Exchange Messaging Outlook Volume 9, Number 5


Information on this page is several years old and may be out-of-date; some links may not work.

Greetings! Welcome to Vol. 9, No. 5, 10 June 2004, of Exchange Messaging Outlook, a biweekly newsletter about Microsoft Exchange and Microsoft Outlook.

Today's highlights:

Regular features:

  • Other Resources

 

 

 

TAMING YOUR INBOX

Everyone has different methods they use to keep their Inbox under control. My method involves heavy use of flags and I never mark messages read automatically. Since I usually only mark messages read when I reply to them, I always have around 1800 unread messages in a mailbox with about 3500 messages.

I don't like using rules to move messages as they arrive, rules break too often and when messages aren't in the Inbox they are too easily forgotten. Outlook's Search folders help, but old habits die hard and I still spend a large part of my day in the Inbox.

Two new Outlook utilities are helping me organize my Inbox. The first, Auto-mate, applies rules to messages hours or days after they arrive, offerig basic rules conditions - To, From, CC, Subject, Importance, Read Status, and Flag Status. This allows me to leave messages in the Inbox long enough for me to see them and (hopefully) act on them. I use it to file messages from mailing lists, server reports, and mail from specific people or with a specific subject.

The second new add-in is Quick Mail Sort. It moves messages based on who they are from--scanning the contacts folder for e-mail addresses, moving messages to folders created for each contact, naming the folder using the Contact's e-mail display name field. It can move just messages from contacts considered business contacts or include Personal contacts as well as messages from people not in the contacts folder. Unlike Auto-mate, it's not automatic, I need to run it when you want to file my messages, such as at the end of the each day or week. It runs on the currently selected folder, so Outlook 2003 users can create Search folders to control what is filtered, as the filtering options are limited to the classification of the sending e-mail address, read and flagged status.

I'm a fan of ExLife, but Quick Mail Sort is easier to configure (no configuration required) and very simple to use. However, if you want to sort mail based on rules and don't have Outlook 2003, try ExLife.

These programs all work with Outlook 2000 and up.
Auto-Mate http://www.pergenex.com/auto-mate/index.shtml 
Quick Mail Sort http://www.netroworx.com/netroworx/DesktopDefault.aspx?tabid=28 
ExLife http://www.inboxrules.com/old/add-ins/exlife.shtml 
For a list of other rules utilities, see https://www.slipstick.com/addins/auto.htm#rwiz 

HOW GOOD IS THE INTELLIGENT MESSAGE FILTER?

One question often asked after the release of the Intelligent Message Filter was "How good is it?" The answer is "surprisingly accurate". I configured it to archive messages with a Spam confidence level (SCL) rating of 6 on the server and have a false positive rate of less than 1 in 800 messages. Using an SCL of 5, I had 6 in 300 false positives. With the client SCL set at 2, the false positive rating on Inbox filtering is worse, partly because very little spam gets into the mailboxes to begin with. Mailing lists and newsletters are problematic, with a false positive rate of close to 20% before white-listing addresses. Fortunately, the false negative rate is very low and almost all of the spam is removed from users mailboxes.

IMF fails noticeably with spam sent to mail-enabled public folders. Before enabling IMF on the Exchange server, I used GFI's Mail essentials on a gateway SMTP server at the firewall. While the false positive rate for my configuration was in the range of 1 in 500 messages, spam was all but non-existent in the public folders. Most of the spam delivered to the public folders has a SCL of 5, so lowering the server setting from 6 would help, but it would also increase the false positives.

In this situation, the ideal setup is an anti-spam filter on the gateway, configured to insure a low false positive rate, with IMF on the Exchange server removing the remaining spam. When used in conjunction with a well-tuned third party spam filter, IMF can eliminate a large portion of the spam your organization receives, with the client side SCL settings removing the remaining spam from user's Inboxes. Sunbelt Software reached a similar conclusion in their document, First Look: Microsoft Exchange Intelligent Message Filtering available in PDF format.

The bottom line? The IMF is good, but not good enough to eliminate third party filters in many organizations. Smaller organizations who can't or won't invest in a third party programs will benefit and it should make Exchange 2003 easier to sell to smaller organizations.

MONITORING IMF

As you know, the IMF assigns a spam confidence level rating to each message and filters messages based on that number. But can you find what level it assigns to messages you find in the archive or Junk E-mail folder?

To add the SCL number to message headers on messages moved to the archive folder on the Exchange server, follow the instructions in Chapter 6 of the deployment guide to add the ArchiveSCL value to the HKEY_LOCAL_MACHINE\Software\Microsoft\Exchange\ContentFilter registry key. This adds the SCL number to the top of the message header in this format: X-SCL: 7 95.18%. In this example, IMF is 95.18% confident the message is spam and assigned it 7 points.

The deployment guide includes instructions to change the location of the archive directory, filter messages sent by authenticated users, since by default, authenticated users bypass filtering. The guide also has instructions for creating a registry key that allows you to configure the maximum size of the safe and blocked sender's lists.

If you want to see the SCL number on messages in Outlook, you need to add the SCL field to a view to see the SCL ratings, as they aren't exposed in the message header. To learn how to create the SCL field, follow the instructions at You had me at EHLO:.

Once the SCL field is added to a view using Outlook, you can use the view in Outlook or OWA to see the SCL rating. If you're using cached mode with Outlook, disable cached mode when you create the view to insure the view is saved on the server and available to OWA. Once the view is created, select it from the Views menu next to the Folder name in OWA.

For at least the first few weeks, you should archive messages and review the archive, so that you can be sure the filter settings are optimal for your organization. Reviewing the archived messages can be time consuming, since opening the messages in notepad is safest, but it takes a long time to review them. Dropping the archived messages into Outlook Express folders for review is faster and easier, but if you use this method, make sure you turn on the option to read all mail in plain text and turn off the preview pane. While you can exit out of the Outlook Express dialogs and avoid creating a profile, I added the postmaster account using the IMAP protocol so I can forward false positives to the intended recipient.

If you don't want to use OE to browse the archives, a free utility written by James Webster is available at GotDotNet. Use the IMF Archive Manager to browse the archived messages and if you find any false positives, you can easily resubmit the message to Exchange. It also includes options to copy the content to the clipboard or forward by e-mail to an address.

Microsoft Exchange Intelligent Message Filter Deployment Guide
IMF Archive Manager http://workspaces.gotdotnet.com/imfarchive

FORCING OUTLOOK 2003 TO CREATE UNICODE PSTS

Many Outlook 2003 users ask how to force Outlook to create only Unicode pst's. By default, Outlook will create a Unicode pst when possible. The exception is when creating pst's to be used with IMAP or Hotmail/MSN accounts, those must be ANSI. While not usually necessary, you can force Outlook 2003 to force Unicode pst's by setting a registry value for NewPSTFormat.

To force Unicode or ANSI psts, navigate to HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook
Add the NewPSTFormat value with one of the following values:

Prefer Unicode PST: 0 (default)
Prefer ANSI PST: 1
Enforce Unicode PST: 2
Enforce ANSI PST: 3

By using a value of 2 or 3, you can restrict all new .pst files to either the old format or the new format. Note however, that Outlook will not open the mailbox folders if you are using IMAP or Hotmail/MSN accounts and try to force Unicode format pst's - they require the ANSI format used by Outlook97/2002.

Read more about this in the Office 2003 Resource Kit online at
http://www.microsoft.com/office/ork/2003/three/ch7/OutB06.htm  or
http://www.microsoft.com/resources/documentation/office/2003/all/reskit/en-us/outb06.mspx 

Other Resources

EXCHANGE SERVER 2003 TECHNICAL DOCUMENTATION LIBRARY
http://www.microsoft.com/technet/prodtechnol/exchange/2003/library/default.mspx
The Microsoft Exchange Server 2003 Technical Library is a catalog of technical content about Exchange Server, and it includes technical guides and articles that were reviewed and approved by the Exchange Server product team. The documents are designed to evolve over time as new issues become known, and new tricks and troubleshooting information become available. New versions of the documents are added to the library as the old versions expire, ensuring that the most current Exchange Server technical information is always available.

EXPOSING SCL (SPAM CONFIDENCE LEVEL) IN OUTLOOK
http://blogs.msdn.com/exchange/archive/2004/05/26/142607.aspx
If you're using Exchange 2003 and the IMF and are interested in knowing the rating it gives to messages, follow the instructions in the Exchange teams "You Had Me At EHLO:" blog to enable the SCL field. Are you looking for an easy explanation on how IMF works? Read Evan Dodds weblog at http://blogs.msdn.com/evand/archive/2004/05/31/145134.aspx 

FAX SERVICE AND FAX SERVICE PROVIDER (FSP) FAQ
http://members.optusnet.com.au/~hssandler1/fspfaq.htm
An FAQ on the Windows fax service.

OPSWAT ANTIVIRUS INTEGRATION SDK
http://www.opswat.com/antivirussdk.shtml
Develop antivirus add-ins using the OPSWAT Antivirus Integration SDK, a professional software kit for developing tight connections between your applications and nearly every antivirus package. With its simple object-oriented interface, Antivirus Integration SDK provides a comprehensive tool for controlling, managing, and checking the behavior of a wide variety of antivirus applications. The product is available in both client and server versions.

UPDATE ROLLUP FOR EXCHANGE 2000 (KB836488)
http://www.microsoft.com/downloads/details.aspx?FamilyId=43F5CDF6-D1E6-4476-B5F2-E17371236C3C&displaylang=en
This is a re-release of the post SP3 rollup for Exchange 2000. If you've already installed it, you should download this new version and install it-- there is a memory leak in the original. The leak happens in a scenario where incoming mail which does not have an MTS ID (the equivalent of a Internet Message-ID) and is routed to the MTA or any other connector (groupwise, notes, etc) will cause a leak in the epoxy.dll shared memory address space. Messages coming in via a straight SMTP connector or MAPI-submitted messages to the store will not cause the problem.

More Information

Click here to subscribe to the Exchange Messaging Outlook newsletter. 
Exchange Messaging Outlook Newsletter back issues
ISSN 1523-7990 Copyright 1996-2015, Slipstick Systems and CDOLive LLC. All rights reserved.

Updated Sunday January 04 2015

Copyright Slipstick Systems. All rights reserved.
Send comments using our Feedback page

Back to Top