SpamMover for MS Exchange 2000/2003 event sink application

Updated: 29-December-2006



Purpose

This application moves into a special folder in a user's mailbox any message that carries an X-header or subject line marking it as spam, as added by such tools as SpamAssasin or GFI Mail Essentials. These marked messages can be deleted instead of moved. The application allows user to set up to 4 independent rules.
SpamMover creates a folder named Spam (or whatever you prefer) in each Exchange mailbox automatically. 
The application is an Exchange store event sink.



Benefits

- You can set up SpamMover on per-mailbox basis or as "store-wide" application, i.e. it will   work on each user's Inbox in the certain Exchange 2000/2003 mailbox store 

- You do not need to configure Spam rules on each workstation that runs Outlook

- The application is server-centric, so you do not need to install any extra software on the client side 

- Even being deleted by user accidentally, Spam folder will be restored automatically when incoming message is received.



Installation

On your Exchange 2000/2003 Server computer:

1. Create a new mailbox-enabled user account. Mailbox alias must be SMTEST.
 
2. Select (or create) a user account that is a member of the local Administrators, Domain Admins, Domain Users and Exchange Domain Servers security groups.
That account must have full permissions on the mailbox store. Open ESM (Exchange System Manager) and drill down to the mailbox store in question. Now open the properties and select the Security tab. Add your account and allow full control.
See also these MS articles: 
Exchange 2000 Permissions Required to Configure an Event Sink (http://support.microsoft.com/default.aspx?scid=kb;en-us;812861)
and 
How to Get Service Account Access to All Mailboxes in Exchange 2000 (http://support.microsoft.com/default.aspx?scid=kb;en-us;262054)


3. Log on as that user.

4. Create the C:\Program Files\SpamMover\ directory.

5. Download SpamMover.zip archive file to the C:\Program Files\SpamMover\ directory and extract all files.

6. Run C:\Program Files\SpamMover\SpamMoverSetup.exe

7. Check the Install COM+ object checkbox. Place the #2 account name (using <domain>\<account> syntax) and password in the appropriate fields. Modify the Spam header field.  Select "move to folder" in the Action field. Type the name of the folder in the Target folder field. Make sure the Priority field is filled with 65535. Click the CHANGE button.

8. Select  the SMTEST mailbox in the second list and check the Register in the following Mailboxes checkbox. Click the CHANGE button. The  SMTEST mailbox will be placed in the third list box.
 
9. Click the Exit button.



Store-wide registration

If you wish to register SpamMover store-wide, use the first and last lists to select/deselect the appropriate mailbox store.




Cluster Installation Specifics

1. Open Computer Management, double-click Services and Applications and click Services. In the details pane, double-click Cluster Service. On the Log On tab you can find the name of the Cluster Service Account. This account hast to be mailbox-enabled. Make sure the account fits all requirements described in step #2 of Installation section.

2. In order for SpamMover to failover to another node, on the Exchange cluster shared drive (for example, E:) create SpamMover directory. Copy there SpamMover.dll and SpamMoverSetup.exe files. Create there SpamMover_Reactivation.bat batch file that includes the following:
   Rem Reactivation of SpamMover
   E:
   CD \SpamMover
   E:\SpamMover\SpamMoverSetup.exe -b
   Rem Done

3.Create a cluster resource for SpamMover_Reactivation.bat: On the active node of the cluster, open the Cluster Administrator. Right-click on the group corresponding to the Exchange Virtual Server and select New > Resource to start the resource creation wizard. In the New Resource panel, type
   SpamMover_Reactivation
in the Name field.
Select Generic Application as the Resource Type and the group corresponding to the Exchange Virtual Server in the Group field. Click Next.
In the Possible Owners panel, accept the default setting of having both nodes as possible owners and click Next.
In the Dependencies panel, select the Exchange Information Store and the shared drive as dependencies and then click Next.
In the Generic Application Parameters panel, type
   CMD /K "E:\SpamMover\SpamMover_Reactivation.bat"
for the command line and
   E:\SpamMover
for the current directory.
Select the option to allow application to interact with desktop.




Testing

1. Assuming you have placed "X-Spam-Flag: YES" to the Spam header field, "Move to folder" to the Action field and "Spam" to the Target folder field (see Installation - step 7), send a message that contains "X-Spam-Flag: YES" header to SMTEST.

2. Using Outlook, open the SMTEST mailbox. Make sure the Spam folder has been created on the same level as the other main folders like Inbox, Outbox etc. Also make sure the message you just sent is placed in the Spam folder. 

3. Send a message that DOES NOT contain "X-Spam-Flag: YES" header to SMTEST

4. Make sure the message you just sent is placed in the Inbox folder of  SMTEST mailbox.

5. When finished, you can delete the  SMTEST account and mailbox.

I have tested SpamMover with Outlook 2002 and Exchange 2000 SP1/SP2/SP3 on MS Windows 2000 SP3 Advanced server. It also can run with Exchange 2003 server on Windows 2003. 



Expressions

Let's suppose that your spam software (Symantec Mail Security, for example) adds an X-Header if the SCL (Spam Confidence Level) value of a message is greater than 3 (or whatever you set the value at). The X-Header that is added is this:
   X-SMSMSE-SCL: x 
where x is the SCL value of the message. You need to move to the spam folder any message with an SCL value of 4 or higher. To get this result, place the following in the "Spam header" field:
   X-SMSMSE-SCL: {>3}
This syntax is also acceptable:
   X-SCL:{>4 <11}
   X-CustomHeader:{>3.9 <11.1}
   X-Spam-Status: No, hits={>-4.9}
Note that you can set only one {...} expression per "Spam header" field. 




Cooperation with MS Intelligent Message Filter or other application that can assign the Spam Confidence Level (SCL)

The SCL property is not exposed to the end user. It means there is no any visible value in the message body or in the SMTP headers that indicates the SCL rate of the message. 
SpamMover can work with SCL value though. You should place the following in the "Spam header" field:
   IMFSCL: 3 
if you wish to handle the messages whose SCL score is equal to 3.
To move/delete the messages with the SCL score greater than 4, use this syntax:
   IMFSCL: {>4}   
To manipulate the messages whose SCL score is 3 or 4, use this syntax:
   IMFSCL: {>2 <5}





Uninstallation

1. Start C:\Program Files\SpamMover\SpamMoverSetup.exe

2. Select all strings in the second mailbox list and mark the Unregister from the following mailboxes checkbox.

3. Mark the Uninstall COM+ object checkbox.

4. Press the CHANGE button. After uninstallation is complete, press the Exit button.



Batch mode

SpamMoverSetup.exe program can be run in batch (non-interactive) mode from the command line:
   SpamMoverSetup.exe -b
After starting in batch mode the program re-creates all current store event items. This feature could be useful if you are run SpamMover in the cluster environment.


About this demo version. 

SpamMover demo version works only for mailboxes whose names include "TEST". Examples:
      SpamMover1TEST
      Test2SM
Other mailboxes are unavailable. Also you can not register this demo version for all maiboxes at once (store-wide). The full product version has no limitations. 





Feel free to send me your comments and criticism.

Thank you,

Victor Ivanidze,
software developer. 
IvaSoft
http://www.ivasoft.biz
mailto://victori@mail.fact400.ru
