I'm temporarily overseeing the company's infrastructure while we find a replacement for someone who recently left. We have on-premise exchange with ePrism (EdgeWave). Most of our users find our email security very inconvenient as they find themselves having to to go the ePrism portal many times during the day. The prior sysadmin set up the ePrism settings as follows:
1 - JUNK: Subject is prefixed with weird prefix and delivered.
2 - SPAM: was held in ePrism quarantine; users would need to login and release.
3- Everything else is quarantined: Virus, Phishing, Virus, etc
I decided to make the following changes:
1 - JUNK: Prefix subject with [JUNK] and deliver.
2 - SPAM: Prefix subject with [SPAM] and deliver.
3- Everything else is quarantined: Virus, Phishing, Virus, etc
4- Add exchange rule to change SCL whenever the emails were prefixed as above to level that causes it to go to the Junk folder in Outlook; (the threshold was set to 8 which seems high).
While what I did makes sense to me, I can't help to wonder if I am missing something; keep in mind that I am no sysadmin nor have any experience. I've found posts where other companies do the same as our original set up, deliver JUNK and quarantine SPAM.
Any thoughts? Am I missing something? Why would we quarantine SPAM?