Use PowerShell to search for transport rules (updated)

Update (April 7, 2015): More content and examples have been added to this article since the original posting.

PowerShell can be used to quickly search for rules matching specific criteria. This can be incredibly valuable for a tenant that contains a lot of rules. While possible to search for transport rules in the EOP portal, PowerShell offers a more comprehensive (and cooler) way to accomplish this. There are also some rule properties that can only be searched for with PowerShell.

Example 1

We have created some EOP transport rules and are expecting them to trigger, however they aren’t. One possible explanation is that a transport rule with a lower priority is triggering that has the option Stop processing more rules enabled.
Remember that rules are evaluated starting first with priority zero, and then progressing up. If a rule triggers that has the option Stop processing more rules, no further transport rules will be evaluated. Rule priorities can be seen directly in the portal.

 
We could search for rules containing this option in the GUI, but let’s focus on how we can do this search with PowerShell. I’ll run the following PowerShell in this particular tenant.

Get-TransportRule | ?{$_.StopRuleProcessing -eq 'True'}

Executing this I get the following results.

I can quickly see that we have three rules with this option enabled, only two of which are enabled.

Breaking down the PowerShell, we are first pulling all existing transport rules (Get-TransportRule), and then sending these results to Where-Object (a question mark is an alias for this cmdlet) who looks for rules that march our search criteria. We are searching for a rule that has the property StopRuleProcessing set to True.

Example 2

Along the same lines as above, what if we wanted to find all Transport Rules with the option Defer the message if rule processing doesn’t complete? To find rules with this particular option enabled we need to turn to PowerShell as the search in the GUI won’t be able to find these.

 
Just like the above example, the PowerShell for this is quite straight forward and looks as follows.

Get-TransportRule | ? {$_.RuleErrorAction -eq 'Defer'}

Example 3

For audit reasons, we want to see which EOP transport rules were modified in the last 15 days. This is another search query that is not possible in the GUI, but possible with PowerShell. Here is how that PowerShell would look.

Get-TransportRule | ? {$_.WhenChanged -gt [datetime]::Now.AddDays(-15)}

Transport rule properties

In the above examples I searched on three different transport rule properties, StopRuleProcessing, RuleErrorAction, and WhenChanged. The following PowerShell will return a complete list of the properties that the Get-TransportRule cmdlet can return, which you can then subsequently serach on.

Get-TransportRule | Get-Member -MemberType Property

Resources

Connect to Exchange Online PowerShell
Exchange Online cmdlets
Get-TransportRule