Re: Funny IMF V2 filtering

What do you mean by Gateway action? I have a SBS 2003, so everything is in
the same box. i.e. ISA, Exchange, internal and external network, no dmz. 2
NIC of course.

I have set Global Settings > Message Delivery Properties > IMF > Gateway
Blocking Configuration > SCL rating 8 and When blocking messages - Archive.
Never choose Reject or Delete since day one.

Yes, diagnostic logging is set to medium or higher. But it shouldn't affect
the way incoming messages are handled.

Some messages were archived to the UceArchive folder, so I assume IMF was
functioning properly in those cases. What bugs me are those emails got
rejected 'intelligently'.


"Bharat Suneja [MVP]" <bharat@xxxxxxxxxx> wrote in message
news:%23rrNE8YmHHA.596@xxxxxxxxxxxxxxxxxxxxxxx
Double-check your Gateway action. 7512 is logged when rejecting/deleting
if diagnostics logging for Transport is bumped up to medium or higher.
--
Bharat Suneja
MVP - Exchange
www.zenprise.com
NEW blog location:
exchangepedia.com/blog
------------------------------


"saigontuna" <saigontuna@xxxxxxxxxxxx> wrote in message
news:46445c01@xxxxxxxxxxxx
That's exactly the funny part. For the whole time, the IMF was set to
Archieve messages that it intercepts. Why would it Rejected/Deleted a
message as indicated in the following event (ID:7512)?

Event Type: Information
Event Source: MSExchangeTransport
Event Category: SMTP Protocol
Event ID: 7512
Date: 10/5/2007
Time: 14:59:20
User: N/A
Computer: P4S0101
Description:
The message with ID <00cf01c792d0$ada2f7e0$1600a8c0@o22>, P1 From
smtp:golden_shine@xxxxxxxx, Subject 1359, from remote host "P4S0101" was
Rejected/Deleted by Intelligent Message Filter. This is an informational
event and does not indicate an error.

For more information, click http://www.microsoft.com/contentredirect.asp.

Thanks.

"Bharat Suneja [MVP]" <bharat@xxxxxxxxxx> wrote in message
news:%23xwOMqmkHHA.4112@xxxxxxxxxxxxxxxxxxxxxxx
- How did you determine IMF blocked/deleted the earlier message?
- Did you try having the same original message resent to the original
recipient? Did that work the second time?
- Set IMF Gateway action to Archive and test to figure out if it is
indeed blocked by IMF.
- No, there's very little control of IMF and the SCLs it assigns. You
can have mail from a particular sending host bypass Connection Filtering
and Content Filtering (IMF) by adding its IP address in Connection
Filtering's Global Accept List and enabling Connection Filtering on SMTP
Virtual Server.
- You can raise/lower SCL values based on certain keywords using the
Custom Weighting feature. Requires creating
MsExchange.UceContentFilter.xml file. Syntax and details in SP2 Release
Notes
(http://download.microsoft.com/download/f/b/5/fb5c54af-fe5c-48e9-be97-f9e8207325ab/Ex_2003_SP2_RelNotes.htm).
Make sure you save it in the correct format (xml) with the correct
encoding. Also note, it's required to copy the file to the new folder
created by each IMF update.
--
Bharat Suneja
MVP - Exchange
www.zenprise.com
NEW blog location:
exchangepedia.com/blog
------------------------------


"saigontuna" <saigontuna@xxxxxxxxxxxx> wrote in message
news:4641fc29$1@xxxxxxxxxxxx
An user recently reported that she can't recieve mail from a particular
sender. But when she asked the same sender to resend (forward) the
same message to a colleague, it succeeded. Through my investigation, I
found:

1. She didn't set any rules to filter any message in her Outlook 2003;
2. Server has IMF V2 and other Exchange 2003 SP2 built-in mechanisms
enabled;
3. IMF blocked and deleted the message the first time it recieved the
message but allowed it when resend by the sender.

I want to know why IMF filter the message the first time but not the
subsequent resend? How come IMF rated the same message differently?
How can I control?

Thanks.









.

Relevant Pages

  • Re: IMF blocking email
    ... I apologize I am not a full time Exchange admin so I do not understand the ... After adding the problem email address to my registry the filter did not stop ... In Ex2003 IMF your only option is to use IPs. ... unleash its full power. ...
    (microsoft.public.exchange.admin)
  • Re: SCL is being stored when IMF is off.
    ... Of course I am biased here cause IMF Tune sets the SCL property as well;) But since this is documented by MS in their SDK there is no question about that... ... IMF Tune - Enable the Exchange 2003 IMF/Exchange 2007 Content Filter to unleash its full power. ...
    (microsoft.public.exchange.admin)
  • Re: Funny IMF V2 filtering
    ... 7512 is logged when rejecting/deleting if diagnostics logging for Transport is bumped up to medium or higher. ... The message with ID, P1 From smtp:golden_shine@xxxxxxxx, Subject 1359, from remote host "P4S0101" was Rejected/Deleted by Intelligent Message Filter. ... Set IMF Gateway action to Archive and test to figure out if it is indeed blocked by IMF. ... IMF blocked and deleted the message the first time it recieved the message but allowed it when resend by the sender. ...
    (microsoft.public.exchange.setup)
  • RE: IMF Setup
    ... I understand that you want to set the IMF do ... not filter the inbound SMTP mails from specify domain. ... Microsoft Exchange Server Intelligent Message Filter v2 Operations Guide ...
    (microsoft.public.windows.server.sbs)
  • Re: Spam detection and deletion
    ... This is free an included with Exchange SP2. ... Do you mean you want spam filtered to the Junk Email folder? ... IMF supports that. ... IMF Tune - Unleash the Full Intelligent Message Filter Power ...
    (microsoft.public.exchange.admin)