Home

Exchange 2003 Server SP2 rounds out the anti-spam capabilities of Exchange Server 2003. With addition of Sender ID and IMF filters Exchange server is now capable of protecting an Exchange organization from many spam attack vectors. The flexible, reliable, and robust Exchange 2003 anti-spam framework proved to be very effective and instrumental in protecting Microsoft IT infrastructure from Unsolicited Commercial E-Mail (UCE). However, the anti-spam solution offered by Exchange 2003 SP2 would not be complete without regular updates to the filter and spam definitions.  Spammers constantly change tactics to find new ways to penetrate anti-spam defenses.  And while spam attack vectors become obsolete rather quickly, it is necessary to keep track of them to prevent potential future ‘re-use’ of the attack scheme.  All of this means that getting new spam definitions into production e-mail environments is truly imperative.   

 

The regular updates to the Intelligent Message Filter (IMF) will allow administrators to place the newest spam definitions onto mail processing Exchange Servers. 

 

The regular IMF updates functionality can be enabled on Exchange 2003 SP2 servers that have IMF turned on (meaning these servers process inbound Internet mail).  To make the functionality available on the server, new ContentFilterState registry key with the DWORD value 1 must be created under: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Exchange.  The registry entry should look similar to this:

 

 

After you create this registry key, the next step would be to go to the Microsoft Update website and select the “Custom” button to scan for IMF Updates package (as shown below):

 

 

IMF Updates detection logic will detect the key and offer the package.  

 

Both the regular IMF updates and the Exchange Intelligent Message Filter itself are language agnostic and supported on all Exchange Server languages.

 

The update mechanism will maintain the last three versions of the IMF data and binary files on the Exchange 2003 that the updates are being applied to.  Once installed, the IMF update package will appear in Add/Remove Programs under the following name: “Update for Intelligent Message Filter on Exchange Server 2003: 2005.12.09 (KB907747)”.  You should see an entry in the ‘Add or Remove Programs’ (ARP) Control Panel similar to the below:

 

 

If you look closely at the name, you will see that ‘2005.12.09’ corresponds to the date when the package was released.  Over the course of the regular update cycle, this date will change while the name/number of the KB itself ‘(KB907747)’ will remain intact.  For example, for the package released on January 18th 2006, the full name will be: “Update for Intelligent Message Filter on Exchange Server 2003: 2006.1.18 (KB907747)”. 

 

The IMF update package can be uninstalled through the Add or Remove Programs Control Panel.  Removing an update package will trigger Exchange 2003 SP2 IMF binary registration, which will cause the server to use the IMF update binary that was shipped in the original SP2 package.  Uninstalling the IMF updates package will remove the Add/Remove Programs entry, delete an appropriate registry key for the update, and re-register the SP2 IMF binary.  However, as I said earlier, the IMF updates installer will maintain the three most recent last packages on the system.  An actual directory structure should be similar to the below:

 

 

It is important to understand that these directories will remain on the system intact and will be available for manual registration if needed so that, for example, you could remove the current package through Add/Remove Programs and run IMF using the previous package.  Corresponding KB907747 goes into great details how to achieve this.

 

You may be wondering about the frequency IMF updates…  The good news is that updates will be offered every first and third Wednesday of the month!  IMF updates will be available not only through manual installation but also via scheduled Automatic Updates (AU)!  The updates are cumulative (as they incorporate the latest spam definitions and data derived from the continuous learning and feedback loop processes), classified as Rollup Updates, and will be available for WSUS and SMS distributions!  The bottom line is that the IMF Updates will be available through Microsoft Update technologies and the method of implementing an update – e.g. manual, Automatic Update, SMS, etc. – is flexible. 

 

IMF updates will only be supported on Exchange 2003 SP2 servers with IMF enabled.  For the updates to take effect, IMF updates installer will restart IISADMIN, so the best time to apply updates will be the time when the least amount of mail traffic is expected (e.g. during the night).  The IMF updates installer will always offer the DAT and binary files to keep the Exchange IMF server implementation up to date with the latest anti-spam protection.  IMF is not supported on Exchange clusters and as such IMF updates will not be offered for Exchange clusters.  To summarize IMF updates offerings in a few words:

 

  1. IMF updates are twice per month

  2. IMF updates are only supported on Exchange 2003 Servers with SP2 where IMF is enabled 

  3. IMF updates are supported on all Exchange server languages

  4. IMF updates are available from Microsoft Update via both manual and AU

  5. IMF updates supports uninstall through Add/Remove Programs and manual rollback

- Alexander Nikolayev

105 Comments
Not applicable
Great stuff, however I made the registry change on an SBS2K3 server SP1, Exchange SP2, went to update site and no update found for IMF. Looking in add remove programs there is nothing listed for IMF either. Is there an issue with SBS and this feature?

Regards,
Mitchel
Not applicable
When will updates first appear in Windows Update?

Will there be a location to download the updates without using Automatic updates? If so, what?

http://support.microsoft.com/?kbid=907747 doesn't have any links for downloading the updates...




Not applicable
Wonderful article Alexander. Thank you for posting it, everyone should get going on IMF v2 deployments.



There is actually a very good podcast going on at Inside SBS (http://blogs.technet.com/sbs) I was just talking on it and asked them to discuss IMF and SenderID Specifically. We also talked about Exchange 2003 SP2 on my podcast at SBSShow.com: http://www.vladville.com/sbsshow/sbsshow-episode1.mp3



If any of you reading this blog are new to Exchange administration or are just getting started on deploying SP2 check out the articles on http://www.vladville.com/articles.asp as they will help you get it done right.
Not applicable
Mitchel, please let me know if you still do not see the first IMF Update on the Microsoft Update website, the package should be availalbe now.
Not applicable
Colin, IMF Updates will be availalbe through the Microsoft Update service, it is now one-stop updating for all Microsoft products. Actually, preferred method of installation is manual. After all, AU is not 100% true auto-update as with this option you will get a bunch of other updaets that you might not even care about. If you opted-in for AU, you still need to select what updates you want to install (unless you want it all -:).
Manual mode - you need to go to the MU website, and select 'Custom' button as described in my blog. The link to the website is also in the blog, please give it a try! The detection logic will offer an IMF Updates package to you and all you need to do is install it! Let me know if you have more questions.
Not applicable
Thanks Vlad, on January 17th I will have a webcast and discuss the entire Exchange Server anti-spam framework and then Konstantin Ryvkin from MSIT will shed more light on how Microsoft IT department implements these features. The link to it is:

http://msevents.microsoft.com/CUI/WebCastEventDetails.aspx?EventID=1032287164&EventCategory=2&culture=en-US&CountryCode=US


I will cover Sender ID and IMF in details, as well as a couple of new anti-spam features that will be available for E2K3 sp2 soon.

Not applicable
The update does not show up on my SBS 2003 box either.
Not applicable
Just tried it and still no update on the update site.
Not applicable
Just tried it and no updates still.
Not applicable
Tried this and can't see an update...
Not applicable
I would like to mention a concern of ours with the IMF update being handled by auto-update.

Prior to deploying software patches and fixes into production, we must test them. As a result, we do not use auto-update for deploying updates to our production environment. If IMF updates are only available via AU, it would require a lot of additional work to deploy updates manually twice per month.

May we suggest making IMF updates available separately from other software updates, much like an anti-virus update is deployed that require minimal manual intervention?
Not applicable
Hi,

I also went to the microsoft update site, but it doesn't report the update is available. Further more, the update is delivered to WSUS. I approved it for installation, but WSUS reports that the update is not needed on our exchange server ????
Not applicable
The package should be available by 4:00pm PST today. My apologies for the delay.
The packages will be available via both AU and manual. If WSUS reports that update is not needed on the exchange server, please make sure yur Exchange server is 2003 SP2.
We are looking into making IMF Updates available separately from other updates for Exchange 12 server.
Not applicable
The update is live on MU guys. Please be aware that the installer will restart iisadmin, so for a couple of minutes corresponding services (e.g. smtpsvc) will not be available.
Not applicable
Yes, it is live now!

Thanks :)
Not applicable
I wonder how WSUS works with this. I would expect without any additional work...

Also, I've followed Vlad's instructions on enabling IMF, and my Registry Key Value shows '2' instead of 1. I wonder what the difference is...
Not applicable
Great! Regular updates will take IMF to the next level in my opinion.

The registry key requirement will certainly cause some to miss the updates unfortunately.

But nevertheless it is a good step forward.
Not applicable
IMF Updates is the key to maitaining your server's ability to separate ham from spam so stay tuned!
Not applicable
Did all of the above (registry, restart, etc), the update discussed above is not visible on Windows Updates or my WSUS server. Is it still there or am I missing something ?
Not applicable
Hi,

AU reported this morning that it wanted to install the IMF update. It was delivered trhough WSUS, strange that WSUS reported earlier that it wasn't needed though. But hey, it works now.

Franc.
Not applicable
Franc,

Forgive me for the stupid question, but did you check Exchange 2003 as one of the updates to check under for your WSUS subscription?

-Vlad
Not applicable
I also did the registry addition, restarted and I still am not seeing the update in Windows Update. Help!
Not applicable
Vlad,

yes I did. Otherwise the update doesn't show up in WSUS at all. It just reported the updated wasn't needed by exchange 2003, but weird thing, next day it wants to install it on the server.
Not applicable
Chris, IMF updates work on E2K3 sp2 only. What is your config?
Not applicable
Alex I am running E2K3 sp2 on a 2003 server. The IMF application is running and blocking spam but I am not able to see any updates.
Not applicable
Am I reading the KB right in that SP3 will require the IMF updates to be manually removed before it can be safely applied?

If so that sounds a little unecessary. I.E. Shouldn't a goal of SP3 be to deal with admins who put this in place and forgot about it?
Just remembering customers I support as a consultant who had another consultant enable IMF under SP1 which was supposed to be ripped out before SP2. Customers don't always know who did what in their enviornment, so it is better IMHO if the service pack can account for that.
Not applicable
To answer Dan Sheehan:
Dan, you do not have to remove anything, the case in KB applies to a situation when you apply service pack in a few months after its release. For example, the SP3 has been released in January, and you did not upgraded to it immediately. You, however, continue to apply IMF Updates on regular basis. By August you decide to upgrade to SP3. Now what happens is that the IMF files (both .dll and .dat) are much fresher (because you were installing updates regularly) than the IMF fiels that were released in January with SP3. During upgrade these newer files will be replaced by the older (back from january) IMF fiels that come with SP3, so you need after upgrade to go to Microsoft Updates and install the latest version of IMF files. You do not have to uninstall IMF in order to upgrade to SP3.
Not applicable
To answer Chris:
Chris, please double check the ContentFilterState registry location (should be under Exchange). When you go to the MU site, can you see other updates?
Not applicable
Alex I double-checked and the ContentFilterState registry is in the correct location. When I go to Windows Update and click on Custom I have no High Priority updates listed and I have 2 Software, Optional updates listed which are Microsoft .NET Framework 2.0: x86 (KB829019) and Microsoft Base Smart Card Cryptographic Service Provider Package: x86 (KB909520). Thats the only updates available to me. Thanks for your help!
Not applicable
Alex I found the problem. I was going to Windows Update instead of Microsoft Update. The update is there and I am downloading it now! Thanks!
Not applicable
Chris, this is good news! New update will help with catching more spam!
Not applicable
Guys, on January 17th I will have a webcast covering anti-spam technologies in Exchange and how Microsoft IT department implements them. If interested, please sign up here:


http://www.microsoft.com/events/EventDetails.aspx?CMTYSvcSource=MSCOMMedia&Params=%7eCMTYDataSvcPara...


Not applicable
Alex I have a quick question for you. I have the IMF set to move e-mail with a SCL rating of 5 to the User's Junk e-mail folder. But, I had an e-mail come into my Inbox this morning that had a SCL rating of 5. Is there anything on my end that I need to do or was it a glitch? Thanks!
Not applicable
Alex, i wonder if i should copy my MSExchange.UceContentFilter.xml to the newly created subdir in MSCFV2 every time a new IMF update have been installed on my Exchange server? The update process described in KB907747 dont give me an answer to this question. Thanks in advance!
Not applicable
To answer Maxim's question:
Yes, you need to copy the Custom Weight List file to the newly created directory every time when the new update is installed. You also need to reset iis if the file is not working after the move. I will make changes to the KB to address this scenario.
To answer Chris's question:
There is nothing wrong on your end, it was a typo in documentation and we are fixing it. The intended behavior is that mail items with SCL only above 5 will be moved to Junk, so this is the reason you see mail with SCL5 in your inbox.
Not applicable
Regarding the Custom Weigh List. Besides moving the xml file to the newly created directory, do you also have to register the new MSExchange.UceContentFilter.Dll file?

Thanks,
Jeff
Not applicable
I have configured the IMF to update successfully on my SBS Server, I had previously been successfully archiveing messages that were given and SCL of 6.

What I no longer have in my configuration is the ability to enable or disable the IMF on a Virtual SMTP Server under the protocolsSMTP, has something gone wrong with the updates/install?

I have also tried to manually configure the Archive location in the registry without success either.

Any ideas?

Thanks
Kerry
Not applicable
IMF updates are said here to be released _every_ first and third Wednesday, but I can't get my machines to detect one for this past week, did the update get released?
Not applicable
I followed all the advice from Alex and was able to get the update. IMF (with update) is now working fine. Stupidly I had updated to IMF Ver 2 via the exchange service pack and then not enabled it! (http://www.msexchange.org/tutorials/Intelligent-Message-Filter-version-2-IMF-v2.html).
My problem is that I have been unable to register the UceContentFilter.dll. I get a "module not found" error.
I have checked and rechecked the path (which is on a "D" drive not under "program files" and I've even tried upper/lower case. No joy. Any suggestions? I really want to try the "Custom Weighting Feature" (CWF)?

Not applicable
Jeff, you do not need to register the binary. IMF Updates installer will do it automatically for you during update. If the CWL file does not work after the move you might need to restart smtpsvc.
Not applicable
Kevin, due to holidays schedule we did not release IMF Update past week. However, it is scheduled to be released next Tuesday (Jan 10th). Stay tuned!
Not applicable
Kerry,
IMF Updates do not alter the IMF core functionality. Are you saying that before installing the first IMF Update package you were able to enable/disable IMF under the SMTP VSI and now you can no longer do it? To ease the administration, in SP2 all anti-spam filters located under one single dialog page. Have you looked there? Also, E2K3 SP2 does not create ContentFilter regkey during upgrade, so you need to create it manually.
Not applicable
David,

This is a link to get you going on MSExchange.UCEContentFilter.xml (Custom Weighting):
http://download.microsoft.com/download/f/b/5/fb5c54af-fe5c-48e9-be97-f9e8207325ab/Ex_2003_SP2_RelNot...
Are trying to register MSExchange.UCEContentFilter.dll or UCEContentFilter.dll? Try to find the binary and regsvr32 it from there.
My I ask you - why you need to register the binary? It should already be registered either by SP2 upgrade or IMF Updates installer. There is really no need to re-register it. After you create the CWL file, make sure to restart smpsvc to load it into the IMF.
Not applicable
Guys,

I really encourage you to sign up for the January 17th webcast. I will not only talk about latest advances in anti-spam technologies available from Microsoft, you will see how Microsoft IT department implements these technologies. As always, the webcast will

conclude with Q&A session so you get a chance to get into details what these technologies are and how MSIT does it. This is the registration link:



http://www.microsoft.com/events/EventDetails.aspx?CMTYSvcSource=MSCOMMedia&Params=%7eCMTYDataSvcPara...




Not applicable
Today I applied the second available update using WSUS. That AU went OK (I can check the registry for the active version), but now the AU notifies me about another IMF update to install: the old one!

My control panel shows only the december update?!?

Should I decline (or even uninstall) previous updates? The WSUS details don't say this january update supersedes others so both are still available for install.

(Also, please let me know if I should report this to PSS)
Not applicable
I installed the first IMF update 2005.12.15 successfully via microsoft update. Today I tried to install the second update 2006.01.05.
The update failed with error code 0x80246002. This is the first time I have had this error with microsoft update. What does this error mean and what can I do to install the update?
Not applicable
We applied Exchange 2003 SP2 last year without incident, and we enabled and
configured IMFv2 to pull updates down from Microsoft Update with no
problems.
The December 15, 2005 IMF Update (6.5.7757.0) was identified and installed
correctly last year.
Last night as part of the regular monthly updates, a new update to IMF was
identified, January 5, 2006 IMF Update (6.5.7765.0), we applied it along
with the other Critical Updates and rebooted the server.

When the server came back up shortly after, Automatic Updates identified the
old December Update to IMF as needing to be installed even though it had
already been installed a month ago. (The "updates needed" notification is
from the yellow shield icon in the system tray.)
We went ahead and re-installed it, and once it was applied, Automatic
Updates then identified the January Update to IMF again, and we applied it
again.
Once again, Automatic Updates claimed that the December Update to IMF was
needed - we stopped there and are for now ignoring the notification message.
Automatic Updates notification appears to be caught in a loop trying to
apply IMFv2 updates.

Is anyone else seeing this behavior? How can this be fixed so that it
doesn't incorrectly identify IMF updates that have already been applied (yet
will continue to look for _real_ new updates)?
Not applicable
I am experiencing the exact same issue you are Jon with a brand new install of Windows 2003 SP1 and Exchange 2003 SP2. In my case I am using Microsoft Updates. It first had me install the Dec 15th IMF Update, and then Jan 5th IMF Update. Then it wanted the Dec 15th IMF Update again. I have gone through installing both of these IMF Updates a few times and it doesn’t seem to stop.
Not applicable
Guys,

Regarding the old update (December's update) - you do not need it. The reason it appeared on MU is that it was not expired in timely manner and you got it. You do not need to have an old update re-installed and it's gone from MU. Next time we release an update will be 1/18/06, we are back to normal release schedule - 1st and 3rd Wednesday of the month.
Not applicable
Phil,

This error indicates that the downloaded content’s hash did not match what was expected. If you are flexible with your environment, try to reinstall again. Let us know if you still can not do it. I will look into this from the development side. My apologies for this.