You Had Me At EHLO...

Good, but not great.

Any way to get the X-SCL: in the headers just like messages that are written to the archive?

Dillon - This isn't easy to do without writing a transport sink that runs after IMF has stamped the SCL property. In addition, adding the value to the message headers has the potential for information disclosure if the message bounces back to the source of the UCE.

Colin - Thanks for pointing that out. I lost that key piece of information while cutting/pasting information from Paul.

Both, config file and archive manager, are top needed tools and works nicely. Thanks for those..

But is there any way to get this SCL "gateway value" to be avalaible in OWA?

I have just finished installing the SCL to see the different levels. It works fine when directly connected to the exchange server, but does not work outside using Outlook2003 in a pop3 config. Is this possible? Regardless this will be very helpful.

Thanks,

Tim

Great, now spammers are able to abuse this value in the same way websites abuse the google page rank to get their sites listed more prominently. Being able to manipulate their mails and "score" them with ease will allow them to reduce the number of default outlook spam configurations that they trigger.

Tim -

SCL is only exposed via Mapi (Outlook Exchange mode) and via OWA (Outlook Web Access). There isn't a method to expose the property via POP/IMAP.

Andrew - SCL is only propagated between servers using xexch50 which requires an authenticated connection with SendAs permissions. As for using IMF to test their own spam and change it to get a lower score, they can do that with any bayesian filter as long as they can get their hands on the product.

AJS - I think I ran into that once as well when I had a custom filter already select. Try modifiying the Messages view and see if that works.

Quite interesting, I have this enabled in a frontend/backend scenario, and although I can see that the filter is working (i.e. by looking at the performance counters or when archiving the obvious spams), I can't seem to find an SCL rating in Outlook. When I apply this custom form field, it only shows me field entries of -1 (local deliveries) and empty fields, nothing else.

What can cause this?

James,

Thanks for the reply, I had another custom filter in from another application that caused the issue.

Another quick question for you, we have some SMTP servers setup in our internal network that sometimes send mail to the Exchange server. These messages are getting SCL levels well below the threshold set (some are 1 or 2) and the level we set is 5) but are getting filtered into junk e-mail folders. I've tried adding the entire internal network subnet into the global address list but I just saw one go into the junk. Any idea?

I experienced a similar problem. Sometimes mails with a SCL level below the threshold are moved to the junk mail folder of Outlook. The mails don’t come from the internal network. The Outlook internal filter is set to off. The same happened to several mailboxes. Is this a bug of the IMF or is it a problem of this scl.cfg?

Michael -

scl.cfg just exposes the scl column, it doesn't move the message.

If you have FE/BE topology and messages on the BE are being moved below the threshold, then you may need to restart the store on the BE server. PSS is working on a FAQ to address this and some of the other issues.

nice - thanks for this :-)

David G

Just got this sorted out.

What happened was that (thanks to extra security measures) on the backend server SMTP instance only anonymous authentication was allowed.

Turned Integrated windows back on, and SCL propagation incl. Your forms display works like charm.

Might help others, might help Peter Schmidt as well.

Exchange 2000 has no concept of the SCL MAPI property, so when the FE 2003 server sends the xexch50 blob which contains the SCL property to the BE 2000 server, this property is lost. What confuses me is your statement that you are seeing -1 for authenticated mail. Only Exchange 2003 stores will stamp that property, so I'm not quite sure why you are seeing it. My only guess is your topology may actually look like: FE e2k3 -> RG e2k -> BE e2k3

In this case the RG server is dropping the IMF stamped property, but the BE server is stamping the authenticated property.

The IMF release notes have been updated with both known issues and a FAQ section that covers most questions asked here. You can find the latest release notes here: http://download.microsoft.com/download/2/2/C/22CCB3FB-CE5F-4E23-810B-1A4AC5540C97/IntelligentMessageFilterReadmejune2004.htm

I just dont get it :(

I have a question. I have both the configuration file installed and the registry edit to view archived SCL ratings. I sent a test e-mail from one of my yahoo account to our corporate address to see what the SCL rating is on it. I noticed that the archive rating is a 4 and the 'outlook config file' is a 3. Anyone know why this may be. Just some additional info, I only have one server acting as an email server, no extra relays or anything.

How would I go about putting this form on the Exchange server and making it available to all my clients? It would be nice to enable this column in the Junk Email folder for a bunch of my power users without all the client-specific stuff if it all possible. I'm an Exchange forms neophyte, so be gentle!

Hello,

I have written an agent script which installed to a public folder (or an inbox folder) makes it possible to create a junk mail folder aswell. It has several parameters, and also allows you to tag the message subject if you want to. Here it is:


<SCRIPT RunAt=Server Language=VBScript>

'------------------------------------------------------------------------------
'
' NAME: Move spam messages
'
' FILE DESCRIPTION: Automatically move and tag incomming messages
' according to the settings below
'
' Copyright (c) Peter Suba 2004. subap@eol.hu All rights reserved.
'
' Portions:
' Copyright (c) CdoLive 1999. All rights reserved.
' Http://www.cdolive.com
' Mailto:samples@cdolive.com
'
' Copyright (c) Microsoft Corporation 1993-1997. All rights reserved.
'
'------------------------------------------------------------------------------

Option Explicit

'------------------------------------------------------------------------------
' Global Variables
'------------------------------------------------------------------------------

Dim g_bstrDebug ' Debug String

'------------------------------------------------------------------------------
' CONSTANTS
'------------------------------------------------------------------------------



' Configuration constants

Const EOL_MoveAboveSCL = 5 ' Move messages that are above this SCL
Const EOL_TagAboveSCL = 3 ' Tag messages that are above this SCL (will only work if set to lower than above set parameter!)
Const EOL_TagMoved = TRUE ' Set to true if you want to tag also message that are moved
Const EOL_TagPrefix = "**** SPAM LIKELIHOOD: %SCL%/10 **** " 'Set for tag prefix: %SCL% will be replaced by SCL value assigned to message
Const EOL_MoveToSubfolder = "Junk mail" ' Moved messages will be transfered to this folder


' MAPI property tags used in this script

Const CdoPR_SCL = &H40760003 'PT_I4 (PT_MV_I4) - reméljük stimmel


'------------------------------------------------------------------------------
' EVENT HANDLERS
'------------------------------------------------------------------------------

' DESCRIPTION: This event is fired when a new message is added to the folder
Public Sub Folder_OnMessageCreated

' Declare variables
Dim objSession ' Session
Dim objFolder ' Current folder
Dim objJunkFolder ' Junk mail folder
Dim objCurrentMsg ' Current message
Dim mSCL
Dim strPrefix
Dim objMovedMsg ' Moved message
Dim strFolderID
Dim strStoreID

' Initialize variables
Set objSession = Nothing
Set objFolder = Nothing
Set objCurrentMsg = Nothing
Set objJunkFolder = Nothing


' Clear error buffer
Err.Clear

' Get session informationen
On Error Resume Next
Set objSession = EventDetails.Session

' No errors detected ?
If Err.Number = 0 Then

' Get current message
Err.Clear
On Error Resume Next
Set objCurrentMsg = objSession.GetMessage(EventDetails.MessageID,Null)

' Error detected ?
If Err.Number <> 0 Then

' Error reading current message
Call DebugAppend("Error - Could not read message", True)
Else
mSCL = objCurrentMsg.Fields(CdoPR_SCL)
If mSCL>EOL_MoveAboveSCL Then ' Move message to subfolder
If EOL_TagMoved Then
strPrefix=Replace(EOL_TagPrefix,"%SCL%",CStr(mSCL))
objCurrentMsg.Subject = strPrefix & objCurrentMsg.Subject
objCurrentMsg.Update
End If
Set objFolder = objSession.GetFolder(objCurrentMsg.FolderID,objCurrentMsg.StoreID)
Set objJunkFolder = objFolder.Folders(EOL_MoveToSubfolder)
If Err Then 'If the folder does not yet exist then create it
Call DebugAppend("Error - get junk mail folder - creating it", True)
Set objJunkFolder = objFolder.Folders.Add(EOL_MoveToSubfolder)
Err.clear
Else
If objJunkFolder.Name <> EOL_MoveToSubfolder Then
Call DebugAppend("Error - get junk mail folder (got:<"&objJunkFolder.Name&">) - creating it", False)
Set objJunkFolder = objFolder.Folders.Add(EOL_MoveToSubfolder)
End If
End If
If objJunkFolder.Name = EOL_MoveToSubfolder Then
strFolderID = objJunkFolder.ID
strStoreID = objJunkFolder.StoreID
objCurrentMsg.MoveTo strFolderID, strStoreID
End If
Else
If mSCL>EOL_TagAboveSCL Then 'Tag message
strPrefix=Replace(EOL_TagPrefix,"%SCL%",CStr(mSCL))
objCurrentMsg.Subject = strPrefix & objCurrentMsg.Subject
objCurrentMsg.Update
End If
End If
End If
Else

' Write some logging
Call DebugAppend("Junk - Undefinied Error detected", True)
End If

' Write some logging

' Clear objects
Set objSession = Nothing
Set objFolder = Nothing
Set objCurrentMsg = Nothing
Set objJunkFolder = Nothing

' Write results to the Scripting Agent log
Script.Response = g_bstrDebug

End Sub

' DESCRIPTION: This event is fired when a message in the folder is changed
Public Sub Message_OnChange
End Sub

' DESCRIPTION: This event is fired when a message is deleted from the folder
Public Sub Folder_OnMessageDeleted
End Sub

' DESCRIPTION: This event is fired when the timer on the folder expires
Public Sub Folder_OnTimer
End Sub

'-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
' PRIVATE FUNCTIONS/SUBS
'-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

'------------------------------------------------------------------------------
' Name: DebugAppend
' Area: Debug
' Desc: Simple Debugging Function
' Parm: String Text, Bool ErrorFlag
'------------------------------------------------------------------------------

Private Sub DebugAppend(bstrParm,boolErrChkFlag)
If boolErrChkFlag = True Then
If Err.Number <> 0 Then
g_bstrDebug = g_bstrDebug & bstrParm & " - " & cstr(Err.Number) & " " & Err.Description & vbCrLf
Err.Clear
End If
Else
g_bstrDebug = g_bstrDebug & bstrParm & vbCrLf
End If
End Sub

</SCRIPT>

When we installed Microsoft's Intelligtent Message Filter last summer, the spam identification rate was about 98%, using a spam confidence level (SCL) of 4. Now, we are at 82%. With this configuration file for Outlook, one can read the SCL...

Greetings!
Below I&amp;rsquo;ve pasted an edited and cleaned up copy of most of the Q&amp;amp;A from today&amp;rsquo;s...