How can I configure Intelligent Message Filter in Exchange 2003 SP2?

Microsoft Exchange Intelligent Message Filter is a product developed by Microsoft to help companies reduce the amount of unsolicited commercial e-mail (UCE), or spam, received by users. You can read more about IMF on the  page.

How it works?

When an external user sends e-mail messages to an Exchange server with Intelligent Message Filter enabled, IMF evaluates the textual content of the messages and assigns the message a rating based on the probability that the message is UCE or spam. All incoming messages are marked with a Spam Confidence Level (or SCL) rating, regardless of the rating threshold you set. This rating is saved with the other message properties and these properties are sent with the message to other Exchange servers (you might want to read Archiving the SCL Rating in Intelligent Message Filter).
In Gateway Blocking Configuration, select the rating in Block messages with an SCL rating greater than or equal to above which Intelligent Message Filter takes action on this message.
If a message has a rating higher than the gateway threshold, IMF takes the action specified. If the message has a rating below the gateway threshold, the message is sent to the Exchange mailbox store of the recipient. At the Exchange mailbox store, if the message has a higher rating than the mailbox store threshold, the mailbox store delivers the message to the user’s Junk E-mail folder rather than to the Inbox.
Intelligent Message Filter does not need to be installed on Exchange mailbox servers. If Intelligent Message Filter is installed and enabled on the gateway SMTP virtual servers, Exchange mailbox servers receive the SCL rating with each incoming Internet message and take the appropriate action.
Note: The Intelligent Message Filter is not supported in a clustered environment. Therefore, Intelligent Message Filter updates are not offered to Exchange Server 2003 servers in a clustered environment.
System Requirements: Supports Windows 2000 Service Pack 3, Windows 2000 Service Pack 4, and Windows Server 2003. Requires Exchange Server 2003.
Note: IMF used to be a stand-alone tool downloadable from Microsoft. Although one can still download and install it separately (here, if you insist), IMF is now an integral part of Exchange Service Pack 2 (SP2).
Read more about IMF on the Block Spam with Exchange 2003 Intelligent Message Filter, Installing Intelligent Message Filter with Exchange 2003 SP2 and Update Intelligent Message Filter in Exchange Server 2003 SP2 pages.

Installing IMF (with Exchange 2003 SP2) – No action required

Exchange Server 2003 SP2 already has IMF v2 bundled with it. Therefore, the moment you install SP2 you already have IMF. However, you do need to manually enable and configure it to work.
Read the Installing Intelligent Message Filter with Exchange 2003 SP2 page for more info.

Configuring IMF

Configuring Intelligent Message Filter involves two settings:
Gateway Blocking Configuration – In Gateway Blocking Configuration, you establish a threshold based on a spam confidence level (SCL) rating above which the gateway server takes action on the message. You also define the type of action you want the gateway to take.
Store Junk E-mail Configuration – In Store Junk E-mail Configuration, you define the thresholds based on an SCL rating that Microsoft Exchange 2003 mailbox stores use to determine whether to deliver messages to a user’s Inbox or Junk E-mail folder.
In order to configure IMF follow these steps:

1. Open the Exchange System Manager snap-in (ESM).
2. Expand your Organization object, expand Global Settings. Right-click Message Delivery and choose Properties.

1. Click on the “Intelligent Message Filtering” tab.

1. In the Gateway Blocking Configuration section enter the number you chose, based upon your own preferences. I use 7, but you may want to experiment with lower or higher numbers. Selecting a lower number for the SCL rating filters more messages, but also increases the likelihood of false positives, which are legitimate messages that appear to be UCE. Selecting a higher number for the SCL rating filters fewer messages, but also reduces the likelihood of false positives.

Note: There is a known bug (or issue as Microsoft like to call it) with the SCL threshold. Read Bug in Intelligent Message Filter Interface for more information.

1. Now choose the action to perform when blocking messages. You can select Archive, for example, in order to archive all the messages with the SCL rating higher than 7 (for example). Read View Intelligent Message Filter Archive and Archiving the SCL Rating in Intelligent Message Filter for more information.

1. In the Store Junk E-mail Configuration select your desired threshold. I use 4. but again, you may want to experiment with higher numbers. Again, read the articles below for more info, and don’t forget about that “small issue” with the UI.
2. That’s all to it. Click Ok.

After you configure Intelligent Message Filter, you must enable this filter on all inbound gateway SMTP virtual servers. You do NOT need to enable IMF on ALL Exchange servers, do so only on the server(s) that is responsible for the incoming SMTP traffic.

Since now IMF is installed as an integral part of SP2, the IMF settings that need to be configured under the SMTP Virtual Server are no longer a subfolder node of the SMTP Virtual server as it was prior to SP2.

1. Expand the Administrative Group folder, then expand the Servers folder, then expand each server that will be configured with IMF.
2. Expand the server object and click to expand the Protocols folder. Expand the SMTP folder.
3. Right-click the Default SMTP Virtual Server and choose Properties.

1. In the General tab click on the Advanced button.

1. In the Advanced window, click to select the (All Unassigned) IP Address and click on the Edit button.

1. In the Identification window, click to select the Apply Intelligent Message Filter checkbox. Click Ok all the way out.

Done.

After the configuration of IMF

Make sure you monitor your Junk Mail folder. Test your e-mail software (it does not necessarily have to be Outlook) and make sure you don’t have too many false positives. If you do, or if you see that legitimate e-mail is deleted or treated as junk you can always go back to the IMF configuration screen and lower your SCL rating. In order to view the SCL rating and understand how it works read the Display SCL Level in Outlook 2003, Display SCL Level in OWA 2003 SP2, Archiving the SCL Rating in Intelligent Message Filter and View Intelligent Message Filter Archive articles.
Note: IMF v2 will ignore messages that have attachments with the size of 3MB or larger. This is by design.
If you’re running Exchange 2003 SP2 you can (and should) read the Updating Intelligent Message Filter in Exchange Server 2003 SP2 page.

Further Reading

You might also want to read the following related articles:

• Archiving the SCL Rating in Intelligent Message Filter
• Block Spam with Exchange 2003 Intelligent Message Filter
• Block Spam with Exchange 2003
• Block Spam with Outlook 2003
• Bug in Intelligent Message Filter Interface
• Combating Spam in the Corporate Environment
• Display SCL Level in Outlook 2003
• Display SCL Level in OWA 2003 SP2
• Download Exchange 2003 Intelligent Message Filter
• GFI MailEssentials for Exchange/SMTP – more info
• How to Post to Newsgroups Without Getting spammed?
• Installing Intelligent Message Filter with Exchange 2003 SP2
• Moving Intelligent Message Filter Archive Folder
• Sender Policy Framework
• Updating Intelligent Message Filter in Exchange Server 2003 SP2
• View Intelligent Message Filter Archive

Links

Exchange Intelligent Message Filter
Microsoft Exchange Intelligent Message Filter Deployment Guide (2.2mb)
Microsoft Exchange Intelligent Message Filter Readme