We help IT Professionals succeed at work.

Mail going to junk mail when it is not configured

LFSPAdmin
LFSPAdmin used Ask the Experts™
on
I have a user that does not have his Junkmail folder option configured.....so no mail should be going to his Junk mail folder....but it is still going there?....I have checked the options in Tools...Options...Junk Mail....and also checked OWA and both are set to NOT filter....but stuff still keeps going into it.

Help!

Thanks,

LFSPAdmin
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®

Author

Commented:
so would you set this up at the Exchange console?.....to set a transport rule that stamps all messages with a SCL of -1

Never done that?

Thanks,
yes, just add the transport rule in Exchange Management Console
under action, select "set spam confidence level to value" and enter -1

Author

Commented:
well I set it....and cleared his "Junk folder".....will let it run over night and see what we have in the morning....

Thanks Raysonlee!
welcome

Author

Commented:
Well...5 messages in the Junk mail folder today....that did not work????

I have attached a Screen shot..is does this look right??


Hub-T.jpg
try restart the Transport Service by
Net Stop MSExchangeTransport
Net Start MSExchangeTransport
check the SCL of those 5 messages by procedures stated here http://technet.microsoft.com/en-us/library/bb124595.aspx
to make sure the rule applied, can u try prepend a string to the subject to identify them?

Author

Commented:
restarted the Transport...but could not find "SCL" in any of the headers????

below is an example of the header...with any info removed of course.



Received: from p02c12m024.mxlogic.net (208.65.145.245) by LFSPEXCH.lfsp.local
 (216.180.32.54) with Microsoft SMTP Server (TLS) id 8.2.255.0; Fri, 5 Aug
 2011 08:24:34 -0500
Received: from unknown [12.106.49.41] (EHLOm)      by
 p02c12m024.mxlogic.net(mxl_mta-6.10.0-2) over TLS secured channel      with ESMTP
 id f1feb3e4.0.319716.00-2286.423590.p02c12m024.mxlogic.net (envelope-from
 <>);      Fri, 05 Aug 2011 07:24:47 -0600 (MDT)
Received: from ([172.16.235.82])      by smtpdt. with ESMTP  id
 48N3WH1.76637951;      Fri, 05 Aug 2011 07:49:05 -0500
X-ZLAuthOn: <null>
Received: from  (EHLO DTE10-HUB1.MORKEE.COM
 GF-VONTU-SMTP-4 [172.16.235.181] (may be forged))      by 172.16.235.82 with ESMTP
 id BZPHZYZMUOEWXWKZ1O51SVVG12ZY00T1A      for <>; Fri, 5 Aug 2011 08:24:41 -0500
  (CDT)
Received: from MKDAG1-MBX2.morkee.com ([fe80::b9f2:a058:6ca2:deb4]) by
 DTE10-HUB1.MORKEE.COM ([fe80::8830:4de6:ed08:6632%10]) with mapi id
 14.01.0289.001; Fri, 5 Aug 2011 08:24:41 -0500
From:
To: "
Subject: New Contact Info...
Thread-Topic: New Contact Info...
Thread-Index: AcxTcweEYFKlCX53QOqOgNcS6oYkfQ==
Date: Fri, 5 Aug 2011 13:24:40 +0000
Message-ID: <B3F4041560A40347B3646EE9AB17AB610245C3@MKDAG1-MBX2.MORKEE.COM>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: []
MIME-Version: 1.0
X-CFilter-Loop: Reflected
Content-Type: multipart/alternative; boundary="=_reb-r07E96BDD-t4E3BEF1F"
X-Processed-By: Rebuild v2.0-0
X-Spam: [F=0.1428571429; B=0.500(0); spf=0.500; STSI=0.500(-16); STSM=0.400(-16); CM=0.500; MH=0.500(2011080508); S=0.200(2010122901); SC=none]
X-MAIL-FROM:
X-SOURCE-IP: [12.106.49.41]
X-AnalysisOut: [v=1.0 c=1 a=ip5ioaBJgQ0A:10 a=BHfQJthtv6QA:10 a=BLceEmwcHo]
X-AnalysisOut: [wA:10 a=xqWC_Br6kY4A:10 a=BqgCfznX7MUA:10 a=osx1VOCzZiLTWz]
X-AnalysisOut: [ut8f0fpw==:17 a=4sPn884lAAAA:8 a=t6Ldwdx2AAAA:8 a=TW008Oyu]
X-AnalysisOut: [fbwgTSefqU4A:9 a=RSH_pRqUSBf_zfYFj2gA:7 a=CjuIK1q_8ugA:10 ]
X-AnalysisOut: [a=jgrNIiUaAowA:10 a=U7BOtjLYL10A:10 a=-27RCJUQNL8A:10 a=eu]
X-AnalysisOut: [eA0NoA4LoA:10 a=7avBT4ExCZBZOlR3nwcA:9 a=n_7zQFB3waYsP8OFe]
X-AnalysisOut: [zUA:7]
Return-Path:
I see, it looks like the message was moved to the Junk folder by other Anti-Virus / Anti-SPAM program, not Exchange / Outlook.

Author

Commented:
huh....we use to have a program that would do that....but that server is not even on line anymore...and all of our Anti-spam is done thru MX logic....outside our firewall.

not sure where to go from here?

Just looked thru the settings again....I see nothing.



Author

Commented:
on the phone with McAfee Saas now.....
ok, u use MX Logic to filter SPAM before going into your Exchange server.
Now try remove the condition for this Transport rule, set all messages' SCL to 9 and add one more action to prepend a string in front of the subject of every messages, leave it overnight and see what happen.

Author

Commented:
ok...so I remove the Trans rule that I put in before to set it to  -1 ....then set all messages to a SCL of 9(This would be done in Exch console correct?).....the add a string to each message???not sure about that?(is this done in Exch console as well?....and what string?

Thanks for your help....I am getting nowhere fast with this myself.

Jeff

Author

Commented:
I tried to set mailbox to the following today...

set-mailbox -identity rjm -SCLJunkEnabled $false



but got Junk mail this afternoon.....booooo

what i'm trying to do is to force all messages go to junk (by setting SCL to 9) if Exchange's SPAM filter is activated and label all messages being processed by your rule with "prepend a string in front of the subject" (just select it in action of your rule).

Author

Commented:
is there a way to do this without it affecting 100 users...I am only having issues with one user?

in the rule's criteria, you can select message sent to that user only.
If the problem only occur for one user, it's not likely to be settings in Exchange server.
Would it be the PC installed some anti-spam software without your permission? do u use local profile / roaming profile? do u have a clean PC that can let him try on?

Author

Commented:
well...doing what we have done so far we have slowed it down....not sure how yet...

Just had his sec. call.....thought i would tell about this...she had one in Quarantine...moved it to the Inbox....and the system moved it back to Quarantine!!!!!......how do you find figure out what is moving these messages????



Author

Commented:
sorry for the delay

Author

Commented:
sorry...I should have said Junk mail.

Author

Commented:
the reg key was set to 1.....so as I read it...it was turned off.....the other option was to delete the reg key....so I did.....cleaned out the "Junk folder" (had almost 50 in it.).....and will see how it does over the weekend.

Thanks,

Jeff
Called Microsoft they gave us a tool to run on the mailbox…this would allow you to delete the “Junk mail” properties inside your Inbox…..the tool is called ‘MFCMapi.exe”

Logon and Display Store Table

Chose profile effected…..


Double click the maibox  in question….

Expand the “Root- mailbox”

Right click on the Inbox and choose “open Associated Contents Table”

Scroll down and look for “Junk mail Rule”…under the “Subject” column

When you find it…right click and  “delete Message”….then it will ask you if you would like to do Hard Delete….do hard deletion……close this tool…..create new profile under Mail in control panel…..load new profile and fix N2K file plus signature.


Author

Commented:
Had to call MS...but this FIXED the issue....