Jan
28

Exchange 2003 SP2 IMF Keyword Manager

By Paulie

Exchange 2003 sp2 comes with an updated intelligent message filter. One of the new features of the updated IMF is the ability to add a custom weighting file that gives administrators more control over incoming mail.

I have used this file a few times on customers systems, usually to allow certain automated e-mails through the IMF which were being incorrectly identified as spam.

The problem is that Microsoft have not included a GUI to edit the MSExchange.UceContentFilter.xml file. ?Ǭ�So it must be generated by hand, and while this isn’t difficult, it is not very convenient and it is easy to make a mistake.

I was looking for an excuse to have a play with Visual Basic 2005 and so I have made a little utility to make creating and managing the MSExchange.UceContentFilter.xml a little easier.

Screenshot 1

Becomes….

Generated XML File

The utility can be downloaded from here.(Requires .net 2.0).

If you need more information on how to implement the custom weighting feature then see:

Microsoft Exchange Server 2003 Service Pack 2 Release Notes

Microsoft Exchange Server Intelligent Message Filter v2 Operations Guide

Comments

  1. Jamie says:

    Thanks for this mate, I am going to use it at the school and eradicate junk period…yeah right. Nice little app!!!

  2. Lee says:

    Excitedily downloaded your app, but tried it on a XPMachine (just to create the file) and it ended with an error, so tried it on my SBS2003 and still the same error (can supply the install log file if required)…

    The following error occurred attempting to install ‘C:\Program Files\Exchsrvr\bin\MSCFV2\Exchange 2003 IMF Keyword Manager.application’:
    “The system cannot find the file specified. ”

    See the setup log file located at ‘C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\1\VSD31.tmp\install.log’ for more information.

  3. Paulie says:

    Thanks for letting me know, I had a setting wrong in VB. It should work now.

  4. Paul says:

    What a fantastic little app that has made life alot easier

    Thanks

  5. virtualbawheed says:

    Does the SMTP servive require restarted after adding keywords? Also what are the minus values for?

  6. Paulie says:

    Not sure if you need to restart the SMTP service. You certainly do not have to restart when the file is changed.

    The value being plus or minus helps to determine what spam score the message will eventually receive.

    The higher the value the more likely it is spam and the lower the less likely. You can assign minus values to content you consider to be safe.

  7. Gerard says:

    I tried installing the tool but I just get an XML page Output. I have Net 2.0 installed on a Windows 2003 Standard Server.

  8. Wahoo says:

    Thank you for sharing!

  9. Anders says:

    I get the same as Gerard, just a xml page output….

  10. Paulie says:

    I think I have this fixed now, was something to do with mime types in Apache. If anyone else has this issue please let me know and I will just post up a zip file with the install files in it.

  11. Anders says:

    Regarding the question about restaring smtp-service MS states the following:

    Custom weighting is made available in the form of an XML configuration file that is read by Intelligent Message Filter upon initialization, and then reloaded any time the file changes. If the XML configuration file is not present when Intelligent Message Filter is started, you must restart the SMTP service. The custom weighting file, MSExchange.UceContentFilter.xml, should be located in the same directory as the MSExchange.UceContentFilter.dll and .dat files.

  12. Jim Mist says:

    Thanks for the very useful application, I previously hand edited the xml and made mistakes, the custom filtering just stops working without any error.
    Such a simple application removes all of the risk, why on earth did Microsoft not program a gui when they introduced the feature.

  13. Simon says:

    Hi,

    I installed the utility, which installed without any errors. I ran a test by entering Type = Both, Change =MAX and entered a word in the Text box. I sent an email with the entered word and it still went through my Exchange server, is there something I have missed?

    Regards

  14. Paulie says:

    E-mails sent internally are not spam checked at all. So make sure you test from an external account.

    If you have IMF updates installed then you need to put the XML file in to the subdirectory of your latest IMF update.

    Lastly you might need to restart the SMTP service if it is the first time you have used the custom weighting file.

  15. PaulCheeseman says:

    Hi

    I have the same problem as Simon (#13), I have got the xml file in the right directory, (no updates added yet) and have restarted the SMTP service a few times. I am sending tests from an outside account, but they all get through. current settings on test words are either 9 or MAX.

    Any other suggestions ?

    Love the Interface BTW, once its working, it will be a godsend!

    Regards

    Paul

  16. Paulie says:

    Might be because you have IMF updates installed and therefore you need to put the XML file in the subfolder of the updates.

    Do you know if you have IMF updates installed?

  17. PaulCheeseman says:

    HI Paulie

    No, I only have the original MSCFV2 directory. No updates on this have been applied yet. I’ll get the latest update, move my .xml file to the new place and try again.

    Fast reply! impressed :)

    Paul

  18. PaulCheeseman says:

    No updates actually installed, even with the registry entry set to 1. I expact the fault is with IMF itself, so I need to get that working first … Everything seems right, and in the right place, so I guess I have missed something …

    Paul

  19. John Silvia says:

    Folks, the XML code that’s output by this utility is the code needed by the IMF in your Exchange 2003 server. Custom editing XML is possible, but only for the most meticulous of us. What this can really do that’s cool is XML code can be created so that your SCF can be set in response to custom headers you put on the email using other anti-spam systems. The Piratefish anti-spam system, for instance, does a great job of blocking spam – but with custom mods to the IMF with this, you can control where spam is delivered – so instead of blocking low scoring spam (that might be mis-identified) you could in fact deliver it – and let the IMF place the message into your users junk folder automatically. I’ve linked to some other resources (including this page) here: http://www.piratefish.org/registered/piratefish_tuning-3.0.html#Exchange

    Cheers!

  20. [...] a very sophisticated solution but for now I have edited the Exchange IMF custom weighting file on customer systems to ensure that messages with "UPS" in the subject line are never [...]

  21. Hallgrimur says:

    Real life saver

    Thank you!

  22. Sam says:

    IMF has worked like a dream for me. Each time I update the XML, I manually start and stop the SMTP service. Unfortunately, as of the last DLL update to IMF (6.5.8066.0), my SMTP service hangs when I attempt to stop the service. Problem first noticed when the service never restarted after the update was installed. Any ideas?

  23. [...] Ah… me confund?? con el antispam de Exchange 2007. Vas a tener que usar una herramienta como http://www.accendo.co.uk/blog/?p=4 para eso. — Pablo D. Vernocchi Microsoft Exchange MVP MCSE + M / MCSE + Sec [...]

  24. [...] le email marcate come spam in posta indesiderata puo fare cos?¨: Installi IMF keywork manager (http://www.accendo.co.uk/blog/?p=4) e generi una regola che assegna uno score alto (es. 9) alle email che hanno ***SPAM*** in oggetto. [...]

  25. [...] SPaM about Watches and casinos Here are links to a couple of tools: http://www.accendo.co.uk/blog/?p=4 http://www.windeveloper.com/imftune/…inimftune3.htm But as Mark mentioned, you are rather [...]

  26. Lori says:

    Thank you SO much! This works BEAUTIFULLY! I’m running Exchange 2003 on SBS w/ IMF. I saved the test file (both / MAX / viagra) to the most recent update folder (C:\PF\ExchSrvr\bin\MSCFV2\6.5.8070.0), stopped & started SMTP, sent a test message & it was re-routed to the UCEArchive folder. PERFECT! Interesting to note that I sent the same email from 2 different domains – 1 of which I have added to the Connection Filtering Accept List – that email did get delivered despite having ‘viagra’ in the Subject so I guess the Connection Filtering Accept List takes precedent over the keyword list. That’s totally fine, just thought I would mention it! Thanks again!!

  27. Remy says:

    Hello,

    i can’t install your software . Setup.exe return the following error (install.log):
    Launching Application.
    URLDownloadToCacheFile failed with HRESULT ‘-2147024891′
    Error: An error occurred trying to download ‘http://www.accendo.co.uk/blog/files/exchangeimf/Exchange 2003 IMF Keyword Manager.application’.

    Note : I’m behind a proxy that require authentication.

    Thanks

  28. Paulie says:

    In light of how many people have problems installing this software through the one-click web installer I have repackaged it into a standard setup executable.

    Remy – This should fix your problem.

Leave a Reply