Rules problem - Outlook isn't following the key word rules

[lkthompson]

We have a legal hold folder that has "Virginia" as one of the key words in
the rule, but one of our users, whose legal name is Virginia (but whose
display name is Ginger, and her email address is Ginger as well, not
Virginia) has said all the emails she sends out and receives go into that
folder. The word "Virginia" doesn't appear anywhere visibly in the
subject/body. Is there a hidden place where Microsoft sees that word? We want
to figure it out so that hold folder doesn't get so large. Thanks!

 

[lkthompson]

FYI - using Windows XP Outlook 2003
I also opened an email from the user and went to View > Options to see the
Internet header but did not see "Virginia" in any of that code.

 

[Brian Tillman]

We have a legal hold folder that has "Virginia" as one of the key
words in the rule, but one of our users, whose legal name is Virginia
(but whose display name is Ginger, and her email address is Ginger as
well, not Virginia) has said all the emails she sends out and
receives go into that folder. The word "Virginia" doesn't appear
anywhere visibly in the subject/body. Is there a hidden place where
Microsoft sees that word? We want to figure it out so that hold
folder doesn't get so large. Thanks!

Outlook version? Is this an Exchange account? If so, what does the X.500
address for the person contain? What is the exact text of the rule?

 

[lkthompson]

Yes, it is an exchange account. Outlook version is 2003 (11.8206.8202) SP3.
Here is the info from the Internet header (i removed parts of our names and
our company's name before the ".com"'s).

Microsoft Mail Internet Headers Version 2.0
Received: from usctmx1113..com ([54.48.16.62]) by USCTMX1140..com with
Microsoft SMTPSVC(6.0.3790.3959);
Wed, 25 Jun 2008 12:12:06 -0400
X-MimeOLE: Produced By Microsoft Exchange V6.5
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: application/ms-tnef;
name="winmail.dat"
Content-Transfer-Encoding: binary
Subject: Legal Hold
Date: Wed, 25 Jun 2008 12:12:10 -0400
Message-ID: <[email protected]>
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
<[email protected]>
Thread-Topic: Legal Hold
Thread-Index: AcjW3jkC9vpeooeERiuD7hPpszFIOQ==
From: "R, Ginger" <[email protected]>
To: "Thompson, L" <[email protected]>
Return-Path: [email protected]
X-OriginalArrivalTime: 25 Jun 2008 16:12:06.0697 (UTC)
FILETIME=[36966990:01C8D6DE]

The rule information:

"Apply this rule after the message arrives
with 'maryland' or 'virginia' or 'district of columbia' or 'md' or 'va' or
'washington dc'
Move a copy to the HOLD .... folder

 

[Brian Tillman]

Yes, it is an exchange account. ....snip...
The rule information:

"Apply this rule after the message arrives
with 'maryland' or 'virginia' or 'district of columbia' or 'md' or
'va' or 'washington dc'
Move a copy to the HOLD .... folder

Impossible. You've left out WHERE the rule is to locate those strings
(i.e., in the subject, in the sender address, in the body, etc.). Moreover,
if these messages between two users on an Exchange server, there won't be
any internet headers, so you're not accurately describing your
configuration.

 

[lkthompson]

Sorry, I left out this part:

with 'maryland' or 'virginia' or 'district of columbia' or 'md' or
'va' or 'washington dc' with keywords in the subject or body

Also I looked for an x500 string in the outlook properties, but we only have
x400:c=US;.... with no Virginia in that either, or any of the other key words.

Thanks

 

[Brian Tillman]

with 'maryland' or 'virginia' or 'district of columbia' or 'md' or
'va' or 'washington dc' with keywords in the subject or body

Since you have "or 'md' or 'va'" in the rule and it's searching botht he
subject and the body, any message whose body contains either "va" or "md"
will trigger the rule. This, a message whose body contains the word
"vacuum" or "vacillate" or "Evan" or "Marcus Welby, MD" or "Ramsdell" will
cause that rule to trigger. It's not a good practice to use short, common
strings in a rule or you'll catch many more messages than you want.

 

[lkthompson]

Thanks Brian. I didn't think the short ones would get so many, I guess. But
unfortunately we cannot alter the rules because it's a company-wide legal
hold and we're not allowed to change anything.

 

[Brian Tillman]

This, a message whose body contains
the word "vacuum" or "vacillate" or "Evan" or "Marcus Welby, MD" or
"Ramsdell" will cause that rule to trigger.

Oops. I meant to type "ramdell". Clearly "ramsdell" won't trigger the
rule.