1

I have a box running Server 2008 R2, Exchange 2010 SP1, and Forefront Protection for Exchange 2010.

The issue is that I cannot for the life of me get my content filters to quarantine a single message that is supposed to be tripping the filters. I've been sending myself emails that should be quarantined from several personal email account with different providers. Nothing. FPE Content Filtering is enabled and set to scan Internal, Incoming, and Outgoing messages and I cant get it to filter!

To be more specific. I have a keyword filter set up with a few words like "Viagra" "Make Money Fast" and a few others. I send myself emails from gmail, cox.net, etc. to an email address within my domain, with these words in the body and subject.

Forefront is configured to scan Internal, Outgoing, and Incoming messages and is appending the default "Suspect:" string to the subject when the keyword filter is tripped, but the are not being quarantined as intended. All of the them get through to the intended recipient.

Each message was being assigned an SCL of -1 but I found a PS command that changed this to zero. This seemed to resolve the issue for some people, but it didn't for me.

My keyword filter Target Action was already set to "Purge", and Quarantine was already set to "Yes" and the filter is being applied to all traffic.

All of the incoming mail that trips the filter shows up in the Quarantine View correctly, like you say. The details specify that they are inbound traffic from an external sender, and the metrics on the Dashboard reflect the messages received so I know that they are being scanned.

However, the emails still make it to the users mailboxes. I'm stumped.

1
  • Be a little more specific: What exactly is the contents of these "emails that should be quarantined"? And how have you determined that content filtering has not been applied Feb 2, 2012 at 8:13

1 Answer 1

1

You seem to have configured the Target Action in your keyword filter list to the "Identify in Subject line" option.

Select either Purge or Delete as the action type and opt Yes to Quarantine files

The messages matching your keyword filter will now only be available from the Quarantine View

Be sure to enable the keyword list for inbound mail

Check out the TechNet documentation on Configuring filtering for more information

5
  • All of this was already configured as per your instructions. The messages that trip the filter show up in the Quarantine View, yet they still go to the users mailbox. I only have one mailbox database. Could this have something to do with it? Feb 2, 2012 at 18:29
  • Have you tried restarting the FSCController and FSEIMC services after making changes to the configuration? Feb 2, 2012 at 18:36
  • I just found that when sending internal, the Quarantine View's Detection Detail tab shows "State: Purged" while email received from the outside says "State: Identified". The internal mail never made it to the mailbox! Feb 2, 2012 at 18:42
  • answer updated, enable for inbound mail globally Feb 2, 2012 at 18:47
  • Inbound mail filtering was already enabled. Keyword and File filters both scan outbound and inbound. I have also restarted those services and the issue persists. Feb 2, 2012 at 19:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .