be able to easily manage how messages move through your Exchange system.