MAPI Attribute for message owner (finding the duplicate emails in a public folder) RRS feed

  • Question

  • Here is the situation we have a distribution group that has a public folder and a large group of people nested inside of it. Whenever an email comes into that distribution group two copies end up in the public folder. We have determined based on a number of factors that what is causing this is someone has created a client side outlook rule to move messages from the distribution group into the public folder.

    This has happened a few times to us before and the only way to find the person if they won't fess up or do not understand what they have done is to remove members of the group one by one and send a test email each time. The only problem with this besides spamming all the users is that if that user turns off their computer or someone deletes the duplicate emails it creates a lot of false positives making it hard to nail down. This is also problematic when you have 100+ people in the group. 

    If you look at the outlook properties of the message that was copied and the message that was delivered to the folder directly they are identical making it impossible to tell via message tracking who moved the message. What I was wondering is if there is some MAPI Attribute somewhere that would either show that a message was copied or who the original owner was that might be a much easier way to find the offending person causing the duplicate emails. Does anyone know of an attribute like this or have any better suggestions for tracking this down? 

    Tuesday, June 12, 2012 2:11 PM


All replies

  • Have you looked at the message with OutlookSpy or MFCMAPI to see if PR_LAST_MODIFIER_NAME points to the culprit?

    Dmitry Streblechenko (MVP)
    Redemption - what the Outlook
    Object Model should have been
    Version 5.3 is now available!

    • Marked as answer by Anonymous1595 Wednesday, June 13, 2012 3:35 PM
    Tuesday, June 12, 2012 2:45 PM
  • that sounds like just the attribute I might be looking for. I am not sure where to find it though in outlook spy. 
    Wednesday, June 13, 2012 1:25 PM
  • select mail in explorer, click IMessage button,

    • Marked as answer by Anonymous1595 Wednesday, June 13, 2012 3:35 PM
    Wednesday, June 13, 2012 1:31 PM
  • awesome thanks found it! Turns out this was just what I needed I was able to find the user that had the offending rule and get them to delete it. Thanks for the help guys. Cheers. 
    Wednesday, June 13, 2012 3:35 PM