Some users are reporting Outlook 2003 SP1 won't send their email out on the correct email account, instead sending the message on one of their other accounts.

It appears this is caused by the failure of Outlook to create an NDR when it can't send a message using the assigned SMTP server because of lack of proper authentication. Instead of bouncing back with a "relaying denied" error, Outlook falls back to the next available SMTP server in the profile, which results in the From address from the account whose SMTP server was used.

The fix? Make sure that any account that uses a server which supports authentication is set up to authenticate to that server. Check with your email administrator to learn what types of authentication is supported.

To change your authentication settings, go to Tools, Email Accounts, View or change existing accounts, select the account and click Change. Click More Settings then Outgoing Server tab to configure authentication.

Exchange 2003's Intelligent Message Filter (IMF) does 'okay' at keeping spam out of user's Inboxes, but it's difficult to review the messages in the UceArchive folder and IMF lacks the ability to white list addresses that are erroneously tagged as spam. Because of these limitations, organizations that receive a lot of spam should consider using third party anti-spam filters, which offer white (or safe) lists and black (or block) lists, keyword filters, file attachment filtering and other features well worth the cost.

If your organization doesn't receive much spam, IMF will keep some or all of the spam out of your mailboxes. How much spam is removed depends on the SCL settings - as you lower the SCL, you remove more spam and questionable messages, but you increase the number of messages falsely labeled spam. To recover these false positives, you'll need to review the UceArchive.

The simplest method is to open the messages using notepad or another text editor. This is the safest method, but reviewing the messages is slow. You can use Windows search to find messages containing keywords or specific addresses, but it's still very time consuming.

While you shouldn't have Outlook Express installed on your server, if you do, you can drag the *.eml files to Outlook Express's Inbox. But you need to enable the option to read as plain text to prevent web bugs or viruses from triggering and infecting your Exchange server. If you're willing to take the risk, you'll see The To, From, and Subject fields of the message and can sort by any of the fields, which makes it easier to quickly browse the messages, but you have two copies of the messages to delete - the one in OE and the one in the UceArchive folder. Releasing false positives for redelivery is difficult as well. All in all, it's not a good method to use.

The IMF Archive Manager is a browser-based IMF archive viewer that works well for browsing archive but you can only delete all of the messages at once, or delete or release one message at a time. It would be better if you could mark and delete (or release) multiple messages at once and sort by subject, recipient, or sender.

While the IMF Archive is the best of these options, it's not workable for an organization that gets a lot of spam. What's really needed in IMF is the ability to white list addresses or domains and to configure it to always delete messages with an SCL higher than a specific number and archive those with lower SCLs. To meet this need, two new products are available which offer white lists and other options, making it much easier to manage the UceArchive.

The first, Sirana SpamCenter, is suitable for organizations that want a simple standalone solution. Archived messages are stored in an SQL database. Users can view their messages in the archive using their web browser and release any messages which are not spam. Users can also create their own white lists and blacklists. Administrators can view reports containing information such as the most frequently spammed mailboxes and peak times of the day or week for spam. I've been using a beta build of SpamCenter for the last couple of weeks and it's very easy to use.

The second product is the Nemx Exchange IMF Extension for the Nemx PowerTools antispam filter. It also supports white lists, using not only the From address, but also the subject, body, and header fields.

Along with white listing capabilities, Exchange IMF extension allows you to set thresholds and define different actions for each SCL range. For example, you can use thresholds to always delete messages with an SCL rating over 7 but quarantine messages between 4 and 6. It also supports assigning different thresholds and actions by user groups. For example, when used in a school setting, messages sent to the staff can be quarantined while the same message sent to students is deleted. Because the Exchange IMF extension is part of a more robust content control program, you'll also be able to apply actions to the messages, such as rerouting the message or moving it to a subfolder.

A reader writes: "I receive a message on a regular basis and IMF is dropping it in to the UCEArchive folder. Is there any way to always allow messages from this sender?"

While white lists are a basic feature found in all other anti-spam programs, the inability to always allow messages from specific senders is one of the big drawbacks to IMF.

If the Exchange server is the gateway, you can configure Exchange to always allow messages sent from a specific IP or IP range (but not email address or domain). If the Exchange server is behind a gateway this won't work as Exchange sees your gateway IP, not the originating IP.

To enable this option, open the Exchange System Manger and browse to Global Settings, Message Delivery, Message Filtering. Add the SMTP IP address into the Global Accept field.

Another option is to use one of the two programs mentioned earlier which support white lists, Nemx Exchange IMF Extension or Sirana SpamCenter.

This week's Knowledgebase articles for Outlook contain a number of post-SP hotfixes which require you to contact Microsoft to obtain. While many of our readers are administrators and are familiar with the process they must follow to obtain a hotfix, individuals often don't know how to obtain them.

It's actually quite easy and painless. If you don't have a support agreement and don't know who to call for a hotfix, US residents can call 1-800-936-4900 then press 3 for hotfixes. Tell them you're calling to obtain the hotfix described in KB [number] and they'll take care of it, at no charge. That's right - all hotfixes are free if you problem is the one described in the KB article. The procedure for non-US callers is similar.

Should you install a hotfix if the problem listed in the kb article doesn't affect you? No. Hotfixes aren't tested as well as service packs and are designed to fix a specific problem. Unless it's a problem that affects your use of the program, wait until the hotfix is released in a SP or on Office Update.

How accounts and mailboxes are created and mapped when you use the Migration Wizard to migrate from Exchange Server 5.5 to Exchange 2000 Server or to Exchange Server 2003 (281583)

An e-mail message may not be formatted correctly when a recipient sends the e-mail message from an Exchange Server 2003 computer to another Exchange recipient (835992)

How to automatically delete messages in the Badmail folder in Exchange Server 2003 and in Exchange 2000 Server (867642)

Setup with the /forestprep switch does not succeed, and you receive a 0xC1037AE6 error message (870829)

A memory leak occurs when you run the Incremental Change Synchronization API in a loop in Exchange Server 2003 (887828)

The available memory gradually decreases on your Exchange 2000 Server computer (867648)

A mail-enabled contact may receive a Winmail.dat file attachment with an SMTP e-mail message instead of receiving the correct file attachment in Exchange 2000 Server (841668)

Advantages and disadvantages of decreasing the log checkpoint depth in an Exchange 2000 Server cluster (886298)

The MSExchangeMTA service may stop responding in Exchange 2000 Server (870988)

Your outgoing SMTP e-mail may not be delivered successfully if you have configured an inbound IMS connector in Exchange Server 5.5 (884423)

Outlook e-mail message format overrides the Internet message format that is specified by your Exchange Server 2003 computer (883490)

Address length padding may be miscalculated when Exchange Server 2003 validates the PR_REDIRECTION_HISTORY property (883940)

Memory usage by the Adc.exe process continually increases on the Exchange Server 2003 computer that is running the Active Directory Connector (884576)

A move mailbox operation is not successful, and Event ID 9166 appears in the Application log in Exchange Server 2003 (886700)

Incoming messages to the back-end server are stuck in the Messages Awaiting Directory Lookup queue on the SMTP bridgehead server in Exchange 2000 Server (328339)

You receive error ID 80004005 when you use Exchange System Manager to try to change the domain controller that is specified in the properties dialog box for the Recipient Update Service in Exchange 2000 (821465)

The Microsoft Exchange Information Store service may unexpectedly quit on an Exchange 2000 computer (884860)

The Microsoft Exchange Information Store service may crash repeatedly in Exchange 2000 Server (886973)

You may experience inconsistent search results after you configure MAPI restrictions on public folder content in Exchange 2000 Server (885857)

A prefix in the Subject line of a journaled e-mail message is duplicated in Exchange 2000 Server or in Exchange Server 2003 (886769)

You cannot open Business Contact records in Outlook 2003 with Business Contact Manager (837998)

You may receive an error message when you click "View the Tours" in Office Outlook 2003 with Business Contact Manager (888633)

E-mail messages that you read in a public folder remain marked as unread in Outlook 2003 (838896)

Description of the Outlook 2003 post-Service Pack 1 hotfix package: September 9, 2004 (839647)

If you try to perform a function after you run a script in Outlook 2003 that connects an Outlook 2003 Calendar folder that belongs to another user to your calendar, Outlook 2003 quits unexpectedly (843180)

Description of the Outlook 2003 post-Service Pack 1 hotfix package: September 9, 2004 (885227)

Description of the Outlook 2003 post-Service Pack 1 hotfix package: September 13, 2004 (885243)

Duplicate e-mail messages are downloaded from a POP3 e-mail server account in Outlook 2003 (885870)

The offline Address Book may not download successfully in Outlook 2002 and Outlook 2003 (887409)

You receive error messages one minute after the download process when you download many e-mail messages from an HTTP server that is on a slow connection in Outlook 2002 (830444)

Description of the Outlook 2002 post-Service Pack 3 hotfix package: October 25, 2004 (887808)

Duplicate e-mail messages are downloaded from a POP3 e-mail server in Outlook 2002 (888238)

Description of the Outlook 2003 post-Service Pack 1 hotfix package: September 2, 2004 (883942)

You can delete only one shared calendar at a time in Outlook 2003 (884839)

Description of the English version of the Outlook 2003 post-Service Pack 1 hotfix package: September 13, 2004 (885244)