Exposing SCL (Spam Confidence Level) in Outlook

re: Exposing SCL (Spam Confidence Level) in Outlook

Dillon — Wed, 26 May 2004 22:24:00 GMT

Good, but not great.

Any way to get the X-SCL: in the headers just like messages that are written to the archive?

re: Exposing SCL (Spam Confidence Level) in Outlook

Colin Walker — Wed, 26 May 2004 22:25:00 GMT

When saving the cfg file make sure yousave it to the same location as the ico files:

LargeIcon=IPML.ico
SmallIcon=IPMS.ico

This is usually Program Files\<Office folder>\Office 11\Forms\<language ID>

re: Exposing SCL (Spam Confidence Level) in Outlook

James Webster — Thu, 27 May 2004 00:03:00 GMT

Dillon - This isn't easy to do without writing a transport sink that runs after IMF has stamped the SCL property. In addition, adding the value to the message headers has the potential for information disclosure if the message bounces back to the source of the UCE.

Colin - Thanks for pointing that out. I lost that key piece of information while cutting/pasting information from Paul.

Exposing the SCL to better understand your

E-Bitz - SBS MVP the Official Blog of the SBS — Thu, 27 May 2004 04:12:00 GMT

re: Exposing SCL (Spam Confidence Level) in Outlook

ML — Thu, 27 May 2004 15:31:00 GMT

Both, config file and archive manager, are top needed tools and works nicely. Thanks for those..

But is there any way to get this SCL "gateway value" to be avalaible in OWA?

re: Exposing SCL (Spam Confidence Level) in Outlook

James Webster — Thu, 27 May 2004 18:54:00 GMT

ML - I know this is possible, but I'm not sure about the details. I'll dig around and see if I can find out some information as this is something I'd like to see on my server as well.

Off for the weekend...

Scott Galloway's Personal Blog — Fri, 28 May 2004 23:05:00 GMT

re: Exposing SCL (Spam Confidence Level) in Outlook

Erick — Fri, 28 May 2004 22:12:00 GMT

This is perfect, and helps me figure out what the levels should be. I'm looking for a way to easily give this to all my power users, so I can get an idea of what level is good. If you can, a KB article containing this would be VERY useful. And even better if there was a link from the IMF page...

Thanks

re: Exposing SCL (Spam Confidence Level) in Outlook

Tim Watts — Mon, 31 May 2004 20:28:00 GMT

I have just finished installing the SCL to see the different levels. It works fine when directly connected to the exchange server, but does not work outside using Outlook2003 in a pop3 config. Is this possible? Regardless this will be very helpful.

Thanks,

Tim

re: Exposing SCL (Spam Confidence Level) in Outlook

KC Lemson — Mon, 31 May 2004 21:53:00 GMT

Tim: What does "outside" mean in this case? A POP server that's not running Exchange w/the IMF?

re: Exposing SCL (Spam Confidence Level) in Outlook

Andrew — Tue, 01 Jun 2004 09:45:00 GMT

Great, now spammers are able to abuse this value in the same way websites abuse the google page rank to get their sites listed more prominently. Being able to manipulate their mails and "score" them with ease will allow them to reduce the number of default outlook spam configurations that they trigger.

re: Exposing SCL (Spam Confidence Level) in Outlook

AJS — Tue, 01 Jun 2004 17:12:00 GMT

James,

Having an issue with Outlook on step 6 of your howto. The form shows up under personal forms on the left but won't move over with the add button. Any suggestions?

re: Exposing SCL (Spam Confidence Level) in Outlook

James Webster — Tue, 01 Jun 2004 18:12:00 GMT

Tim -

SCL is only exposed via Mapi (Outlook Exchange mode) and via OWA (Outlook Web Access). There isn't a method to expose the property via POP/IMAP.

Andrew - SCL is only propagated between servers using xexch50 which requires an authenticated connection with SendAs permissions. As for using IMF to test their own spam and change it to get a lower score, they can do that with any bayesian filter as long as they can get their hands on the product.

AJS - I think I ran into that once as well when I had a custom filter already select. Try modifiying the Messages view and see if that works.

re: Exposing SCL (Spam Confidence Level) in Outlook

Justin — Wed, 02 Jun 2004 11:45:00 GMT

Works like a charm! Thanks!

re: Exposing SCL (Spam Confidence Level) in Outlook

Peter — Fri, 04 Jun 2004 13:51:00 GMT

Quite interesting, I have this enabled in a frontend/backend scenario, and although I can see that the filter is working (i.e. by looking at the performance counters or when archiving the obvious spams), I can't seem to find an SCL rating in Outlook. When I apply this custom form field, it only shows me field entries of -1 (local deliveries) and empty fields, nothing else.

What can cause this?

re: Exposing SCL (Spam Confidence Level) in Outlook

James Webster — Fri, 04 Jun 2004 16:33:00 GMT

Peter -

SCL is transfered from FE (IMF) servers to BE (mailbox) servers using xexch50 blob. If there are any servers between the FE and BE that don't relay the xexch50 blob (like virus wall server), then the SCL value will be lost. In such topologies, you want to run IMF on a server behind your 3rd party Virus Wall server.

James

re: Exposing SCL (Spam Confidence Level) in Outlook

AJS — Fri, 04 Jun 2004 18:11:00 GMT

James,

Thanks for the reply, I had another custom filter in from another application that caused the issue.

Another quick question for you, we have some SMTP servers setup in our internal network that sometimes send mail to the Exchange server. These messages are getting SCL levels well below the threshold set (some are 1 or 2) and the level we set is 5) but are getting filtered into junk e-mail folders. I've tried adding the entire internal network subnet into the global address list but I just saw one go into the junk. Any idea?

re: Exposing SCL (Spam Confidence Level) in Outlook

James Webster — Sat, 05 Jun 2004 01:45:00 GMT

AJS -

They are probably going into Junk E-mail because of Outlook 2003 filtering rather then IMF filtering. Changing your settings on Outlook 2003 from high to low may solve your problem. If it doesn't, then you should have your internal App servers submit mail using credentials instead of anonymously. Authenticated mail automatically get an SCL of -1, and as such will bypass both IMF and Outlook 2003 rules.

re: Exposing SCL (Spam Confidence Level) in Outlook

Michael Pietroforte — Mon, 07 Jun 2004 07:37:00 GMT

I experienced a similar problem. Sometimes mails with a SCL level below the threshold are moved to the junk mail folder of Outlook. The mails don’t come from the internal network. The Outlook internal filter is set to off. The same happened to several mailboxes. Is this a bug of the IMF or is it a problem of this scl.cfg?

re: Exposing SCL (Spam Confidence Level) in Outlook

AJS — Mon, 07 Jun 2004 15:54:00 GMT

James,

We tried that and are actually getting messages through with no SCL at all now, however, these still don't get filtered so thats ok even though it's giving a -1 as you mentioned. In any case, I'm still getting some mail through from other sources that are less than SCL 5 and Outlook filtering is off, some of this mail is coming from other companies and I have no control over authentication methods through SMTP. Any advice would be appreciated. Thanks.

re: Exposing SCL (Spam Confidence Level) in Outlook

James Webster — Mon, 07 Jun 2004 15:56:00 GMT

Michael -

scl.cfg just exposes the scl column, it doesn't move the message.

If you have FE/BE topology and messages on the BE are being moved below the threshold, then you may need to restart the store on the BE server. PSS is working on a FAQ to address this and some of the other issues.

re: Exposing SCL (Spam Confidence Level) in Outlook

Peter Schmidt — Thu, 10 Jun 2004 07:00:00 GMT

I get some mails in my mailbox, that does not have a SCL level, they are just empty and the mails are from an external source.
Do you know why this happens ?

I've tried to see if I could use the SCL form together with a Outlook rule, so that I personally could move SCL 3 mails to a certain folder, but I cannot get it working, nothing happens. Is this because of the scl.cfg file, that might not support using it for a rule ?

Thanks,
Peter

re: Exposing SCL (Spam Confidence Level) in Outlook

drg — Thu, 10 Jun 2004 12:26:00 GMT

nice - thanks for this :-)

David G

Exchange 2003 IMF

JT's Blog — Sun, 13 Jun 2004 11:11:00 GMT

Exchange 2003 IMF

JT's Blog — Sun, 13 Jun 2004 11:12:00 GMT

re: SCL progagation

Peter — Wed, 16 Jun 2004 16:56:00 GMT

Hi James,

Thanks for the response.

We do not have any relay servers between the fronted/backend servers, only a firewall that does let SMTP through.

The backend Exchange 2003 server is still running on Windows 2000 though I don't think it causes the problem. Does it? According to the deplozment docs You only need to deploy IMF on the frontend server for the filtering to function.

Peter

re: SCL progagation

Peter — Wed, 16 Jun 2004 17:27:00 GMT

Just got this sorted out.

What happened was that (thanks to extra security measures) on the backend server SMTP instance only anonymous authentication was allowed.

Turned Integrated windows back on, and SCL propagation incl. Your forms display works like charm.

Might help others, might help Peter Schmidt as well.

re: Exposing SCL (Spam Confidence Level) in Outlook

Greg — Wed, 16 Jun 2004 17:47:00 GMT

This is great, thanks. For some reason the last time I stopped and started the exchange service my IMF seems to have started acting strangely. It is not moving everything with the assigned rating to the junk email folder anymore. Anyone else have this problem?

re: Exposing SCL (Spam Confidence Level) in Outlook

James Webster — Wed, 16 Jun 2004 18:35:00 GMT

Exchange 2000 has no concept of the SCL MAPI property, so when the FE 2003 server sends the xexch50 blob which contains the SCL property to the BE 2000 server, this property is lost. What confuses me is your statement that you are seeing -1 for authenticated mail. Only Exchange 2003 stores will stamp that property, so I'm not quite sure why you are seeing it. My only guess is your topology may actually look like: FE e2k3 -> RG e2k -> BE e2k3

In this case the RG server is dropping the IMF stamped property, but the BE server is stamping the authenticated property.

re: Exposing SCL (Spam Confidence Level) in Outlook

Garry — Mon, 21 Jun 2004 13:38:00 GMT

Not sure whats gone wrong, but i've done what the instructions say, and most of the messages don't have any number under the SCL column, but the ones that do, are all -1

re: Exposing SCL (Spam Confidence Level) in Outlook

James Webster — Mon, 21 Jun 2004 17:41:00 GMT

The IMF release notes have been updated with both known issues and a FAQ section that covers most questions asked here. You can find the latest release notes here: http://download.microsoft.com/download/2/2/C/22CCB3FB-CE5F-4E23-810B-1A4AC5540C97/IntelligentMessageFilterReadmejune2004.htm

re: Exposing SCL (Spam Confidence Level) in Outlook

Craig — Wed, 30 Jun 2004 05:50:00 GMT

I have a front end 2003 and a backend 2003 Exchange server and I am getting blank SCL values for internet mail. Additionally, the performance counters on my front end server do not increment for IMF UCE messages scanned. I have triple checked my settings per the deployment doc with no luck. I do have SCL values of -1 for email sent within the backend Exchange server.

re: Exposing SCL (Spam Confidence Level) in Outlook

joe — Tue, 06 Jul 2004 18:00:00 GMT

I just dont get it :(

Spam filtering in Exchange 2003

Ian Blackburn's Weblog — Wed, 07 Jul 2004 23:52:00 GMT

re: Exposing SCL (Spam Confidence Level) in Outlook

Brian — Thu, 08 Jul 2004 12:50:00 GMT

I have a question. I have both the configuration file installed and the registry edit to view archived SCL ratings. I sent a test e-mail from one of my yahoo account to our corporate address to see what the SCL rating is on it. I noticed that the archive rating is a 4 and the 'outlook config file' is a 3. Anyone know why this may be. Just some additional info, I only have one server acting as an email server, no extra relays or anything.

re: Exposing SCL (Spam Confidence Level) in Outlook

Eric VT — Sat, 10 Jul 2004 09:00:00 GMT

Hello,

I have a mailbox on a disabled user account, which is accessible by an other user.

On that mailbox SCL is always empty, so messages are not moved to junk folder.

How could I enable SCL rating on that mailbox ?

Eric

re: Exposing SCL (Spam Confidence Level) in Outlook

SteveF — Tue, 20 Jul 2004 22:13:00 GMT

How would I go about putting this form on the Exchange server and making it available to all my clients? It would be nice to enable this column in the Junk Email folder for a bunch of my power users without all the client-specific stuff if it all possible. I'm an Exchange forms neophyte, so be gentle!

re: Exposing SCL (Spam Confidence Level) in Outlook

James Webster — Wed, 21 Jul 2004 01:17:00 GMT

Craig - Make sure your front end servers authenticate to your back end servers. If you have authentication disabled, then the SCL property will not be transmitted.

Brian - I have no idea what you are referring to as a 'outlook config file'.

Eric - SCL properties are not exposed per mailbox, but rather per server.

Steve - I'm not a forms guru either (just an information gatherer), but I believe you can create a script that does all the steps that are listed above.

Public folder agent script to move spam

Peter Suba — Tue, 27 Jul 2004 16:13:00 GMT

Hello,

I have written an agent script which installed to a public folder (or an inbox folder) makes it possible to create a junk mail folder aswell. It has several parameters, and also allows you to tag the message subject if you want to. Here it is:

<SCRIPT RunAt=Server Language=VBScript>

'------------------------------------------------------------------------------
'
' NAME: Move spam messages
'
' FILE DESCRIPTION: Automatically move and tag incomming messages
' according to the settings below
'
' Copyright (c) Peter Suba 2004. subap@eol.hu All rights reserved.
'
' Portions:
' Copyright (c) CdoLive 1999. All rights reserved.
' Http://www.cdolive.com
' Mailto:samples@cdolive.com
'
' Copyright (c) Microsoft Corporation 1993-1997. All rights reserved.
'
'------------------------------------------------------------------------------

Option Explicit

'------------------------------------------------------------------------------
' Global Variables
'------------------------------------------------------------------------------

Dim g_bstrDebug ' Debug String

'------------------------------------------------------------------------------
' CONSTANTS
'------------------------------------------------------------------------------

' Configuration constants

Const EOL_MoveAboveSCL = 5 ' Move messages that are above this SCL
Const EOL_TagAboveSCL = 3 ' Tag messages that are above this SCL (will only work if set to lower than above set parameter!)
Const EOL_TagMoved = TRUE ' Set to true if you want to tag also message that are moved
Const EOL_TagPrefix = "**** SPAM LIKELIHOOD: %SCL%/10 **** " 'Set for tag prefix: %SCL% will be replaced by SCL value assigned to message
Const EOL_MoveToSubfolder = "Junk mail" ' Moved messages will be transfered to this folder

' MAPI property tags used in this script

Const CdoPR_SCL = &H40760003 'PT_I4 (PT_MV_I4) - reméljük stimmel

'------------------------------------------------------------------------------
' EVENT HANDLERS
'------------------------------------------------------------------------------

' DESCRIPTION: This event is fired when a new message is added to the folder
Public Sub Folder_OnMessageCreated

' Declare variables
Dim objSession ' Session
Dim objFolder ' Current folder
Dim objJunkFolder ' Junk mail folder
Dim objCurrentMsg ' Current message
Dim mSCL
Dim strPrefix
Dim objMovedMsg ' Moved message
Dim strFolderID
Dim strStoreID

' Initialize variables
Set objSession = Nothing
Set objFolder = Nothing
Set objCurrentMsg = Nothing
Set objJunkFolder = Nothing

' Clear error buffer
Err.Clear

' Get session informationen
On Error Resume Next
Set objSession = EventDetails.Session

' No errors detected ?
If Err.Number = 0 Then

' Get current message
Err.Clear
On Error Resume Next
Set objCurrentMsg = objSession.GetMessage(EventDetails.MessageID,Null)

' Error detected ?
If Err.Number <> 0 Then

' Error reading current message
Call DebugAppend("Error - Could not read message", True)
Else
mSCL = objCurrentMsg.Fields(CdoPR_SCL)
If mSCL>EOL_MoveAboveSCL Then ' Move message to subfolder
If EOL_TagMoved Then
strPrefix=Replace(EOL_TagPrefix,"%SCL%",CStr(mSCL))
objCurrentMsg.Subject = strPrefix & objCurrentMsg.Subject
objCurrentMsg.Update
End If
Set objFolder = objSession.GetFolder(objCurrentMsg.FolderID,objCurrentMsg.StoreID)
Set objJunkFolder = objFolder.Folders(EOL_MoveToSubfolder)
If Err Then 'If the folder does not yet exist then create it
Call DebugAppend("Error - get junk mail folder - creating it", True)
Set objJunkFolder = objFolder.Folders.Add(EOL_MoveToSubfolder)
Err.clear
Else
If objJunkFolder.Name <> EOL_MoveToSubfolder Then
Call DebugAppend("Error - get junk mail folder (got:<"&objJunkFolder.Name&">) - creating it", False)
Set objJunkFolder = objFolder.Folders.Add(EOL_MoveToSubfolder)
End If
End If
If objJunkFolder.Name = EOL_MoveToSubfolder Then
strFolderID = objJunkFolder.ID
strStoreID = objJunkFolder.StoreID
objCurrentMsg.MoveTo strFolderID, strStoreID
End If
Else
If mSCL>EOL_TagAboveSCL Then 'Tag message
strPrefix=Replace(EOL_TagPrefix,"%SCL%",CStr(mSCL))
objCurrentMsg.Subject = strPrefix & objCurrentMsg.Subject
objCurrentMsg.Update
End If
End If
End If
Else

' Write some logging
Call DebugAppend("Junk - Undefinied Error detected", True)
End If

' Write some logging

' Clear objects
Set objSession = Nothing
Set objFolder = Nothing
Set objCurrentMsg = Nothing
Set objJunkFolder = Nothing

' Write results to the Scripting Agent log
Script.Response = g_bstrDebug

End Sub

' DESCRIPTION: This event is fired when a message in the folder is changed
Public Sub Message_OnChange
End Sub

' DESCRIPTION: This event is fired when a message is deleted from the folder
Public Sub Folder_OnMessageDeleted
End Sub

' DESCRIPTION: This event is fired when the timer on the folder expires
Public Sub Folder_OnTimer
End Sub

'-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
' PRIVATE FUNCTIONS/SUBS
'-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

'------------------------------------------------------------------------------
' Name: DebugAppend
' Area: Debug
' Desc: Simple Debugging Function
' Parm: String Text, Bool ErrorFlag
'------------------------------------------------------------------------------

Private Sub DebugAppend(bstrParm,boolErrChkFlag)
If boolErrChkFlag = True Then
If Err.Number <> 0 Then
g_bstrDebug = g_bstrDebug & bstrParm & " - " & cstr(Err.Number) & " " & Err.Description & vbCrLf
Err.Clear
End If
Else
g_bstrDebug = g_bstrDebug & bstrParm & vbCrLf
End If
End Sub

</SCRIPT>

Can't open embedded messages, no

KC on Exchange and Outlook — Thu, 29 Jul 2004 19:57:00 GMT

Can't open embedded messages, no

KC on Exchange and Outlook — Sat, 31 Jul 2004 01:36:00 GMT

Determining the SCL rating of your mail

Mark Dormer — Thu, 05 Aug 2004 12:35:00 GMT

re: Exchange blog suggestion box

You Had Me At EHLO... — Mon, 23 Aug 2004 23:37:00 GMT

Messaging Security at Microsoft presentation

Eileen Brown's WebLog — Sat, 15 Jan 2005 23:09:00 GMT

Update for Intelligent Message Filter for Exchange is comming soon

4sysops — Tue, 25 Jan 2005 12:21:00 GMT

When we installed Microsoft's Intelligtent Message Filter last summer, the spam identification rate was about 98%, using a spam confidence level (SCL) of 4. Now, we are at 82%. With this configuration file for Outlook, one can read the SCL...

BlogCast: The Intelligent Message Filter

Eileen Brown's WebLog — Tue, 15 Feb 2005 17:29:00 GMT

re: IMF and the Junk E-mail folder in Outlook

Evan's WebLog — Wed, 16 Feb 2005 04:25:00 GMT

Exposing the SCL in Outlook

SBS Patching — Sat, 26 Mar 2005 05:29:00 GMT

Best of Q&A from Webcast: Exchange Server 2003 Tips, Tricks, and Shortcuts

Full of I.T. — Sat, 25 Mar 2006 00:48:38 GMT

Greetings!
Below I&rsquo;ve pasted an edited and cleaned up copy of most of the Q&amp;A from today&rsquo;s...

Exposing SCL (Spam Confidence Level) in Outlook

re: Exposing SCL (Spam Confidence Level) in Outlook

re: Exposing SCL (Spam Confidence Level) in Outlook

re: Exposing SCL (Spam Confidence Level) in Outlook

Exposing the SCL to better understand your

re: Exposing SCL (Spam Confidence Level) in Outlook

re: Exposing SCL (Spam Confidence Level) in Outlook

Off for the weekend...

re: Exposing SCL (Spam Confidence Level) in Outlook

re: Exposing SCL (Spam Confidence Level) in Outlook

re: Exposing SCL (Spam Confidence Level) in Outlook

re: Exposing SCL (Spam Confidence Level) in Outlook

re: Exposing SCL (Spam Confidence Level) in Outlook

re: Exposing SCL (Spam Confidence Level) in Outlook

re: Exposing SCL (Spam Confidence Level) in Outlook

re: Exposing SCL (Spam Confidence Level) in Outlook

re: Exposing SCL (Spam Confidence Level) in Outlook

re: Exposing SCL (Spam Confidence Level) in Outlook

re: Exposing SCL (Spam Confidence Level) in Outlook

re: Exposing SCL (Spam Confidence Level) in Outlook

re: Exposing SCL (Spam Confidence Level) in Outlook

re: Exposing SCL (Spam Confidence Level) in Outlook

re: Exposing SCL (Spam Confidence Level) in Outlook

re: Exposing SCL (Spam Confidence Level) in Outlook

Exchange 2003 IMF

Exchange 2003 IMF

re: SCL progagation

re: SCL progagation

re: Exposing SCL (Spam Confidence Level) in Outlook

re: Exposing SCL (Spam Confidence Level) in Outlook

re: Exposing SCL (Spam Confidence Level) in Outlook

re: Exposing SCL (Spam Confidence Level) in Outlook

re: Exposing SCL (Spam Confidence Level) in Outlook

re: Exposing SCL (Spam Confidence Level) in Outlook

Spam filtering in Exchange 2003

re: Exposing SCL (Spam Confidence Level) in Outlook

re: Exposing SCL (Spam Confidence Level) in Outlook

re: Exposing SCL (Spam Confidence Level) in Outlook

re: Exposing SCL (Spam Confidence Level) in Outlook

Public folder agent script to move spam

Can't open embedded messages, no

Can't open embedded messages, no

Determining the SCL rating of your mail

re: Exchange blog suggestion box

Messaging Security at Microsoft presentation

Update for Intelligent Message Filter for Exchange is comming soon

BlogCast: The Intelligent Message Filter

re: IMF and the Junk E-mail folder in Outlook

Exposing the SCL in Outlook

Best of Q&amp;A from Webcast: Exchange Server 2003 Tips, Tricks, and Shortcuts

Best of Q&A from Webcast: Exchange Server 2003 Tips, Tricks, and Shortcuts