SpamMoverPF for MS Exchange 2000/2003 event sink application

Updated: 7-September-2007

Current version: 1.2.0.145


Purpose

This application can scan any message that is delivered to a mail-enabled public folder. If that message carries an X-header or subject line marking it as spam, as added by such tools as SpamAssasin or GFI Mail Essentials, SpamMoverPF application will move it into a specified public folder. These marked messages can be forwarded to specified e-mail address or deleted instead of moved. 

Any amount of rules can be configured.

The application is an Exchange store event sink. 



Benefits

- You can set up SpamMoverPF on per-folder basis or as "store-wide" application, i.e. it will work on each public folder of Exchange 2000/2003 Public Folder Store

- You do not need to configure Spam rules on each public folder using Folder Assistant

- The application is server-centric, so you do not need to install any extra software on the client side 

- The application can mark each moved message with the "Originally delivered to" custom field, that contains a URL of the public folder where a message has been delivered initially. The e-mail address of that public folder is placed to "E-mail Account" Outlook field also. It allows someone to return back the "false positive" messages. 



Installation

On your Exchange 2000/2003 Server computer:

1. Create a new mail-enabled public folder named PFTEST. You should create this public folder for test purposes only, so you can delete it after you satisfy yourself with the fact that the application is actually works.
 
2. Create a new public folder named SpamCentral. You should create this public folder for test purposes only, so you can delete it after you satisfy yourself with the fact that the application is actually works.

3. Select (or create) a mailbox-enabled user account that is a member of the local Administrators, Domain Admins, Domain Users and Exchange Domain Servers security groups.
That account must have full permissions on the public folder store. Open ESM (Exchange System Manager) and drill down to the public folder store in question. Now open the properties and select the Security tab. Add your account and allow full control.
See also this MS article: 
Exchange 2000 Permissions Required to Configure an Event Sink (http://support.microsoft.com/default.aspx?scid=kb;en-us;812861)

4. Log on as that user.

5. Create C:\Program Files\SpamMoverPF\ directory.

6. Download SpamMoverPF.zip archive file to C:\Program Files\SpamMoverPF\ directory and extract all files.

7. Run C:\Program Files\SpamMoverPF\SpamMoverPFSetup.exe

8. (Only for Exchange 2000) Place step #3 account name and password in the appropriate fields in COM+ object frame.

9. Click Install button in COM+ object frame.

10. In Rules frame click Add button. Select "Subject:" from the drop-down list under SMTP header label. Fill out Value field with "[SPAM]" (without quotes). Make sure the Action field contains "move to". Click Spam Central in the list of public folders to populate Target URL field. Click OK  button to close the New rule window and save the changes. Make sure the rule is added to Rules list.

11. In Per-folder registration frame select PFTEST public folder (see step #1) in the list and mark its checkbox. Click Change button. The list will be refreshed. Make sure PFTEST is still checked.
 
12. Click Exit button.


Cluster Installation Specifics

1. Open Computer Management, double-click Services and Applications and click Services. In the details pane, double-click Cluster Service. On the Log On tab you can find the name of the Cluster Service Account. This account hast to be mailbox-enabled. Make sure the account fits all reqirements described in step #2 of Installation section.

2. In order for SpamMoverPF to failover to another node, on the Exchange cluster shared drive (for example, E:) create SpamMoverPF directory. Copy there SpamMoverPF.dll and SpamMoverPFSetup.exe files. Create there SpamMoverPF_Reactivation.bat batch file that includes the following:
   Rem Reactivation of SpamMoverPF
   E:
   CD \SpamMoverPF
   E:\SpamMoverPF\SpamMoverPFSetup.exe -b
   Rem Done

3.Create a cluster resource for SpamMoverPF_Reactivation.bat: On the active node of the cluster, open the Cluster Administrator. Right-click on the group corresponding to the Exchange Virtual Server and select New > Resource to start the resource creation wizard. In the New Resource panel, type
   SpamMoverPF_Reactivation
in the Name field.
Select Generic Application as the Resource Type and the group corresponding to the Exchange Virtual Server in the Group field. Click Next.
In the Possible Owners panel, accept the default setting of having both nodes as possible owners and click Next.
In the Dependencies panel, select the Exchange Information Store and the shared drive as dependencies and then click Next.
In the Generic Application Parameters panel, type
   CMD /K "E:\SpamMoverPF\SpamMoverPF_Reactivation.bat"
for the command line and
   E:\SpamMoverPF
for the current directory.
Select the option to allow application to interact with desktop.




Testing

1. Start Outlook and navigate to the SpamCentral public folder. If you are running Outlook 2000 or Outlook 2002(XP), click View > Current view > Customize current view > Fields. For Outlook 2003, click View > Arrange by > Current view > Customize current view > Fields. Click New field button. Place "Originally delivered to" (without quotes) to the Name field. Place "Text" to the "Type" and "Format" fields. Click OK button. From the "Select available fields from:" list select "All mail fields". Select "E-mail account" from the "Available fields:" list (in Outlook 2000 the name of this field is "Internet Account"). Click Add button. Click OK button. Click OK button again to close the "View summary" window.

2. Assuming you placed [SPAM] to Value field (see Installation - step #9), send a message with [SPAM]1 subject field to PFTEST public folder.

3. Make sure the message you just sent is moved to the SpamCentral public folder. Note that "E-mail account" field is filled with e-mail address of PFTEST public folder and "Originally delivered to" field is filled with URL of PFTEST public folder. 

4. Send a new message that DOES NOT contain [SPAM] in the subject line to PFTEST public folder. Make sure the message you just sent is delivered to PFTEST and not moved to Spam Central.


I have tested SpamMoverPF with Outlook 2002 and Exchange 2000 SP3 on MS Windows 2000 SP3 Advanced and Exchange 2003 SP1 on MS Windows 2003 server.



Comparison Expressions

Let's suppose that your spam software (Symantec Mail Security, for example) adds an X-Header if the SCL (Spam Confidence Level) value of a message is greater than 3 (or whatever you set the value at). The X-Header that is added is this:
   X-SMSMSE-SCL: x 
where x is the SCL value of the message. You need to move to the spam folder any message with an SCL value of 4 or higher. To get this result, click Add in Rules frame. Mark a radio button near "SMTP header" field and place the following expression to "SMTP header" field:
   X-SMSMSE-SCL:
Then place the following expression to "Value" field: 
   {>3}

The gollowing syntax is also acceptable:
   X-SCL:           {>4 <11}
   X-CustomHeader:  {>3.9 <11.1}
   X-Spam-Status:   No, hits={>-4.9}

Note that you can set only one comparison expression per "Value" field. 



Cooperation with MS Intelligent Message Filter or other application that can assign the Spam Confidence Level (SCL) 

The SCL property is not exposed to the end user. It means there is no any visible value in the message body or in the SMTP headers that indicates the SCL rate of the message.
SpamMoverPF can work with SCL value though.
To handle the messages whose SCL score is equal to 3, you should create a new rule:
1. Click Add in Rules frame.
2. Check "SCL value is" radio button. Select "is equal to" in the drop-down list. Select 3 in the next drop-down list. 
3. Select appropriate Action and Target URL values.

By the way, you can visualize the message SCL score using our free ShowSCL and ShowSCLPF applications:
http://ivasoft.com/showscl.shtml 
http://ivasoft.com/showsclpf.shtml



Uninstallation

1. Start C:\Program Files\SpamMoverPF\SpamMoverPFSetup.exe

2. In Per-folder registration frame click Uncheck all button. Click Change button.

3. In Rules frame click Delete All button. Hit Yes when you will see the confirmation alert.

4. In COM+ Object frame click Uninstall button.

5. Press Exit button.



About this demo version. 

SpamMoverPF demo version works only for public folders whose names include "TEST". Examples:
      SpamMoverPF1TEST
      Test2SM
Other public folders are unavailable. Also you can not register this demo version for all public folders at once (store-wide). Full product version has no limitations. 



The last-time updates you can find at http://www.ivasoft.com/spammoverPF.shtml


Feel free to send me your comments and criticism.

Thank you,

Victor Ivanidze,
software developer. 
IvaSoft
http://www.ivasoft.biz
mailto:SpamMoverPF@ivasoft.biz
