使用ExchangeIMF引擎过滤垃圾邮件.doc

使用Exchange IMF引擎过滤垃圾邮件文档主要包含以下几个部分：1 IMF技术简介2 IMF配置和微调步骤3 IMF归档邮件察看和处理步骤4 IMF日常维护和排错建议5 工作步骤Check List6 参考资料1 IMF技术简介1）IMF OverviewIntelligent Message Filter (IMF) is a content filter designed specifically for Exchange. It is basedIntelligent Message Filter is installed alt= src=/upimg/allimg/070523/1612110.gif border=0After Intelligent Message Filter has assigned an SCL to the message, it is evaluated against two thresholds configured by the administrator as follows:1. Gateway blocking configuration: Block messages with an SCL rating greater than or equal to. If the SCL of a message is greater than or equal to the value set here,a. Archiveb. Deletec. No actiond. Reject2. Store junk e-mail configuration: Move messages with an SCL rating greater than. If the message is greater than the value set here, the message will be delivered to the junk e-mail folder of the users inbox, unless the user has the senderIMF version 2 includes a completely new feature called the Custom Weighting Feature (CWF), which allows you to customize IMF even further. With CWF you can filter e-mail messages basedDrive_letter:Program FilesExchsrvrbinMSCFV2 Before you can make use of the CWF you need to register the MSExchange.UceContentFilter.dll file, you do this by opening a command prompt then issue the following command:regsvr32 Drive_letter:Program FilesExchsrvrbinMSCFV2MSExchange.UceContentFilter.dllWhen the MSExchange.UceContentFilter.dll file has been registered you can start to add words or phrases to the MSExchange.UceContentFilter.xml, normally Notepad would be sufficient for this task (just make sure you save the file as a .xml in the Unicode format!) Below is an example of specific phrases and values you can use in the MSExchange.UceContentFilter.xml file.Value Description Type=”BODY” Search for value specified in text in the BODY field of the message Type=”SUBJECT” Search for value specified in text in the SUBJECT field of the message Type=”BOTH” Search for value specified in text in the BODY and SUBJECT field of the message Change The Change value is used to define what effect a matched word or phrase will have alt= src=/upimg/allimg/070523/1612113.gif border=0When you have created the registry key shown in figure above you need to restart the SMTP service in order to make the IMF update feature become effective.The IMF updates will be available every first and third Wednesday of the month through Windows Update, Automatic Updates, WSUS and SMS technologies, and as you can see in following figure below the first IMF update is already available for approval via Windows Update, Automatic Updates as well as WSUS.4）IMF integrate with OutlookAfter a message makes it past server-based anti-spam defenses, the Outlook 2003 client can actOutlook 2003 and Outlook Web Access for Exchange Server 2003 also allow users to create a list of safe senders from whom users always want to accept e-mail messages, as well as a list of blocked senders from whom users always want to reject e-mail messages. At the mailbox store, regardless of the SCL rating assigned to the message, Exchange delivers all messages from safe senders to the users inbox and all messages from blocked senders to the users junk e-mail folder. However, if the e-mail message has been blocked by the gateway threshold, it is not delivered to the users inbox because the message is never delivered to the mailbox store. If a user is running an earlier version of Outlook, the safe senders and blocked senders lists are not available. Any message marked as spam is delivered directly to the users inbox. Users with earlier versions of Outlook can use Outlook Web Access to define safe and blocked sender lists.2 IMF配置和微调步骤1） 配置SCL基准阀值和后续动作建议从SCL7开始，并设置后续动作为归档（Archive）。 2） 配置客户端Junk mail文件夹基准阀值 3） 调整服务器端归档邮件保存文件夹路径归档文件夹默认在program filesexchsrvmailrootvsi UceArchive 目录中。其中的#是IMF配置的SMTP虚拟服务器节点编号，默认为1。可以将该存档目录移动到一个空闲空间大的硬盘上，要移动该目录，请编辑如下注册表： HKEY_LOCAL_MACHINESoftwareMicrosoftExchangeContentFilter在此键下新增加一个STRING型的键，叫ArchiveDir，其值为目录的全路径，如E:Archive4） 配置注册表进行微调配置IMF在保存邮件时一同保存邮件的SCL等级,要使IMF自动保存SCL,请修改如下注册表:HKEY_LOCAL_MACHINESoftwareMicrosoftExchangeContentFilter增加一个DWord的键叫ArchiveSCL值为1.5） 在SMTP虚拟服务器上启用IMF 6） 配置自定义脏话字典按照要求更改MSExchange.UceContentFilter.xml文件，并根据业务情况定期调整关键字。3IMF归档邮件察看和处理步骤IMF归档管理器提供图形界面帮助管理员管理被IMF阻拦的归档邮件.该程序以C#编写,可在以下地址下载:/workspaces/workspace.aspx?id=e8728572-3a4e-425a-9b26-a3fda0d06fee执行其中的EXE文件,系统提示输入PICKUP目录和UCE归档目录位置接着系统出现程序界面IMF归档管理器允许你查看邮件的实际的SCL值,以便管理员可以依据本单位实际情况,确定合适的IMF阻拦策略. 4IMF日常维护和排错建议1） 根据实际情况调整SCL阀值2） 定期更新IMF的过滤引擎和定义文件3） 定期删除UCE目录下归档的垃圾邮件 5参考资料Microsoft Safety /mscorp/safety/default.mspx How to configure connection filtering to use Real-time Block Lists (RBLs) and how to configure recipient filtering in Exchange 2003/default.aspx?scid=kb;en-us;823866Introduction to the Microsoft Exchange Intelligent Message Filter Deployment Guide/technet/prodtechnol/exchange/guides/IMFDeploy/dbb65d96-b763-46a3-9942-41d5a23c2676.mspxFrontBridge, a Microsoft subsidiary /exchange/evaluation/fbridge Exchange Intelligent Message Filter/downloads/details.aspx?FamilyID=c1b08f7b-8caf-4147-b074-8c9c8f277071&DisplayLang=enExchange Server 2003 SP2 Overview/exchange/downloads/2003/sp2/overview.mspx Anti-Phishing Technologies/mscorp/safety/technologies/antiphishing/default.mspx Sender IDhtt