IMF - how do you know that the filters are up to date on SBS 2003 R2

Posted on 2007-08-05
Last Modified: 2010-03-06
Users are saying that they are getting loads of spam now (the look at the pictures links, besides others).

How do I check that the IMF filters are the latest / how do they update?  I think it was a registry change I did that was supposed to update them seperately from windows update?!
Question by:babaganoosh
    LVL 23

    Accepted Solution

    No, the registry change is so that it is available for updates from Windows update. You really should be running this or a product like it.

    Author Comment

    is there a way to see what version of the filters have been downloaded / what version is in use vs. what the most current one is?
    LVL 58

    Assisted Solution

    Have you got Exchange service pack 2 installed? That has the updated IMF filter with it.
    Run Windows Update on the server and it will have any IMF updates listed there, if none appear, you're all up to date.

    Also check your settings, because it could simply be that the spam is different to before and not being caught by IMF so you need to lower the Spam Confidence Levels. I normally use level 6 or 7 for the gateway and level 4 or 5 for the mailbox store. It has a default of 9 I think though which is way too high and won't filter out that much.
    LVL 11

    Assisted Solution

    Agreed that using WSUS or Windows Update is the best way to keep your server patched.

    If you wanted to see the IMF patches that have been installed, you can browse to \Program Files\Exchsrvr\bin\MSCFV2\ on the server and look at the subfolders.  A new one is created with each installed IMF release, so the newest folder is the current one in use.  My newest one is 6.5.7942.0.  The date/time stamp on the folder is when you installed the update, so go into the folder and look at the date/time stamp of the DLL file.  For me, it is 7/26/07, which corresponds to the last issued update ("Update for Intelligent Message Filter for Exchange Server 2003: 2007.07.26 (KB907747)".)  
    LVL 74

    Assisted Solution

    by:Jeffrey Kane - TechSoEasy

    If I recall correctly you are using the POP3 Connector to retrieve your email, right?  If so, then you can't use IMF.

    This is yet another reason for you to change over to full SMTP email.

    LVL 11

    Assisted Solution

    Oh, you can also check the System Event Log on the Exchange box - filter for Event 4377. Maybe that is the quickest/easiest way to do so.

    Featured Post

    Free Trending Threat Insights Every Day

    Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

    Join & Write a Comment

    Use email signature images to promote corporate certifications and industry awards.
    Local Continuous Replication is a cost effective and quick way of backing up Exchange server data. The following article describes the steps required to configure Local Continuous Replication. Also, the article tells you how to restore from a backup…
    In this video we show how to create an Address List in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Organization >> Ad…
    This video discusses moving either the default database or any database to a new volume.

    754 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    19 Experts available now in Live!

    Get 1:1 Help Now