Exchange filter

[Busybub]

I am currently looking into getting some filtering for our email and looking at what options are available (have posted another thread in the *nix forum).

 

Does anybody know of any software based stuff which runs on Exchange 2003 which scans email for keywords, phrases, and attachments of incoming and outgoing traffic?

 

Budget is limited to a one-time spend. Anything that requires license renewal is going to be a hard sell to SLT (unless it is cheap for 200 users).

 

Cheers!

[djm968]

Exchange 2003 SP2 includes the Exchange Intelligent Message Filter, it does a reasonable job of reducing spam and its free!

 

See the link below for more info.

 

http://www.microsoft.com/technet/prodtechnol/exchange/downloads/2003/imf/default.mspx

[Guest]

yes we use that and in all honesty i dont think its made any difference,

typical microsoft after thought as all settings for it need to be set via registry settings.

[djm968]

misterbusy-2

 

Not sure why it is not working for you and why you need to mess with the registry at all. I have implemented IMF at a number of sites with reasonable results.

 

You may have the SCL set too high. I am not say it is perfect by a long way but if its not catching any UCE at all, something must be wrong with your implementation.

[Busybub]

Thanks DJM, have downloaded a copy and will have a stab at it early next week, I'm getting heat from everybody right now *argh*

 

From what I can see it will do anti spam stuff for incoming, but what about scanning outgoing stuff? Can't see any references to this, and this is the bulk of the problem at the moment.

[djm968]

I did say it’s not perfect! Most sites will employ IMF and a third party solution along side exchange as part of their anti-spam strategy.

 

The link below provides additional info about Exchange IMF and some useful links for third party solutions.

 

http://www.msexchange.org/tutorials/microsoft-exchange-intelligent-message-filter.html

 

Also get the IFM manager from http://www.gotdotnet.com/workspaces/workspace.aspx?id=e8728572-3a4e-425a-9b26-a3fda0d06fee this utility provides a GUI to manage the IMF archive.

[BKGarry]

We Use GFI Mail Essentials here, gave us more flexibilty the IMF, and TBH i didn't notice any difference when i just had IMF.

 

Gaz

[Guest]

misterbusy-2

 

Not sure why it is not working for you and why you need to mess with the registry at all. I have implemented IMF at a number of sites with reasonable results.

nor am i but we had to edit registry to set a word to look for ( SPAM)

which was marked by our other spam software gfi mail essentials

[BKGarry]

Well i don't know what you have done, but all of my GFI mail items goes to the Outlook/Echange Junk Email folder, but also there was a tool with our GFI that allowed you to set a rule for any Flagged up messages to be moved to certain folders

 

Gaz

[djm968]

I run IMF and Antigen on my Exchange server and to date IMF has filtered 13982 messages since I installed it back in 21st August 2006.

 

I currently only have around 10 active mailboxes on our server, to me this proves that it must be doing something.

[Guest]

yes i had problems with my install of gfi because we had only licences for staff members so couldnt install in SMTP mode and hence it marks emails but doesnt move to junk folder in outlook as its on front end exchange server,

it also picks up so many false positives that we are thinking of replacing GFI this year

[Patrizia]

Hi,

 

GFI MailEssentials in SMTP mode can still route emails to the users' junk mail folder by tagging the emails as SPAM and then using the Rules Manager in order to route the emails to the users' junk mail folder.

 

Regarding the false positives, can you ensure that you are using the whitelist and auto-whitelist features? The auto-whitelist would be able to decrease the amount of false postivies drastically since if a users sends out an email to an external recipient, this external recipient will be automatically whitelisted therefore avoiding that future emails from this sender get blocked as spam.

 

Also which module is causing the false positives? If for example, the false postives are being blocked by the Bayesian filter, you would need to train the Bayesian with more legitimate emails in order to reduce the false positives.