I have two servers with both the mailbox and client access role installed. I have come to realize that Content Filter Agent runs before Transport Rule Agent runs. This affected me because I was using Transport Rules to set an SCL so that when ti went though the Content Filter Agent, the proper requirements would apply. But even though I was setting SCL to 6 when SPF Failed, mail was still going to my users mailbox even thought I have SCL 6 to go to my spam qurantine mailbox. The reason for that was because the Content Filter Agent is running on the OnEndOfData event and the Transport Rule was running on OnResolvedmessage event which occurs after the OnEndOfData event. When I ran Get-TransportPipeline |fl event,transportagents on both my servers to confirm that was the case, not all agents are running on each server. For server 1, I got:
Event : OnConnectEvent
TransportAgents : {}
Event : OnHeloCommand
TransportAgents : {}
Event : OnEhloCommand
TransportAgents : {}
Event : OnStartTlsCommand
TransportAgents : {}
Event : OnAuthCommand
TransportAgents : {}
Event : OnProcessAuthentication
TransportAgents : {}
Event : OnEndOfAuthentication
TransportAgents : {}
Event : OnXSessionParamsCommand
TransportAgents : {}
Event : OnMailCommand
TransportAgents : {Inbound Trust Agent}
Event : OnRcptCommand
TransportAgents : {}
Event : OnDataCommand
TransportAgents : {}
Event : OnEndOfHeaders
TransportAgents : {Inbound Trust Agent}
Event : OnProxyInboundMessage
TransportAgents : {FrontendProxyAgent}
Event : OnEndOfData
TransportAgents : {}
Event : OnHelpCommand
TransportAgents : {}
Event : OnNoopCommand
TransportAgents : {}
Event : OnReject
TransportAgents : {}
Event : OnRsetCommand
TransportAgents : {}
Event : OnDisconnectEvent
TransportAgents : {}
Event : OnSubmittedMessage
TransportAgents : {RMS Decryption Agent, Malware Agent, Text Messaging Routing Agent, RMS Encryption Agent, Journal
Agent}
Event : OnResolvedMessage
TransportAgents : {Prioritization Agent, Transport Rule Agent, Index Routing Agent}
Event : OnRoutedMessage
TransportAgents : {RMS Encryption Agent, Prelicense Agent, Journal Agent, Redirection Agent}
Event : OnCategorizedMessage
TransportAgents : {Journal Report Decryption Agent, Outbound Trust Agent}
and for server 2 i got:
Event : OnConnectEventTransportAgents : {Protocol Analysis Agent}
Event : OnHeloCommand
TransportAgents : {}
Event : OnEhloCommand
TransportAgents : {}
Event : OnStartTlsCommand
TransportAgents : {}
Event : OnAuthCommand
TransportAgents : {}
Event : OnProcessAuthentication
TransportAgents : {}
Event : OnEndOfAuthentication
TransportAgents : {}
Event : OnXSessionParamsCommand
TransportAgents : {}
Event : OnMailCommand
TransportAgents : {Inbound Trust Agent, Sender Filter Agent}
Event : OnRcptCommand
TransportAgents : {Recipient Filter Agent}
Event : OnDataCommand
TransportAgents : {}
Event : OnEndOfHeaders
TransportAgents : {Inbound Trust Agent, Sender Id Agent, Sender Filter Agent, Protocol Analysis Agent}
Event : OnProxyInboundMessage
TransportAgents : {}
Event : OnEndOfData
TransportAgents : {RMS Protocol Decryption Agent, Content Filter Agent, Protocol Analysis Agent}
Event : OnHelpCommand
TransportAgents : {}
Event : OnNoopCommand
TransportAgents : {}
Event : OnReject
TransportAgents : {Protocol Analysis Agent}
Event : OnRsetCommand
TransportAgents : {Protocol Analysis Agent}
Event : OnDisconnectEvent
TransportAgents : {Protocol Analysis Agent}
Event : OnSubmittedMessage
TransportAgents : {RMS Decryption Agent, Malware Agent, Text Messaging Routing Agent, RMS Encryption Agent, Journal
Agent}
Event : OnResolvedMessage
TransportAgents : {Prioritization Agent, Transport Rule Agent, Index Routing Agent}
Event : OnRoutedMessage
TransportAgents : {RMS Encryption Agent, Prelicense Agent, Journal Agent, Redirection Agent}
Event : OnCategorizedMessage
TransportAgents : {Journal Report Decryption Agent, Outbound Trust Agent}
Why would they be different if both servers have the same roles? One thing I thought was that I had not enabled antispam on server 1 but I know I did. I ran the powershell command on both servers.
On a second note, does anyone know how I can get the Transport Agent to run before the Content Filter Agent?