Using IMF in conjunction with Trend CSM

Hello!

I have Trend CSM 3.0 SP1 (build 1147) on my SBS 2003 server and some of my
clients' SBS 2003 servers.

By default, the SMEX portion of Trend CSM will create a "Spam Folder" in
each users' mailbox. This is the End User Quarantine, or EUQ. What I found
was that most users failed to check that folder for possible false
positives, or they did not even see the folder in Outlook because they had
so many folders above it. "Out of sight, out of mind" seems to be the phrase
that applies here.

So what I have done is remove the EUQ and then re-install it, but I named
the folder as * Possible Spam during the re-installation of the EUQ (that is
"* Possible Spam" without the quotation marks) so it stays at the top of the
Outlook folders. Now everyone sees it and checks it.

The problem now is that some users get 5000 messages every two weeks
(according to the SBS usage report) and most of that is spam. In order to
reduce the time they spend looking for legitimate messages, I have
implemented Connection Filtering (sbl-xbl.spamhaus.org) as well as the IMF
in Exchange SP2. Recipient Filtering was added a long time ago with
tarpitting (I know the end user never sees the result).

I have the IMF set to archive messages over SCL 6 (I may go to 7) and move
to Junk at 5. So far, an SCL of 6 has only trapped one valid message, and
that was from Backup Exec running on the same server (see thread "Strange
IMF Behavior").

Trend EUQ still has a bunch of spam in it as well. I have Outlook set to
show the SCL and I am reviewing those caught by Trend to see if I can safely
lower the gateway SCL in IMF.

Currently, users have to look in two places to make sure no valid message
got flagged as spam. I wish Trend's product would integrate better into
Outlook so users could look in one location and use one method to approve
and/or block mail. I though about naming the Trend EUQ as "Junk E-mail"
folder so everything goes into one box, but then I get the "out of sight..."
problem again, and I am not sure what would happen if both IMF and Trend
dumped into that folder, since they have different methods of approving
users.

How have the rest of you Trend CSM users been handling this concern?

Gregg Hill



.

Relevant Pages

  • Re: TrendMicro Spam Folder vs. Junk Mail Folder
    ... Using both folders is using one folder too many for most users;-). ... to disable EUQ in Trend, ... superior spam protection to Trend Anti-Spam. ... Les Connor [SBS Community Member - SBS MVP] ...
    (microsoft.public.windows.server.sbs)
  • Re: Spoofing e-mail revisited
    ... Trend so I put a call in. ... I configured Trend to send the quarantined items to the desktop junk folder ... and not the server-side quarantine folder. ... Advanced & am getting hammered by spam. ...
    (microsoft.public.exchange.admin)
  • Re: Using IMF in conjunction with Trend CSM
    ... I think if you have the JMF threshold set in IMF to a number less than ... though - so the best method is to look at the message header - the trend A/S ... because some users have spam in their junk email ... Use the JMF folder in Outlook *only* for spam or unwanted email that ...
    (microsoft.public.windows.server.sbs)
  • Re: Error Message
    ... OK...what I am saying here is that my anti virus program includes a spam ... spam folder, instead of cluttering and defiling my inbox. ... Is my computer still protected against viruses if I disable Email Scanning? ... MS-MVP Outlook Express ...
    (microsoft.public.windows.inetexplorer.ie6_outlookexpress)
  • Re: Using IMF in conjunction with Trend CSM
    ... Turn JMF *off* in Outlook. ... Use the JMF folder in Outlook *only* for spam or unwanted email that makes ... This way, EUQ and JMF don't fight over spam, spreading it over both ...
    (microsoft.public.windows.server.sbs)