When Microsoft released the first version of the Microsoft Exchange Intelligent Message Filter (IMF), I installed it on two servers: my home server and my work server. Each server has about 20 users, and these users are fairly evenly divided between those who have used the same email address for years (like me) and those whose addresses are newer and thus less widely distributed. Some users on both servers liberally publicize their addresses, while others tightly guard them. Each server receives anywhere from 500 to 1000 legitimate messages and 200 to 400 spam messages per day. I was already using the excellent NetIQ MailMarshal SMTP to filter spam on both servers, so IMF didn't have much to do. Unfortunately, the old box I was using to run MailMarshal SMTP gave up the ghost this past week. Rather than rebuild it, I decided to let IMF have a crack at stopping the spam all by itself.
To begin my test, I set the IMF gateway threshold to 6 and the store threshold to 8. (For more information about what these numbers mean and about IMF in general, see "Exchange Gets Filtered," November 2003, http://www.winnetmag.com/article/articleid/41121/41121.html .) These values are fairly permissive, but I was a little worried about throwing away legitimate email. I set the IMF mode to Archive. After a few hours, I didn't see any messages in the archive; then I remembered that you have to stop and restart the Store on the machine that's running IMF to get the software to notice mode changes. After I did that, spam started hitting the archive directory.
So far, the results have been pretty good. Most of the users are using Outlook 2003, a few folks use Outlook Web Access (OWA) only, and a handful of others run Microsoft Entourage 2004 for Mac (which uses a junk mail filter based on the same code as IMF and the Outlook 2003 Junk E-mail Filter). After 5 days, the users--and I--have gotten only a handful of spam in our Inboxes. IMF hasn't flagged any legitimate messages as spam at the gateway and has misjudged only two legitimate messages at the store threshold. (I found both messages in my Junk Mail folder. Interestingly, one of them was a post to a security mailing list, and one was a mailing-list message from a microsoft.com address. Go figure.)
IMF definitely lacks many of the features I've grown accustomed to in third-party antispam products, though. For example, the IMF interface in Exchange System Manager (ESM) doesn't provide any way to review archived messages. However, Daryl Maunder has written a Web-based tool, and James Webster of the Exchange team at Microsoft has written a GUI tool in C#. Both are useful; you can find links to them, and screenshots, at http://www.e2ksecurity.com/archives/000835.html . In addition, IMF requires you to use Performance Monitor to get statistical data about what's happening with messages, and you can't change the filter's rules. The software doesn't block attachments according to type, and it can't perform any kind of content-based inspection (e.g., quarantining inbound encrypted messages, selectively adding disclaimers from certain users).
Still, IMF isn't intended to compete with third-party products. It's a simple, free spam filter meant to add one more level of protection--and it does a good job at that.
Register
