How to Configure Exchange 2007 Anti-Spam Automatic Updates

After Enabling Auto updates, we need to make sure our Exchange 2007 Anti-Spam have those updates

To check:
From cmdlet run get-antispamupdates

This show you the currently installed update version.
UpdateMode : Automatic
LatestContentFilterVersion : 3.3.8414.660
SpamSignatureUpdatesEnabled : True
LatestSpamSignatureVersion : 3.3.8611.1336
IPReputationUpdatesEnabled : True
LatestIPReputationVersion : 3.3.8611.063
MicrosoftUpdate : Configured

You can then compare that to the latest version shown at:
http://catalog.update.microsoft.com/v7/site/Rss.aspx?q=exchange+server+2007+anti-spam&lang=en

If you find that its not updated or not properly configured you need to run:
Enable-AntispamUpdates -Identity SERVER01 -IPReputationUpdatesEnabled $True -MicrosoftUpdate RequestNotifyDownload -UpdateMode Automatic -SpamSignatureUpdatesEnabled $True

Then open Windows Update to check new updates

More info:
http://technet.microsoft.com/en-us/library/aa997658(EXCHG.80).aspx
http://technet.microsoft.com/en-us/library/bb125199(EXCHG.80).aspx

Handling Exchange IMF & SCL

To enable IMF auto-updates:

1. In Registry Editor, navigate to the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Exchange

2. Create the following value (DWORD):

ContentFilterState

and give it a value of 1.

To configure IMF to also add the SCL rating to the archived message:

1. In Registry Editor, navigate to the following registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Exchange\ContentFilter

Note: You might not find this key in place. If that is the case, create a new key under the Exchange key and call it ContentFilter

2. Within the ContentFilter key, create the following value (REG_DWORD):

ArchiveSCL

and give it a value of 1.

restart the Simple Mail Transfer Protocol (SMTP) service

Custom Weighting Feature for Exchange IMF

IMF version 2 includes a completely new feature called the Custom Weighting Feature (CWF), which allows you to customize IMF even further. With CWF you can filter e-mail messages based on specific phrases within the body of the messages, the subject line or both.

Below is an example of specific phrases and values you can use in the MSExchange.UceContentFilter.xml file.

<?xml version="1.0" encoding="UTF-16"?>
<CustomWeightEntries xmlns="http://schemas.microsoft.com/2005/CustomWeight">
<CustomWeightEntry Type="BODY" Change="5" Text="abcde"/>
<CustomWeightEntry Type="BODY" Change="-5" Text="fghij"/>
<CustomWeightEntry Type="BODY" Change=”6" Text="klmno"/>
<CustomWeightEntry Type="SUBJECT" Change="MIN" Text="pqrst"/>
<CustomWeightEntry Type="BOTH" Change="MAX" Text="uvwxy"/>
</CustomWeightEntries>

Notes:
1. MSExchange.UceContentFilter.xml, should always be in the working path of IMF in latest update subfolder (be sure to check them regularly againts IMF Update)
2. You migh to restart SMTP services to make sure no problem while loading them
3. MSExchange.UceContentFilter.xml file should saved in Unicode format
4. SCL Result : a. determine by + and - change, b. if MAX match then reset to 9, c. if MIN macth then reset to 0.
5. CWLs will not match an entry to a substring of a word, but will match a shorter phrase to part of a longer phrase