MORE INFORMATION
Additional information
The Microsoft Exchange Intelligent Message Filter Deployment Guide is located at
http://go.microsoft.com/fwlink/?LinkId=27922The Microsoft Exchange Web site (
http://www.microsoft.com/exchange) provides product and licensing information about Exchange, including white papers, product literature, Exchange-related events, service packs, and more. Visit the site often for new and updated content.
The Exchange Server 2003 Technical Documentation Library (
http://www.microsoft.com/exchange/library) is your one-stop source for technical documentation about Exchange Server 2003. The library is a catalog of technical Exchange content that has been reviewed and approved by the Exchange product team at Microsoft.
back to the topPrerequisites
Intelligent Message Filter requires the following software:
back to the topUninstalling Intelligent Message Filter
To uninstall Intelligent Message Filter, use
Add or Remove Programs in
Control Panel. The account that was used to install Intelligent Message Filter must also be used to uninstall the filter. No other accounts will see Intelligent Message Filter in
Add or Remove Programs.
Removing Intelligent Message Filter does not remove Active Directory objects that were created during the first installation of the filter.
back to the topKnown issues with Intelligent Message Filter
At the time of release, the following are known issues with Intelligent Message Filter.
.NET Framework dependency
To install the Management Tools for Intelligent Message Filter on an Exchange System Administration Console, you must have .NET Framework 1.1 installed. For more information about the .NET Framework, visit
http://www.microsoft.com/net.
Integrated help files are only in English
The help integrated with Management Tools for Intelligent Message Filter always displays in English, regardless of which language-specific MSI package was installed.
After installation, the FTP Publishing service is not restarted
Intelligent Message Filter installation stops the IIS Admin service. The following services are restarted after installation has completed.
- Simple Mail Transfer Protocol service (smtpsvc)
- Network News Transfer Protocol service (nntpsvc)
- Microsoft Exchange Post Office Protocol version 3 service (pop3svc)
- Microsoft Exchange Routing Engine Service (resvc)
- Microsoft Exchange Internet Message Access Protocol Service (imap4svc)
The FTP Publishing service is not restarted. Services that were previously disabled will not be restarted.
Changes to the gateway threshold inadvertently report that the store threshold was modified
When a change is made to the gateway threshold, the Exchange store reports that the store threshold has been modified in the event log even if it has not been modified. Following is a description of the event:
The Unsolicited Commercial Email default filter level has been updated. The new value is
n.This event is recorded because the user interface (UI) rewrites both values in Active Directory regardless of whether the store threshold value has changed. The Exchange store is notified of the change and writes the event entry.
All Internet messages are being moved into the Outlook Junk E-mail folder even though the threshold has been set to a number higher than 0
After installing Intelligent Message Filter, Active Directory is updated with the gateway and store threshold values. The MSExchangeIS service must be restarted so that changes to these values are registered with the store. This applies to any application that is installed that uses the SCL infrastructure within Exchange Server 2003.
Exchange Intelligent Message Filter performance counters do not appear in System Monitor
The Intelligent Message Filter System Monitor counters only appear in System Monitor after a message has been processed by Intelligent Message Filter.
The UI contains incorrect SCL rating text for the store threshold
The "Store Junk E-Mail Configuration" section of the UI incorrectly states "Move messages with an SCL rating greater than or equal to." The correct text should be the following (corrected text in bold): "Move messages with an SCL rating
greater than."
back to the topKnown issues with the Microsoft Exchange Intelligent Message Filter Deployment Guide
Evaluation of SCL rating by the gateway threshold is not correct
In the "How Intelligent Message Filter Works" section, the following incorrect statement is made: "If a message has a rating higher than the gateway threshold, Intelligent Message Filter takes the action specified."
The following text (in bold) is the correct text: "If a message has a rating
greater than or equal to the gateway threshold, Intelligent Message Filter takes the action specified."
In the "How Intelligent Message Filter Works with Exchange 2003 and Outlook Filtering Features" section, the evaluation of the SCL rating in item 6 is incorrect. The following text (in bold) is the correct text:
6. ...
- If Intelligent Message Filter assigns the message an SCL rating that is greater than or equal to your gateway threshold, Intelligent Message Filter takes the appropriate gateway action.
- If Intelligent Message Filter assigns the message an SCL rating that is lower than your gateway threshold, the message is passed to the Exchange server with the user's mailbox store.
Screenshots of the UI contain incorrect SCL rating text for the store threshold
The "Store Junk E-Mail Configuration" section of the UI incorrectly states "Move messages with an SCL rating greater than or equal to." The correct text should be the following (corrected text in bold): "Move messages with an SCL rating
greater than."
How Intelligent Message Filter works with Outlook filtering features needs clarification
In the "How Intelligent Message Filter Works with Exchange 2003 and Outlook Filtering Features" section, the following statements are made: "If a user is running an earlier version of Outlook, the safe senders and blocked senders lists are not available. Any message marked as spam is delivered directly to the user's Inbox."
Following is text that provides further clarification about this interaction: "If a user is running an earlier version of Outlook than 2003, the Safe Senders and Blocked Senders lists cannot be modified from that e-mail client, however, these lists can be modified using Outlook Web Access 2003. If Outlook Web Access 2003 is used in this way to enable junk e-mail filtering, messages whose sender is on the Blocked Senders list or are marked as spam will be delivered to the user's Junk E-mail folder. Messages marked as spam whose sender is on the Safe Senders list will be delivered to the user's Inbox. If Outlook Web Access 2003 has not been used to enable junk e-mail filtering, every message, including those marked as spam, is delivered directly to the user's Inbox."
Table 5.2 is incorrect
Table 5.2 in the guide is incorrect. Use the following table.
| Counter | Description |
| Total Messages Scanned for UCE | The total number of messages scanned by Intelligent Message Filter. If this number is 0 or very low, Intelligent Message Filter may not be functioning properly. |
| Messages Scanned for UCE/sec | The number of messages scanned per second by Intelligent Message Filter. This counter indicates how quickly Intelligent Message Filter is operating. |
| Total UCE Messages Acted Upon | The total number of messages that Intelligent Message Filter has identified as UCE and acted upon, based on the action specified by an administrator. |
| UCE Messages Acted Upon/sec | The number of messages acted upon per second by Intelligent Message Filter. This counter indicates how quickly Intelligent Message Filter takes action on messages identified as UCE. |
| % UCE out of Total Messages Scanned | The percentage of the total number of messages scanned by Intelligent Message Filter that were identified as UCE. |
| % UCE of Messages Scanned in the previous 30 minutes | The percentage of the number of messages scanned by Intelligent Message Filter in the previous 30 minutes that were identified as UCE. |
| Total Messages Assigned an SCL Rating of X | The total number of messages scanned by Intelligent Message Filter that were assigned a spam confidence level (SCL) rating of x, where x is a spam rating of 0 to 9. |
back to the topFrequently asked questions
Do I have to install Intelligent Message Filter on all Exchange 2003 servers?
No, Intelligent Message Filter only needs to be installed on Internet-facing servers. These are the servers within your Exchange topology that are the first to receive mail from the Internet.
How does Outlook 2003 work with Intelligent Message Filter?
Microsoft Office Outlook® 2003 Junk E-mail settings/actions are different from Intelligent Message Filter actions because Outlook uses its own version of SmartScreenT technology. The SCL set by Intelligent Message Filter is used in conjunction with the user-specified Safe Senders, Safe Recipient, and Blocked Senders lists. These lists can be configured using Outlook 2003 or Outlook Web Access 2003.
For more information about how Intelligent Message Filter works with Outlook 2003, see the "How Intelligent Message Filter Works with Exchange 2003 and Outlook Filtering Features" section of the Microsoft Exchange Intelligent Message Filter Deployment Guide located at
http://go.microsoft.com/fwlink/?LinkId=27922.
Do exception addresses under connection filtering affect Intelligent Message Filter behavior?
Exception e-mail addresses under connection filtering have no effect on Intelligent Message Filter behavior.
Does Allow Address under connection filtering affect Intelligent Message Filter behavior?
IP Allow addresses under connection filtering allows mail to bypass Intelligent Message Filter, which results in messages that have no SCL value stamped on them. These messages can be filtered by Outlook 2003 Junk E-mail rules. Intelligent Message Filter does not specify an SCL by design because content scanning was actually bypassed. In this case, setting an SCL of 0 would not be an accurate value from Intelligent Message Filter.
Why do some messages get a SCL rating of -1?
Messages submitted to Exchange using authenticated credentials receive an SCL value of -1. All users that submit messages from authenticated clients such as Outlook or Outlook Web Access will receive an SCL stamp of -1. This ensures that authenticated messages will not be moved to the Junk E-mail folder.
Internal applications should submit mail using authentication to prevent the messages from being treated as junk e-mail, which would occur if the messages either (1) don't go through Intelligent Message Filter and do not receive an SCL value, or (2) they go through Intelligent Message Filter and get a value that is high enough that an action is taken on the message that either prevents it from being delivered to the recipient or moves it to the user's Junk E-mail folder.
For more information about connection filtering and controlling spam, see the Exchange Server 2003 Transport and Routing Guide at
http://go.microsoft.com/fwlink/?LinkId=26041.
Is the SCL rating an Intelligent Message Filter feature?
No, the SCL rating is an Exchange Server 2003 feature. Intelligent Message Filter is the first Microsoft application that uses the SCL rating. Third-party applications can also stamp the SCL rating on messages. For more information about the Anti-Spam infrastructure and SCL values, see the Anti-Spam section of the Exchange Server 2003 SDK.
How is the SCL information transferred between Exchange servers?
SCL information is transmitted as part of the EXCH50 blob between Exchange 2000 and/or Exchange 2003 servers. EXCH50 blobs can only be transmitted across authenticated connections that have SendAs rights.
However, if there is a device in between the Exchange servers that does not support EXCH50, the SCL rating will be lost.
Can I use Intelligent Message Filter to filter messages sent to public folders?
No, because junk e-mail rules cannot be created for public folders.
back to the top