Panda Security for Exchange Servers How to configure Exchange 2003/2007 servers to create a local quarantine on each Endpoint January 2009 Copyright notice Panda Security 2009. All rights reserved. Neither the documents nor the programs that you may access may be copied, reproduced, translated or transferred to any electronic or readable media without prior written permission from Panda Security, c/ Gran Vía Diego López de Haro 4, 48001 Bilbao (Biscay) Spain. Trade Mark Panda Security. TruPrevent: Registered in U.S.A Patent and Trademark Office. Windows Vista and the Windows logo are trademarks or registered trademarks of Microsoft Corporation in the United States and other countries. All other product names may be registered trademarks of their respective owners. D. L. BI-1915-07 Panda Security 2009. All rights reserved. Panda 2009 Page 1
Contents INTRODUCTION...3 CONFIGURING PANDA SECURITY FOR EXCHANGE SERVERS...3 CONFIGURING EXCHANGE 2003/2007 SERVER TO ACT ON SCL FLAGS...5 OPTION 1: FLAG WITH SCL (EXCHANGE 2003)... 5 OPTION 2: FLAG WITH SCL (EXCHANGE 2007)... 8 Panda 2009 Page 2
Introduction The purpose of this document is to inform users how to configure Exchange 2003/2007 servers for flagged messages to be directly sent to users MS Outlook Junk Email folder. This system will depend on each company s structure and spam management method, the advantage being that end-clients manage their own spam folder and can therefore easily detect possible false positives and immediately report them to the administrator to be restored and for future identification. Additionally, administrator costs are reduced as users manage their own spam folders in local quarantines. Configuring Panda Security for Exchange Servers The anti-spam protection included in Panda Security for Exchange Servers allows administrators to carry out three different actions on the spam detected, from the AdminSecure console: Exchange 2000: - Let the message through. - Move the message to a specific location (these messages do not reach recipients, they are sent to a mailbox predefined by the administrator). - Delete message. Figure 1: AdminSecure protection settings screen in Exchange 2000 Panda 2009 Page 3
Exchange 2003/2007: - Let the message through. - Move the message to a specific location (these messages do not reach recipients, they are sent to a mailbox predefined by the administrator). - Delete message. - Flag with SCL: The server is configured for a specific action predefined by the administrator to be taken on the flagged messages received. By default, Exchange Server will send messages with SCL rating 8 or greater to users Junk Mail folder. Figure 2: AdminSecure protection settings screen in Exchange 2003 Panda 2009 Page 4
Figure 3: AdminSecure protection settings screen in Exchange 2007 Configuring Exchange 2003/2007 server to act on SCL flags Once Panda Security for Exchange Servers has been configured to apply a specific SCL flag to messages, the Exchange server must be configured to identify those messages and take specific actions on them. OPTION 1: FLAG WITH SCL (EXCHANGE 2003) In Exchange 2003 servers it is necessary to use IMF (Intelligent Message Filtering). In this case: Set the SCL rating for moving messages to the user s Junk Email folder. Panda 2009 Page 5
In the Message Delivery Properties, you can access IMF and select the SCL rating for which the move to Junk E- mail folder action will be applied. Panda 2009 Page 6
To activate IMF, go to Exchange System Manager, right-click Default SMTP Virtual Server and select Properties. To activate IMF in the Default SMTP Virtual Server Properties screen, click Advanced > Edit, and select the Apply Intelligent Message Filter checkbox: Panda 2009 Page 7
OPTION 2: FLAG WITH SCL (EXCHANGE 2007) You must then send the messages flagged by Exchange with that SCL* to the user s Junk E- mail folder To do this, follow the steps below: 1. Open the Exchange Management Shell (EMS). Panda 2009 Page 8
2. Bearing in mind that the filtering is done by a third-party (Panda Security for Exchange Servers), one of the following actions must be taken: > Disable the Exchange Content-Filter Agent: Disable-TransportAgent Content Filter Agent > Disable the actions Delete, Reject or Quarantine. Set-ContentFilterConfig SclDeleteEnabled $false SCLRejectEnabled $false SCLQuarantineEnabled $false Panda 2009 Page 9
This is done because Panda Security for Exchange Servers carries out the filtering and in order to move spam messages to users Junk E-mail folder. 3. From then on, all emails with SCL > SCLJunkThreshold will be sent to users Junk E-mail folder. 4. The SCLJunkThreshold can be modified for all the organization in the Exchange Management Shell (EMS), through the command: Set-OrganizationConfig -SCLJunkThreshold <SCL threshold value> (*SCL: Spam Confidence Level) Panda 2009 Page 10