I have a box running Server 2008 R2, Exchange 2010 SP1, and Forefront Protection for Exchange 2010.

The issue is that I cannot for the life of me get my content filters to quarantine a single message that is supposed to be tripping the filters. I've been sending myself emails that should be quarantined from several personal email account with different providers. Nothing. FPE Content Filtering is enabled and set to scan Internal, Incoming, and Outgoing messages and I cant get it to filter!

To be more specific. I have a keyword filter set up with a few words like "Viagra" "Make Money Fast" and a few others. I send myself emails from gmail, cox.net, etc. to an email address within my domain, with these words in the body and subject.

Forefront is configured to scan Internal, Outgoing, and Incoming messages and is appending the default "Suspect:" string to the subject when the keyword filter is tripped, but the are not being quarantined as intended. All of the them get through to the intended recipient.

Each message was being assigned an SCL of -1 but I found a PS command that changed this to zero. This seemed to resolve the issue for some people, but it didn't for me.

My keyword filter Target Action was already set to "Purge", and Quarantine was already set to "Yes" and the filter is being applied to all traffic.

All of the incoming mail that trips the filter shows up in the Quarantine View correctly, like you say. The details specify that they are inbound traffic from an external sender, and the metrics on the Dashboard reflect the messages received so I know that they are being scanned.

However, the emails still make it to the users mailboxes. I'm stumped.

  • Be a little more specific: What exactly is the contents of these "emails that should be quarantined"? And how have you determined that content filtering has not been applied – Mathias R. Jessen Feb 2 '12 at 8:13

You seem to have configured the Target Action in your keyword filter list to the "Identify in Subject line" option.

Select either Purge or Delete as the action type and opt Yes to Quarantine files

The messages matching your keyword filter will now only be available from the Quarantine View

Be sure to enable the keyword list for inbound mail

Check out the TechNet documentation on Configuring filtering for more information

  • All of this was already configured as per your instructions. The messages that trip the filter show up in the Quarantine View, yet they still go to the users mailbox. I only have one mailbox database. Could this have something to do with it? – Ethan Hohensee Feb 2 '12 at 18:29
  • Have you tried restarting the FSCController and FSEIMC services after making changes to the configuration? – Mathias R. Jessen Feb 2 '12 at 18:36
  • I just found that when sending internal, the Quarantine View's Detection Detail tab shows "State: Purged" while email received from the outside says "State: Identified". The internal mail never made it to the mailbox! – Ethan Hohensee Feb 2 '12 at 18:42
  • answer updated, enable for inbound mail globally – Mathias R. Jessen Feb 2 '12 at 18:47
  • Inbound mail filtering was already enabled. Keyword and File filters both scan outbound and inbound. I have also restarted those services and the issue persists. – Ethan Hohensee Feb 2 '12 at 19:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.