You are using Smart Search within the PPS Admin UI to investigate the final disposition of a message. Smart Search shows the message is…

The Proofpoint system assigns a unique message Globally Unique Identifier (GUID) to every email it processes. This GUID is the most reliable and specific identifier for tracking a message's complete lifecycle, from receipt to final disposition. When a message is sent to the administrative quarantine (adqueue), using its GUID in a Smart Search query is the definitive method to locate and trace that specific message. Other identifiers like session ID or the header message ID may not be unique or persistent across all internal processing stages, making the GUID the superior choice for precise tracing.

A. The session ID (sid) identifies an entire SMTP conversation, which can contain multiple messages, making it imprecise for tracing a single email.

B. 'adqueue' is the name of the administrative quarantine folder, not a selectable rule, making this action syntactically incorrect within the user interface.

C. The message ID is part of the email header and can be forged, duplicated, or absent, making it less reliable than the system-generated GUID.

1. Proofpoint Protection Server 8.18 Administrator Guide. In the chapter on "Logging

Reporting

and Tracking

" the section "Using Smart Search" details the available search parameters. It specifies that the "GUID" is the unique identifier assigned by the Proofpoint system to each message for internal tracking purposes

ensuring precise message retrieval. (Reference: Chapter 10: Logging

Reporting

and Tracking

Section: "Smart Search Fields

" pp. 350-352).

2. Proofpoint Protection Server 8.18 Administrator Guide. The guide's appendix on system queues and folders defines "adqueue" as the administrative quarantine. Messages here are held for administrator review and are not visible to end-users

necessitating a precise search method like the GUID for investigation. (Reference: Appendix C: Directories and Files

Section: "Quarantine Directories

" p. 621).

3. Proofpoint Certified Administrator - Email Protection Courseware (TPAD01). The official training module on "Message Tracing and Analysis" explicitly instructs administrators to use the message GUID as the primary and most accurate method for tracking a message's path and final disposition within the Proofpoint environment

especially for quarantined items. (Reference: Module 4: Message Tracing

Topic: "Leveraging Smart Search for Investigations").