Re: Using IMF in conjunction with Trend CSM

The users could be putting it there manually though. (r-click and select
block sender). I use that method, just to keep track of what isn't picked up
by any of the layers of anti-spam.

Also, I think if you have the JMF threshold set in IMF to a number less than
the reject setting, you can expect some mail to be delivered to the users
JMF. AFAIK, that works even when the JMF is turned off client-side.

It's possible you might be able to tell which mail in JMF would_have bee
picked up by Trend Anti-Spam, by the icon. It doesn't seem to work reliably
though - so the best method is to look at the message header - the trend A/S
yes/no is stamped there, as well as the A/S version number.

--
Les Connor [SBS Community Member - SBS MVP]
-----------------------------------------------------------
SBS Rocks !
----------------------
"Tell me and I'll forget. Show me and I'll remember. Involve me and I'll
understand." - Confucius


"Gregg Hill" <bogus@xxxxxxxxxxx> wrote in message
news:OipHwPe%23GHA.4740@xxxxxxxxxxxxxxxxxxxxxxx
Hi, Les!

I had forgotten that I actually do have the Junk email set to "No
Protection" via a GPO to prevent them having to look in two places. It
must not be working, because some users have spam in their junk email
folder.

I will look at their setup again next week.

Gregg Hill



"Les Connor [SBS Community Member - SBS MVP]" <les.connor@xxxxxxxxxxxx>
wrote in message news:evrSQjI%23GHA.1168@xxxxxxxxxxxxxxxxxxxxxxx
I'd recommend not using the Outlook JMF if you're using EUQ - it just
confuses the issue (and the end user).

1. Connection filtering (spamhaus is good).
2. IMF set to reject at whatever number you feel good about *and* set the
JMF to the same number.
3. Recipient filtering
4. Trend Anti-Spam <high>
5. Turn JMF *off* in Outlook.

Use the JMF folder in Outlook *only* for spam or unwanted email that
makes it through to the inbox - the end user then only needs to r-click
the message and send to JMF folder.

This way, EUQ and JMF don't fight over spam, spreading it over both
folders. And, it's a good way to see how much spam actually makes it
through to the Inbox, as these are stored in Outlooks JMF by the user.

If you're getting more than 5-10 spams a day into the inbox, then IMHO
the solution isn't working and you may need to tighten up if you can, or
implement other measures. Same with EUQ, you should be able to achieve
10-20 per day there.

--
Les Connor [SBS Community Member - SBS MVP]
-----------------------------------------------------------
SBS Rocks !
----------------------
"Tell me and I'll forget. Show me and I'll remember. Involve me and I'll
understand." - Confucius


"Gregg Hill" <bogus@xxxxxxxxxxx> wrote in message
news:%23a9Ts5H%23GHA.4404@xxxxxxxxxxxxxxxxxxxxxxx
Hello!

I have Trend CSM 3.0 SP1 (build 1147) on my SBS 2003 server and some of
my clients' SBS 2003 servers.

By default, the SMEX portion of Trend CSM will create a "Spam Folder" in
each users' mailbox. This is the End User Quarantine, or EUQ. What I
found was that most users failed to check that folder for possible false
positives, or they did not even see the folder in Outlook because they
had so many folders above it. "Out of sight, out of mind" seems to be
the phrase that applies here.

So what I have done is remove the EUQ and then re-install it, but I
named the folder as * Possible Spam during the re-installation of the
EUQ (that is "* Possible Spam" without the quotation marks) so it stays
at the top of the Outlook folders. Now everyone sees it and checks it.

The problem now is that some users get 5000 messages every two weeks
(according to the SBS usage report) and most of that is spam. In order
to reduce the time they spend looking for legitimate messages, I have
implemented Connection Filtering (sbl-xbl.spamhaus.org) as well as the
IMF in Exchange SP2. Recipient Filtering was added a long time ago with
tarpitting (I know the end user never sees the result).

I have the IMF set to archive messages over SCL 6 (I may go to 7) and
move to Junk at 5. So far, an SCL of 6 has only trapped one valid
message, and that was from Backup Exec running on the same server (see
thread "Strange IMF Behavior").

Trend EUQ still has a bunch of spam in it as well. I have Outlook set to
show the SCL and I am reviewing those caught by Trend to see if I can
safely lower the gateway SCL in IMF.

Currently, users have to look in two places to make sure no valid
message got flagged as spam. I wish Trend's product would integrate
better into Outlook so users could look in one location and use one
method to approve and/or block mail. I though about naming the Trend EUQ
as "Junk E-mail" folder so everything goes into one box, but then I get
the "out of sight..." problem again, and I am not sure what would happen
if both IMF and Trend dumped into that folder, since they have different
methods of approving users.

How have the rest of you Trend CSM users been handling this concern?

Gregg Hill









.

Relevant Pages

  • Re: Using IMF in conjunction with Trend CSM
    ... They have been put in the list manually over the past year or so before IMF ... Did Trend also tag them as spam ... JMF in outlook work. ... Use the JMF folder in Outlook *only* for spam or unwanted email that ...
    (microsoft.public.windows.server.sbs)
  • Using IMF in conjunction with Trend CSM
    ... was that most users failed to check that folder for possible false ... the folder as * Possible Spam during the re-installation of the EUQ (that is ... Trend EUQ still has a bunch of spam in it as well. ... users have to look in two places to make sure no valid message ...
    (microsoft.public.windows.server.sbs)
  • Re: Using IMF in conjunction with Trend CSM
    ... Trend also tag them as spam ... They're only in there because that's the default way JMF ... Les Connor [SBS Community Member - SBS MVP] ... Use the JMF folder in Outlook *only* for spam or unwanted email that ...
    (microsoft.public.windows.server.sbs)
  • Re: TrendMicro Spam Folder vs. Junk Mail Folder
    ... Using both folders is using one folder too many for most users;-). ... to disable EUQ in Trend, ... superior spam protection to Trend Anti-Spam. ... Les Connor [SBS Community Member - SBS MVP] ...
    (microsoft.public.windows.server.sbs)
  • Re: Spoofing e-mail revisited
    ... Trend so I put a call in. ... I configured Trend to send the quarantined items to the desktop junk folder ... and not the server-side quarantine folder. ... Advanced & am getting hammered by spam. ...
    (microsoft.public.exchange.admin)