Well, I'm really at my wit's end here. SOMETHING has changed to cause the junk filtering in our environment to become extremely aggressive, but since I haven't changed any server configuration related to this since our E2k7 rollout in July of 2007, I am at a loss as to explain it. The only thing I know for sure is that I installed the latest MS security patches late last week, and starting on Tuesday people are getting massive amounts of e-mails to their junk folders. One person reported messages from Thursday and Friday sent there, but I did not see it, so I still can't pinpoint the trigger.
It was just a few tech folks at first, but now I've found out our helpdesk has been getting calls on and off all week about people missing messages. I already changed the SCLJunkThreshold to 8 and restarted the server. I've also run the install-AntispamAgents.ps1 that Michael suggested. After poking around some more, I found there is a new tab near my receive connectors under \Server Configuration\Hub Transport called "Anti-Spam". In there, I've added IP addresses of our internal (non-exchange) servers to the IP allow list, and after that those messages are no longer being filtered as spam. But, we still have tons of messages coming in from the outside that are getting thrown into junk folders. These are e-mail addresses that people have been getting things from for months, if not years, and it has never filtered to junk before. At this point, I really want to just shut off junk filtering at Exchange altogether-we have a spam gateway for this and it has worked well-it's what people are used to, and two layers is a lot for everyone to understand. Is there a way to do that? Still E2k7 SP1 RU9. -Bonnie From: Miller Bonnie L. [mailto:[email protected]] Sent: Wednesday, February 17, 2010 12:25 PM To: MS-Exchange Admin Issues Subject: RE: E-mails to junk folder Kewl... did not know about that one or it's been so long I forgot. http://www.expta.com/2008/08/how-to-configure-scl-in-exchange.html http://technet.microsoft.com/en-us/library/bb201691(EXCHG.80).aspx I've adjusted the SCL level and restarted the transport service for good measure. Will see if it gets any better-thanks a bunch! From: Michael B. Smith [mailto:[email protected]] Sent: Wednesday, February 17, 2010 11:43 AM To: MS-Exchange Admin Issues Subject: RE: E-mails to junk folder Set the organizationConfig for SCLJunkThreshold to 8. :) Those tabs only show up in the EMC if you've run install-AntispamAgents.ps1 in $exscripts which causes the relevant DLLs to get registered. Get-TransportAgent shows you what agents are actually installed and can be configured from the EMS. Regards, Michael B. Smith Consultant and Exchange MVP http://TheEssentialExchange.com From: Miller Bonnie L. [mailto:[email protected]] Sent: Wednesday, February 17, 2010 2:12 PM To: MS-Exchange Admin Issues Subject: RE: E-mails to junk folder Thanks Michael-so, do you know where exactly I might find that in EMC? I've looked all over the hub transport options (again, single server all roles SP1 RU9) and am just not finding it. No Exchange edge server-we have a barracuda spam firewall on the outside. For example, I see a screenshot here of the configuration, but I can't find this screen anywhere. http://exchangepedia.com/blog/2007/02/exchange-2007-content-filter-how-to_07.html If I run get-organizationconfig I can see the "SCLJunkThreshold" value is set to 4. Get-contentfilterconfig shows the DN of the object to be under Transport Settings, but I only have two tabs in the properties of Transport settings under \Organization Configuration\Hub Transport. I'm SUPPOSED to be logged on with an admin with all of the correct rights, but I'm starting to wonder if there is a permission out of whack somewhere. -Bonnie From: Michael B. Smith [mailto:[email protected]] Sent: Wednesday, February 17, 2010 10:57 AM To: MS-Exchange Admin Issues Subject: RE: E-mails to junk folder Isn't this controlled by "antispam agent settings" on the hub transport/edge? If you are in online mode, Outlook shouldn't process Junk Email itself - but it still can be processed server-side. Regards, Michael B. Smith Consultant and Exchange MVP http://TheEssentialExchange.com From: Miller Bonnie L. [mailto:[email protected]] Sent: Wednesday, February 17, 2010 1:47 PM To: MS-Exchange Admin Issues Subject: RE: E-mails to junk folder And if I'm reading correctly, Outlook 2007 should not be using the junk folders in online mode-is that correct? We've been non-cached mode for a long time, and I've verified that has not changed on many of the accounts where this is happening. http://technet.microsoft.com/en-us/library/cc178957.aspx (Supported Account types section) Does not supported actually mean it doesn't work, or you shouldn't do it? In other words, something could be turning on our junk filter settings (like a group policy) and it's suddenly trying to work, but really just isn't supported? If I look at my junk filter settings (it has happened to my account as well) it shows "low". Right before I get to the screen to view the settings (actions, junk e-mail, junk e-mail options), I get a warning about the filter not being available because I'm working online. From: Miller Bonnie L. [mailto:[email protected]] Sent: Wednesday, February 17, 2010 10:21 AM To: MS-Exchange Admin Issues Subject: E-mails to junk folder All of a sudden in the last day or two, many of our internally addressed messages are going to the Outlook 2007 (non-cached mode) junk folders for different mailboxes. For example, automated messages from [email protected]<mailto:[email protected]> end up in junk for some users. So far, all of the messages are ones that come from other servers in the domain that are not the actual Exchange server, but are added as servers that are authenticated or allowed to relay (by IP address) on one of two receive connectors. Back end is E2k7 SP1 RU9 all roles with latest security patches from last week. I don't know much about how the junk mechanisms work and am just starting to dig, but if anyone has seen this or knows right where to go looking I'd appreciate it. I've checked our external IP for blacklisting and am not finding it turn up anywhere that I can see. Thanks, Bonnie
