Panda Security for Exchange Servers

How to configure the Exchange server to apply local quarantine
Panda Security for Exchange
Servers
How to configure Exchange 2003/2007 servers to
create a local quarantine on each Endpoint
January 2009
Copyright notice
© Panda Security 2009. All rights reserved. Neither the documents nor the
programs that you may access may be copied, reproduced, translated or
transferred to any electronic or readable media without prior written permission
from Panda Security, c/ Gran Vía Diego López de Haro 4, 48001 Bilbao (Biscay)
Spain.
Trade Mark
Panda Security ™. TruPrevent: Registered in U.S.A Patent and Trademark Office.
Windows Vista and the Windows logo are trademarks or registered trademarks of
Microsoft Corporation in the United States and other countries. All other product
names may be registered trademarks of their respective owners. D. L. BI-1915-07
© Panda Security 2009. All rights reserved.
© Panda 2009
Page 1
How to configure the Exchange server to apply local quarantine
Contents
INTRODUCTION .............................................................................................................3
CONFIGURING PANDA SECURITY FOR EXCHANGE SERVERS ......................................3
CONFIGURING EXCHANGE 2003/2007 SERVER TO ACT ON SCL FLAGS ......................5
OPTION 1: FLAG WITH SCL (EXCHANGE 2003) ............................................................... 5
OPTION 2: FLAG WITH SCL (EXCHANGE 2007) ............................................................... 8
© Panda 2009
Page 2
How to configure the Exchange server to apply local quarantine
Introduction
The purpose of this document is to inform users how to configure Exchange 2003/2007 servers for
flagged messages to be directly sent to users’ MS Outlook Junk Email folder.
This system will depend on each company’s structure and spam management method, the
advantage being that end-clients manage their own spam folder and can therefore easily detect
possible false positives and immediately report them to the administrator to be restored and for
future identification. Additionally, administrator costs are reduced as users manage their own spam
folders in local quarantines.
Configuring Panda Security for Exchange Servers
The anti-spam protection included in Panda Security for Exchange Servers allows administrators to
carry out three different actions on the spam detected, from the AdminSecure console:
Exchange 2000:
-
Let the message through.
Move the message to a specific location (these messages do not reach recipients, they are
sent to a mailbox predefined by the administrator).
Delete message.
Figure 1: AdminSecure protection settings screen in Exchange 2000
© Panda 2009
Page 3
How to configure the Exchange server to apply local quarantine
Exchange 2003/2007:
-
Let the message through.
Move the message to a specific location (these messages do not reach recipients, they are
sent to a mailbox predefined by the administrator).
Delete message.
Flag with SCL: The server is configured for a specific action predefined by the
administrator to be taken on the flagged messages received. By default, Exchange Server
will send messages with SCL rating 8 or greater to users’ Junk Mail folder.
Figure 2: AdminSecure protection settings screen in Exchange 2003
© Panda 2009
Page 4
How to configure the Exchange server to apply local quarantine
Figure 3: AdminSecure protection settings screen in Exchange 2007
Configuring Exchange 2003/2007 server to act on SCL flags
Once Panda Security for Exchange Servers has been configured to apply a specific SCL flag to
messages, the Exchange server must be configured to identify those messages and take specific
actions on them.
OPTION 1: FLAG WITH SCL (EXCHANGE 2003)
In Exchange 2003 servers it is necessary to use IMF (Intelligent Message Filtering).
In this case:
Set the SCL rating for moving messages to the user’s Junk Email folder.
© Panda 2009
Page 5
How to configure the Exchange server to apply local quarantine
In the Message Delivery
Properties, you can access
IMF and select the SCL rating
for which the move to Junk Email folder action will be
applied.
© Panda 2009
Page 6
How to configure the Exchange server to apply local quarantine
To activate IMF, go to Exchange System Manager, right-click “Default SMTP Virtual Server” and
select Properties.
To activate IMF in the Default SMTP Virtual Server Properties screen, click Advanced > Edit, and
select the “Apply Intelligent Message Filter” checkbox:
© Panda 2009
Page 7
How to configure the Exchange server to apply local quarantine
OPTION 2: FLAG WITH SCL (EXCHANGE 2007)
You must then send the messages flagged by Exchange with that SCL* to the user’s Junk Email folder
To do this, follow the steps below:
1. Open the Exchange Management Shell (EMS).
© Panda 2009
Page 8
How to configure the Exchange server to apply local quarantine
2. Bearing in mind that the filtering is done by a third-party (Panda Security for Exchange Servers),
one of the following actions must be taken:
> Disable the Exchange Content-Filter Agent:
Disable-TransportAgent Content Filter Agent
>
Disable the actions Delete, Reject or Quarantine.
Set-ContentFilterConfig –SclDeleteEnabled $false –SCLRejectEnabled $false –
SCLQuarantineEnabled $false
© Panda 2009
Page 9
How to configure the Exchange server to apply local quarantine
This is done because Panda Security for Exchange Servers carries out the filtering and in order to
move spam messages to users’ Junk E-mail folder.
3. From then on, all emails with SCL > SCLJunkThreshold will be sent to users’ Junk E-mail folder.
4. The SCLJunkThreshold can be modified for all the organization in the Exchange Management
Shell (EMS), through the command:
Set-OrganizationConfig -SCLJunkThreshold <SCL threshold value>
(*SCL: Spam Confidence Level)
© Panda 2009
Page 10