Re: IMF configuration ?

Dan Shallbetter wrote: 
Hello Nathan,

I followed your instructions as a result I set my IMF filters at 8 with an action of archive. Is there a tool to review messages in the UCEArchive folder? I would also like to configure connection filtering using Spamhaus, is there a related KB article? Also clients have been receiving a fair amount of sexually explicit e-mails do you have any recommendations for that problem?

Thank You

""Nathan Liu [MSFT]"" wrote:


Hi Dan,

Thank you for your kind update.


Some messages in my inbox have no SCL score. 

1.  Does this issue occur with all users or certain users?

2. Please perform the following steps to create a Outlook Profile and then check if the issue can be reproduced:

Create a new profile
=====================
A. Remove all the existing Outlook profiles in Control Panel | Mail | Show Profiles.
NOTE: You may export the rules for the user in the old profile before you delete the profile, so that you can then import them to the new profile. To do so:
a. Open Outlook, click Tool and then click Rules and Alerts....
b. Click Options.
c. Click Export Rules.
d. Close Outlook.

B. Make sure Outlook is closed.

C. Open Windows Explorer and go to "C:\Program Files\Microsoft Windows Small Business Server\Clients", double-click SBSDefault.prf, this will automatically create the outlook profile with the correct settings for the corresponding domain user.

More information:
How to create a new e-mail profile in Outlook 2003
http://support.microsoft.com/?id=829918



Some message in my junk e-mail folder have a SCL of 3 or less.

As you mentioned, your Junk e-mail setting is currently set to high, please note that this issue is related to your Junk Email's settings, you can set the Junk email setting to Low, or you can add these senders into "Safe Senders" list. 

Please also check the following information to know how IMF works.

1. If a message is not filtered by connection, recipient, or sender filtering, Intelligent Message Filter is applied, and one of two things happens at the gateway:

1). If Intelligent Message Filter assigns the message an SCL rating that is higher than your gateway threshold, Intelligent Message Filter takes the appropriate gateway action.

2). If Intelligent Message Filter assigns the message an SCL rating that is lower than or equal to your gateway threshold, the message is passed to the Exchange server with the user's mailbox store.

2. If a user is using Outlook 2003 or Outlook Web Access with Exchange 2003, the user's mailbox store compares the message's SCL rating with the store threshold you configured, and one of two things happens:

1). If the message rating is lower than or equal to the store threshold, the mailbox store checks the user's blocked senders list configured in Outlook or Outlook Web Access, and one of two things happens:

- If the sender of the message is not on a blocked senders list configured in Outlook or Outlook Web Access, or if a blocked senders list is not available or defined, the message is delivered to the recipient's Inbox.

- If the sender appears on the blocked senders list configured in Outlook or Outlook Web Access, the message is delivered to the user's Junk E-mail folder.

2). If the message rating is higher than the store threshold, the mailbox store checks the user's safe senders list configured in Outlook or Outlook Web Access, and one of two things happens:

- If the sender appears on the safe senders list, the message is delivered to the recipients Inbox.

- If the sender does not appear on the safe senders list or if a safe senders list is not available or defined, the message is delivered to the recipient's Junk E-mail folder.



Is there any benefit to setting up the performance report on the server?

Please kindly refer to the "Chapter 5 - Monitoring and Troubleshooting Intelligent Message Filter" in the following White paper:

Microsoft Exchange Intelligent Message Filter Deployment Guide
http://www.microsoft.com/downloads/details.aspx?FamilyId=B1218D8C-E8B3-48FB-
9208-6F75707870C2&displaylang=en


I appreciate your time and cooperation. If anything is unclear, please feel free to let me know. I am looking forward to hearing from you.

Best regards,

Nathan Liu (MSFT)
Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security
======================================================
This newsgroup only focuses on SBS technical issues. If you have issues regarding other Microsoft products, you'd better post in the corresponding newsgroups so that they can be resolved in an efficient and timely manner. You can locate the newsgroup here: http://www.microsoft.com/communities/newsgroups/en-us/default.aspx

When opening a new thread via the web interface, we recommend you check the "Notify me of replies" box to receive e-mail notifications when there are any updates in your thread. When responding to posts via your newsreader, please "Reply to Group" so that others may learn and benefit from your issue.

Microsoft engineers can only focus on one issue per thread. Although we provide other information for your reference, we recommend you post different incidents in different threads to keep the thread clean. In doing so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.
======================================================
This posting is provided "AS IS" with no warranties, and confers no rights.


--------------------

Thread-Topic: IMF configuration ?
thread-index: AcX14vwDeeHiMazNQNiQ7Ysnu7RrVQ==
X-WBNR-Posting-Host: 198.144.3.30
From: =?Utf-8?B?RGFuIFNoYWxsYmV0dGVy?= 

<DanShallbetter@xxxxxxxxxxxxxxxxxxxxxxxxx>

References: <0283D8FF-7D1E-4CD5-91C4-3038FB98FC12@xxxxxxxxxxxxx> 

<Y1F9WPX9FHA.4000@xxxxxxxxxxxxxxxxxxxxx>

Subject: RE: IMF configuration ?
Date: Wed, 30 Nov 2005 11:19:28 -0800
Lines: 216
Message-ID: <794AE309-950A-4A3B-A8E0-B35CED0A4FD1@xxxxxxxxxxxxx>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="Utf-8"
Content-Transfer-Encoding: 7bit
X-Newsreader: Microsoft CDO for Windows 2000
Content-Class: urn:content-classes:message
Importance: normal
Priority: normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.0
Newsgroups: microsoft.public.windows.server.sbs
NNTP-Posting-Host: TK2MSFTNGXA03.phx.gbl 10.40.2.250
Path: TK2MSFTNGXA02.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGXA03.phx.gbl
Xref: TK2MSFTNGXA02.phx.gbl microsoft.public.windows.server.sbs:226756
X-Tomcat-NG: microsoft.public.windows.server.sbs

Nathan,

Thanks for your reply. I have applied your suggestions and notice that

some

messages in my inbox have no SCL score, and also some message in my junk e-mail folder have a SCL of 3 or less. My junk e-mail setting is currently set to high and the server is configured to do nothing. Any ideas why

these 2

issues occur? Is there any benefit to setting up the performace report on

the 

server? Is there a SBS KB that explains how?

Thank again for all your help.

""Nathan Liu [MSFT]"" wrote:


Hello Dan,

Thank you for posting in the SBS newsgroup.

According to your description, I understand that you would like to determine the appropriate threshold settings for IMF on SBS 2003 premium SP1. If I have misunderstood the problem, please don't hesitate to let

me 

know.

First of all, please kindly refer to the following information to double-check these settings:

I. I recommend you try the following steps to display the SCL Ratings

on 

the Outlook to check the SCL value of those emails:

Create a custom form and name it SCL.CFG and add the form to the Outlook client then add the SCL column.
Steps to create the SCL.CFG file:
Copy the SCL.CFG text and save it as SCL.CFG (in the same location as

the

.ICO files, usually C:\Program Files\Microsoft

Office\OFFICE11\FORMS\1033),

then follow the instructions below to install it.
SCL.CFG: - Copy the text below through "END CFG" and save it as SCL.CFG and follow the steps below. ;**********The CFG file**********
[Description]
MessageClass=IPM.Note
CLSID={00020D31-0000-0000-C000-000000000046}
DisplayName=SCL Extension Form
Category=Standard
Subcategory=Form
Comment=This forms allows the SCL to be viewed as a column
LargeIcon=IPML.ico
SmallIcon=IPMS.ico
Version=1.0
Locale=enu
Hidden=1
Owner=Microsoft Corporation
Contact=Your Name
[Platforms]
Platform1=Win16
Platform2=NTx86
Platform9=Win95
[Platform.Win16]
CPU=ix86
OSVersion=Win3.1
[Platform.NTx86]
CPU=ix86
OSVersion=WinNT3.5
[Platform.Win95]
CPU=ix86
OSVersion=Win95
[Properties]
Property01=SCL
[Property.SCL]
Type=3
NmidInteger=0x4076
DisplayName=SCL
[Verbs]
Verb1=1
[Verb.1]
DisplayName=&Open
Code=0
Flags=0
Attribs=2
[Extensions]
Extensions1=1
[Extension.1]
Type=30
NmidPropset={00020D0C-0000-0000-C000-000000000046}
NmidInteger=1
Value=1000000000000000
;**********END CFG 1. Go into Tools-> Options-> Other-> Advanced Options-> Custom Forms-> Manage Forms
2. Hit the Install button, and choose SCL.CFG ??install into your

Personal

Forms Library
3. Hit OK several times to return to the main Outlook screen
4. Right-click on the Column headings in your Inbox (other any other folder) and choose "Field Chooser"
5. Pull-down the scroll-bar and choose "Forms??"
6. Set focus to your Personal Forms, choose the SCL Extension Form, then click Add
7. Drag and drop the SCL property into your column headings and now you will see an SCL column"
8. Check the SCL of the messages.

Detailed information:
Exposing SCL (Spam Confidence Level) in Outlook
http://blogs.technet.com/exchange/archive/2004/05/26/142607.aspx

II. If you still cannot see the SCL field in the Outlook client, please also perform the following testing:

Create a new profile
=====================
A. Remove all the existing Outlook profiles in Control Panel | Mail |

Show

Profiles.
NOTE: You may export the rules for the user in the old profile before

you

delete the profile, so that you can then import them to the new profile.

To 

do so:
a. Open Outlook, click Tool and then click Rules and Alerts....
b. Click Options.
c. Click Export Rules.
d. Close Outlook.

B. Make sure Outlook is closed.

C. Open Windows Explorer and go to "C:\Program Files\Microsoft Windows Small Business Server\Clients", double-click SBSDefault.prf, this will automatically create the outlook profile with the correct settings for

the 

corresponding domain user.

More information:
How to create a new e-mail profile in Outlook 2003
http://support.microsoft.com/?id=829918

Clean Cache
=================
If the problem still occurs, it is probable that the Outlook cache files are corrupted. Let's perform the following steps to solve the problem. 1. Perform a search on your computer to find the following files: 

I handy tool : IMF Archive Manager

http://www.gotdotnet.com/workspaces/workspace.aspx?id=e8728572-3a4e-425a-9b26-a3fda0d06fee

--
Anastasios Papadopoulos - Athens - Greece
.