Demystifying Exchange Server 2003 SP2 IMF Updates

[The_Exchange_Team]

Hi All,

I thought I would introduce myself to the BLOG-O-Sphere, my name is Scott Roberts and I'm a Software Developer in Test for the Exchange Sustained Engineering team. One of my responsibilities on the Exchange team includes being part of a team that pushes out the update for Intelligent Message Filtering (IMF) via Microsoft Update (MU). This BLOG will cover a few of the areas that we seem to find customers having problems with when trying to get the latest IMF update via MU.

By now, I hope all of you know that new Intelligent Message Filter (IMF) is out in the wild with the release Exchange Server 2003 Service Pack 2 and have moved off of the older version. What you might not be aware of is that Exchange pushes an update twice a month to the Microsoft Update infrastructure to deliver the latest IMF files to your server and this is explained in

http://support.microsoft.com/?kbid=907747. The below will give additional information and troubleshooting steps to make using the IMF update functionality easier and troubleshooting issues less costly. Additionally, you should check our previous post on this subject too.

Microsoft Update/Windows Update

An IMF Update is the same as any other Exchange Update and therefore will use the 'Microsoft Update' pipe instead of the 'Windows Update' pipe to deliver the update to the customer. Every computer by default uses 'Windows Update' when first installed and can be reached by START > PROGRAM FILES and selecting the 'Windows Update' shortcut.

 

For additional information, I would recommend reading the FAQ on Microsoft Update.

 

What Is Microsoft Update? It's the new website from Microsoft that helps you update Microsoft Windows and many other Microsoft programs that you've installed, such as Microsoft Office, Microsoft Exchange Server and Microsoft SQL Server, all in one convenient place.

Does it work with Automatic Updates? Yes. If you turn on Automatic Updates using your settings in Control Panel, Windows will automatically find and install high-priority updates for any Microsoft products that you have installed and that are supported by the website.

If I use Microsoft Update, do I still need to visit the Windows Update website? No. Microsoft Update provides the same updates you find on the Windows Update website and more. Microsoft Update is designed to make it easier for you to update Windows and your Microsoft products in one place.

In order to use Microsoft Update (MU), the computer must 'opt-in' via a website and from that point on the machine will use MU for detecting if it needs updates instead of Windows Update (WU). KB901037 explains 'How to enable and to disable Microsoft Update'. It isn't that difficult to do and only takes a minute.

Detection Logic

 

First off, I think it will be important to explain how detection does happen. There are several checks that happen before the update will be downloaded to the machine and installed. The Automatic Update (AU) Service (Description of the Automatic Updates feature in Windows) is responsible for the scan on the local machine and based on its configuration (How to schedule automatic updates in...) will decide how to handle the update. Remember that there is an ActiveX control that needs to be installed and that there is also a possibility that the machine needs an update for 'Windows Update'.

 

The detection that happens during the AU scan that does happen is as follows:

1. Is one of the Exchange Product installed on the machine?
2. Is Exchange Server 2003 installed on the machine?
3. Is Exchange Server 2003 Service Pack 2 installed on the machine?
4. Is the IMF 'ContentFilterState' registry a DWORD and a value of 1?
5. Is this particular IMF Update already installed onto the machine?

At this point, the 'AU' then does what is configured to do on the local machine:

1. The update is automatically installed (AU Scheduled)  and uses the 'localsystem' account for the installation of the update
2. The update is downloaded and the local user is prompted to install. The update is installed using the credentials of the local user.
3. The update is not download but the local user is prompted to download and install. The update is installed using the credentials of the local user.
4. If the scan is initiated by going to http://update.microsoft.com/microsoftupdate/v6/ then it is up for the user to decide. The update is installed using the credentials of the local user.

Enabling IMF Filter Updates

 

To enable Intelligent Message Filter updates, you must create the ContentFilterState registry entry. http://support.microsoft.com/?kbid=907747 explains this some detail. To do this, follow these steps:

1.	Ensure that Exchange Server 2003 Service Pack 2 is installed on the machine
2.	Click Start, click Run, type regedit, and then click OK.
3.	Expand the following registry subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Exchange
4.	In the left pane, click Exchange. Then, right-click in the right pane, point to New, and then click DWORD Value.
5.	Type ContentFilterState, and then press ENTER to name the new registry entry.
6.	Right-click ContentFilterState, and then click Modify.
7.	In the Data value box, type 1, and then click OK.
8.	Quit Registry Editor.
9.	In the Services snap-in, restart the Simple Mail Transfer Protocol (SMTP) service.

Customer Headaches

A few requests from customers have been in the area of creating a tool that does the scan at a schedule time and not install every other update that is also being offered. If the local machine is configured to auto-install updates at a specific time then all updates being offered that are of 'high-priority' will also be installed based on the 'AU settings' regardless if the IMF is offered or not. I created a small vbscript tool to show how someone can use the 'WU API' to write a custom tool so that the customer has some flexibility on how to install the IMF Update. The script will detect or download just the IMF Update based on the parameter passed in at run time. If there is no IMF update detected as needing to be installed then the script exits until the next time it is run.

 

The script follows; please save it into a file called blogIMFV1.vbs, for example. Also please note that seeing that the blog post contains some Unicode characters, in order to view them properly, please set your browser Encoding to "Unicode (UTF-8)" (in IE, go to View > Encoding and then refresh the page after chaning the encoding to Unicode):

Option Explicit
'//---------------------------------------------------------------------
'//This is a sample script, not officially supported by Microsoft.
'//---------------------------------------------------------------------

'Simple VBScript to show usage
'Forgetting to use cscript.exe could lead to annoying pop-ups when wscript.echo is called.
'Will run on any machine but only will do *stuff* on an Exchange server configured according to http://support.microsoft.com/?kbid=907747

On Error Resume Next

Dim  error, i
Dim  objUpdateSession, objUpdateSearcher, objSearchResult
Dim  objupdateInfo, BundleUpdate
Dim  objUpdatesToDownload, objUpdatesToInstall
Dim  UpdateAction, bInstall, bDetect
Dim  IUpdate  
Dim  downloader, installer
Dim  installationResult

 bInstall = false

 if WScript.Arguments.Count = 1 Then

  UpdateAction = lcase(WScript.Arguments.Item(0))
  
  Select Case (UpdateAction)

       Case ("install")
       bInstall = vbTrue
   Case ("detect")
       bInstall = vbFalse
   Case Else
       Usage
  
  End Select
 
 else
  Usage
 end if

 Set objUpdateSession = CreateObject("Microsoft.Update.Session")
 
 if (err.number <> 0) then
  msgEcho ("Microsoft.Update.Session is not present - have you connected to MicrosoftUpdates before?")
  msgEcho ("Microsoft.Update.Session is not present - have you connected to http://update.microsoft.com/MicrosoftUpdate before?")
 end if

 Set objUpdatesToDownload = CreateObject("Microsoft.Update.UpdateColl")
 Set objUpdatesToInstall  = CreateObject("Microsoft.Update.UpdateColl") 

 msgEcho ( "Setting UpdateSession to Microsoft Update")
 Set objUpdateSearcher = objUpdateSession.CreateupdateSearcher()
 
 objUpdateSession.CreateupdateSearcher()
 

 'By default, the scan will use what AU is configured to use. It could be WSUS or MU/WU.
 'If you want to force the scan to use Microsoft Update and not what AU is configured to use simply uncomment the below lines
 
 'objUpdateSearcher.ServiceID ="7971f918-a847-4430-9279-4a52d1efe18d"
 'objUpdateSearcher.ServerSelection = 3
 'objUpdateSearcher.Online = true

 msgEcho ("Setting SearchResult and performing search")
 Set objSearchResult = objUpdateSearcher.Search("CategoryIDs contains '3cf32f7c-d8ee-43f8-a0da-8b88a6f8af1a'") 'Exchange 2003 GUID
 
 
 if (err.number <> 0) then
  msgEcho ("Have you set the ContentFilterState DWORD registry value?")
  msgEcho ("you connected to http://update.microsoft.com/MicrosoftUpdate?")
 end if

 msgEcho ("Search completed")
 msgEcho ("Total Updates Returned:" & objSearchResult.Updates.Count)

 '//
 '// List current updates and status
 '//

 msgEcho ( "All Exchange Updates Status:")
 msgEcho ("")
 
 msgEcho ( VBTAB & "Is Installed: ")
 For i = 0 to objSearchResult.Updates.Count-1
 
  if (objSearchResult.Updates.Item(i).isInstalled = true) then
   msgEcho ( VBTAB & VBTAB & objSearchResult.Updates.Item(i).title)
  end if

 Next

 msgEcho ( VBTAB & "Not Installed: ")
 For i = 0 to objSearchResult.Updates.Count-1
 
  if (objSearchResult.Updates.Item(i).isInstalled = false)  then
   msgEcho ( VBTAB & VBTAB & objSearchResult.Updates.Item(i).title)
  end if

 Next
 
 '//
 '// List only the IMF updates
 '//

 msgEcho ("")
 msgEcho ("IMF Update Status:")
 msgEcho ("")
 msgEcho ( VBTAB & "Is Installed: ")
 For i = 0 to objSearchResult.Updates.Count-1
 
  if ( IsTitleOfUpdateIMFUpdate(objSearchResult.Updates.Item(i).title) ) then

   if (objSearchResult.Updates.Item(i).isInstalled = true) then
    msgEcho ( VBTAB & VBTAB & objSearchResult.Updates.Item(i).title)
   end if
  end if
 Next

 msgEcho ( VBTAB & "Not Installed: ")
 For i = 0 to objSearchResult.Updates.Count-1
 
  'This will only work for English
  if ( IsTitleOfUpdateIMFUpdate(objSearchResult.Updates.Item(i).title) ) then

   if (objSearchResult.Updates.Item(i).isInstalled = false) then
    msgEcho ( VBTAB & VBTAB & objSearchResult.Updates.Item(i).title)
   
    if (bInstall) then
     msgEcho ( VBTAB & VBTAB & VBTAB & "Adding to the Download Queue")
     objUpdatesToDownload.Add(objSearchResult.Updates.Item(i))
    end if
    
   end if
  end if
 Next

 if Not (bInstall) then
  msgEcho ("Exiting - detection only")
  wscript.quit (0)
 end if

 if (objUpdatesToDownload.Count = 0) then
  msgEcho ("No 'Updates for Intelligent Message Filter' to download")
  wscript.quit (0)
 end if
   
 msgEcho ("Downloading updates...")
 Set downloader = objUpdateSession.CreateUpdateDownloader()
 downloader.Updates = objUpdatesToDownload
 downloader.Download()

 msgEcho ("Adding downloaded updates to the install list")
 For i = 0 to objUpdatesToDownload.Count-1
 
  if (objUpdatesToDownload.Item(i).IsDownloaded = true) then
   objUpdatesToInstall.Add(objUpdatesToDownload.Item(i)) 
     end if
 
 Next
 
 if objUpdatesToInstall.Count = 0 then
  msgEcho ("No 'Updates for Intelligent Message Filter' to install - an error at this point")
  wscript.quit (-1)
 end if
   
 
 Set installer = objUpdateSession.CreateUpdateInstaller()

 msgEcho ("Installing Updates...")

 installer.Updates = objUpdatesToInstall
 
 Set installationResult = installer.Install()
 
 if (installationResult.ResultCode <> 2) then
  msgEcho ("Installation Result: Bad Error (" & installationResult.ResultCode & ")")
 else
  msgEcho ("Installation Result: Succeeded")
 end if

 msgEcho ("Reboot Required: " & installationResult.RebootRequired)
 

 msgEcho ("Exiting with Error 0x" & Hex(Err.Number) & " (" & Err.Description & ")")
 WScript.Quit(Err.Number)

Function IsTitleOfUpdateIMFUpdate(StrTitle)

 IsTitleOfUpdateIMFUpdate = vbFalse

 if ( StrComp (objSearchResult.Updates.Item(i).title, "Update for Intelligent Message Filter for Exchange Server 2003:") > 0 ) OR _
   ( StrComp (objSearchResult.Updates.Item(i).title, "Exchange Server 2003 Intelligent Message Filter ? ???:") > 0 ) OR  _
   ( StrComp (objSearchResult.Updates.Item(i).title, "Mise à jour pour Intelligent Message Filter pour Exchange Server 2003:") > 0 ) OR  _
   ( StrComp (objSearchResult.Updates.Item(i).title, "Update für Intelligent Message Filter für Exchange Server 2003:") > 0 ) OR  _
   ( StrComp (objSearchResult.Updates.Item(i).title, "Exchange Server 2003 Intelligent Message Filter ? ???????(KB907747):") > 0 ) OR  _
   ( StrComp (objSearchResult.Updates.Item(i).title, "Actualización para Intelligent Message Filter para Exchange Server 2003:") > 0 ) OR  _
   ( StrComp (objSearchResult.Updates.Item(i).title, "Aggiornamento per Intelligent Message Filter per Exchange Server 2003:") > 0 ) OR  _
   ( StrComp (objSearchResult.Updates.Item(i).title, "?? for Exchange Server 2003 Intelligent Message Filter:") > 0 ) OR  _
   ( StrComp (objSearchResult.Updates.Item(i).title, "Exchange Server 2003 Intelligent Message Filter ? ??:") > 0 ) then IsTitleOfUpdateIMFUpdate = vbTrue

End Function

Sub msgEcho (strEcho)

 WScript.Echo(NOW() & vbTab & strEcho)

End Sub 

Sub Usage()
 Wscript.Echo "Invalid Arguements"
 Wscript.Echo vbTab & "Usage: imfUpdateScript.vbs ActionType"
 Wscript.Echo vbTab & "ActionType - 'Detect' or 'Install'"
 Wscript.Quit(-1)
End Sub

- Scott Roberts

[#2]

This is great.

From the support requests we get for IMF Tune it is clear that many are finding it hard to get these updates.

We will certainly direct some support requests to this post :)

[#3]

I use Windows Server Update Services to keep my systems updated. I'd like to be able to automatically approve IMF updates. At present, I can't do that because they're classified as Update Rollups, a category which includes the Windows 2000 Service Pack 4 Update Rollup 1, which I do not want automatically approved.

I believe that IMF updates would be better classified as Definition Updates, as updates to Windows Defender are.

[#4]

Thanks for the feedback!

For an update to be classified as a defination update, the update must not restart services. To get the updated file loaded into IMF, the inetinfo services must be restarted. This is why we could not classify it as a 'definition update'.

I will be creating a post on the WSUS blog next week on how to create a script that will show how to do the automatic approval at the WSUS server.

[#5]

Is there any way to get a standalone install of the update?  I have a server at a location that cannot access MU, and WSUS isn't an option in this case either.  I know I can take the updated DLL from a system that has been updated and manually register it on the other server, but I would prefer an executable that processes everything the way MU does.

[#6]

Excellent Script to detect or download just the IMF Updates by Scott Roberts.

[#7]

I know, I know, I'm late again... But this time I have an excuse, the Easter holidays ;)&amp;nbsp;

Synchronizing...

[#8]

We run Ex sp2 on Server 2003. We have had repeated problems with IMF and/or Sender ID causing the smtp service to crash. Details are on SRX060309603045

[#9]

Hi,

It would be great if you didn't have to copy over the IMF Custom Weight file (MSExchange.UceContentFilter.xml, if you are using it) to the folder after *every* update. Is there a reason why this file couldn't just be stored in the root directory and used by all instances of the IMF filter?

[#10]

Security
&amp;nbsp;





News
&amp;nbsp;
Are Smart Cards the New Way of Life? - Solving the...

[#11]

Security
&amp;nbsp;





News
&amp;nbsp;
Are Smart Cards the New Way of Life? - Solving the...

[#12]

The lack of copying over the custom weight XML is a known limitation of the installer. There are obvious work arounds to this but all would be considered a hack and not addressing it at the source.

[#13]

The lack of copying over the custom weight XML is a known limitation of the installer. There are obvious work arounds to this but all would be considered a hack and not addressing it at the source.

[#14]

Hi,

Great script! But I think I'm missing something...? When I run "cscript blogIMFV1.vbs install" the script also installed the other Exchange Updates (KB911829 and KB916803) offered thru MU. The Exchange server went down because I needed to reboot. When I ran MU I saw this message: "You need to restart your computer to finish installing a program or updates. You cannot view or get other updates from the site until you restart. Read more about steps you can take to resolve this problem (error number 0x8DDD0007) yourself." After a reboot everything was fine. I thought this script was only used to install IMF updates and not other Exchange Updates??

[#15]

Let me get back to you on the script :). I think I know what happened and should be an easy fix.

[#16]

Great article.  It actually clarifies the necessity of creating the ContentFilterState registry entry.  Once I have created it, the IMF update (27 Apr) started coming in.

Why would anyone want to run IMF without updates is beyond me. Especially when there is an option turn IMF on or off.

Another gripe I have is why a custom weightage file is not included in the installation.  It is a no brainer to include it as an empty file.  Look at hosts file, Apache conf file etc are excellent examples.

[#17]

Hi Scott,

Did you already had some time to check the script?

[#18]

For the question on the issue with the script:
yes. a bug is in the script where I use strComp instead of inStr. I made the change and hope to have it up by tomorrow evening.

For the question regarding the standalone install:
this is not possible for now. http://blogs.technet.com/mu/archive/2006/05/08/427591.aspx will address the ability for this via Microsoft Update Catalog

For the question regarding automatic approval at the WSUS server:
I owe the WSUS team a sample script but it is a low priority so I do not know when it will get done but it should be possible via the WSUS API.

[#19]

Hoping this is still open...

Exchange 2003 SP2, never used IMF v1, enabled IMF V2, seems to work OK.  Added the necessary reg value ContentFilterState, set it to 1, restarted SMTP.  Went to Microsoft Update (not Windows Update) and chose Custom - no IMF updates shown, other updates but not for IMF.

As far as I can see nothing is misconfigured, IMF works, just no updates offered.  Any ideas?

Thanks ahead,

Mark

[#20]

same problem...

Exchange 2003 SP2, never used IMF v1, enabled IMF V2, seems to work OK.  Added the necessary reg value ContentFilterState, set it to 1, restarted SMTP.  Went to Microsoft Update (not Windows Update) and chose Custom - no IMF updates shown, other updates but not for IMF.

As far as I can see nothing is misconfigured, IMF works, just no updates offered.  Any ideas?

[#21]

New SBS 2003 install - brought up to date with all patches, Exchange sp2, configured IMF (never had IMFv1), receive no IMF updates from MS update.

Have done this 50+ times in past with no problems - maybe one of the recent W2k3 or Exchange 2k3 patches breaking this? ContentFilterState is set to 1 - HELP!

[#22]

Gee, same here--I have been using IMF to great effect ever since SP2, receiving updates whenever I am energetic enough to ask for them via MU, last one received in May, but I cannot get the updates via MU yesterday or today. Last one was 6.5.7817.0.

Thanks

[#23]

Peter, Scott, Bill - please check to see if it is working now. The pipeline + process to push the IMF update out had an issue that caused the update to not be released until the 7th. The previous IMF update was also expired on the 3rd resulting in no IMF update on MU for a couple of days.

[#24]

PingBack from

http://www.mcseboard.de/windows-forum-ms-backoffice-31/imf-updates-wsus-115799.html#post715786

[#25]

This script had been working fine for me, and I had it scheduled to run twice a month in task scheduler.  I hadn't checked it in awhile and now I noticed that it quit applying updates since 3/27/08.  When I run it manually, the last message I get is "No updates for Intelligent Message Filter to install - an error at this point".  It gives me the message that the update from 2008.07.10 is Not Installed.  I can't tell why it is not applying that update.

Any ideas?

[#26]

Figured it out.  It  wouldn't apply manually either, and I received the error "Setup could not verify the integrity of the file Update.inf".  I had to install 2 new certificates to my local certificate store.

[#27]

I run the IMF update today,
It took more than two hours and I
had to cancel it, the cancel took more
than one hour and finally I had to
reboot the server, it took 30 min
to reboot and I was really scared.
Have you had this problem?
This is my second attempt and same
issue both times.