How to Create an Intelligent Message Filter

How to Create an Intelligent Message Filter

1. Start Exchange System Manager from Start>Programs> Microsoft Exchange.

2. Navigate Global Settings> Message Delivery.

3. Right-click Message Delivery, and then select Properties. Note: you won’t see Intelligent Message Filtering, if you are running System Manager from a workstation or you don’t have Exchange SP2 installed on the server.

4. Click the Intelligent Message Filtering tab.

5. Under Gateway Blocking Configuration, in Block messages with an SCL rating greater than or equal to, select a number to set the threshold for the action taken at the gateway on messages.

Notes: 1) Selecting a lower number for the SCL rating blocks more messages that could be UCE, but it also increases the likelihood of false positives, which are legitimate messages that Intelligent Message Filter marks as UCE.

2) Selecting a higher number for the SCL rating blocks fewer messages that could be UCE, but it reduces the likelihood of false positives.

6. Under Gateway Blocking Configuration, in When blocking messages, select the action that you want Intelligent Message Filter to take when it assigns a message an SCL rating above the specified threshold. There are 4 actions:

1) Select Archive to archive all messages marked as UCE with a rating above the specified threshold. Archived messages are saved to the archive directory. This directory is in the root directory of the Queue directory specified on the Messages tab of the SMTP virtual server properties. By default, the archive directory is Exchsrvr\Mailroot\vsi n\UCEArchive, where n is the SMTP virtual server instance number. By default, the \Exchsrvr directory is created in the drive letter:\Program Files parent directory. You can review messages in the archive directory by opening them in Notepad or using Microsoft Outlook Express. If you discover a legitimate e-mail message that has been archived, you can resubmit the message by putting it in the Exchsrvr\Mailroot\vsi n\pickup directory. The SMTP service will then deliver the e-mail message to the appropriate mailbox.

2) Select Delete to delete all messages marked as UCE with a rating greater than the specified threshold. The message is accepted by Exchange Server and is then deleted. Neither the sender nor the intended recipient is notified that the message has been deleted.

3) Select No Action to take no action on messages marked as UCE with a rating greater than the specified threshold. This UCE rating is saved with the other message properties and these properties are sent with the message to other Exchange servers. Exchange mailbox servers use the UCE rating and the settings specified in Store Junk E-mail Configuration to determine whether to deliver a message to a user's Inbox or the Junk E-mail folder.

4) Select Reject to reject the message at the gateway. Exchange Server rejects the message during the SMTP session, and the connecting SMTP server is then responsible for delivering the non-delivery report to the sender.

7. Under Store Junk E-mail Configuration, in Move messages with an SCL rating greater than or equal to, specify the threshold above which incoming messages are moved to a user's Junk E-mail folder, unless the sender appears on a user's safe senders list. These settings work similar to the settings in Gateway Blocking Configuration. Select a threshold above which an Exchange Server mailbox store moves messages to a user's Junk E-mail folder based on the following criteria:

• Selecting a lower number for the SCL rating reduces the amount of UCE delivered to a user's Inbox, but it also increases the probability of false positives being moved to a user's Junk E-mail folder. Therefore, legitimate e-mail messages can unintentionally be moved to the user's Junk E-mail folder when you select a setting to move more UCE.

• Selecting a higher number for the SCL rating increases the amount of UCE delivered to a user's Inbox, but it also decreases the likelihood of false positives being delivered to a user's Junk E-mail folder.

Post your questions, comments, feedbacks and suggestions

Contact a consultant