Archiving the SCL Rating in Intelligent Message Filter

Posted on January 7, 2009 by Daniel Petri in Exchange Server with 0 Comments

How can I archive the Intelligent Message Filter (IMF) Spam Confidence Level (SCL) rating of messages in Exchange 2003?

Sponsored

Microsoft Exchange Intelligent Message Filter is a product developed by Microsoft to help companies reduce the amount of unsolicited commercial e-mail (UCE), or spam, received by users. You can read more about IMF on theĀ Block Spam with Exchange 2003 Intelligent Message Filter page.

When using IMF to help reduce the volume of Unsolicited Commercial E-Mail (UCE, or most commonly known as Spam) received by your users, one of the configuration options is to archive the received messages that are flagged as spam and have a Spam Confidence Level (or SCL). SCL is a “rating system” that on a scale from -1 (only used for authenticated users) to 10, will tell Outlook or OWA whether or not the e-mail should be moved to the Junk E-mail folder (depending on the user’s settings). Note that not all messages might be transferred to the store (i.e. the user’s mailbox) depending on the settings on the IMF tab. Read more about how to Configure Intelligent Message Filter in Exchange 2003 SP2.

Viewing this SCL rating might be beneficial in some cases, especially when evaluating the effectiveness of IMF right before beginning to actually delete messages instead of just rating them or archiving them (read View Intelligent Message Filter Archive).

Note: When performing the archive operation on the messages that have an SCL that is greater than the threshold you’ve configured (make sure you also read Bug in Intelligent Message Filter Interface), these messages will be placed inside a folder on your server’s hard disk. You can always Move Intelligent Message Filter Archive Folder.

However, when looking at the archived messages, one quickly sees that the SCL rating is not included in the message’s header. This is by design.

In order to configure IMF to also add the SCL rating to the archived message, follow these steps:

  1. Open Registry Editor.

Note: As always, before making changes to your registry you should always make sure you have a valid backup. In cases where you’re supposed to delete or modify keys or values from the registry it is possible to first export that key or value(s) to a .REG file before performing the changes.

  1. In Registry Editor, navigate to the following registry key:

Note: You might not find this key in place. If that is the case, create a new key under the Exchange key and call it ContentFilter.

  1. Within the ContentFilter key, create the following value (REG_DWORD):

ArchiveSCL

and give it a value of 1 (Decimal).

  1. Close Registry Editor, and restart the Simple Mail Transfer Protocol (SMTP) service.

If you’ve used any of the tools listed on the View Intelligent Message Filter Archive article, you will be able to view the message’s SCL rating:

Related articles

You might also want to read the following related articles:

Links

IMF Archive Manager: Releases

Sponsored