Re: Forefront?

[Matt Moore]

We've been using it for about 2 months now.  The jury is out.  Mom bugs the 
crap out of me on a daily basis because pc's go to sleep and it takes too long 
for them to wake up and mom sends out a communication error and an update not 
done for that machine.  If you're thinking green and you turn the PC's off at 
night it's a flood of warnings.  It's huge pain for me because mom is tied into 
our helpdesk software and it generats a helpdesk ticket for each comm error mom 
has.  Other than that it seems to work pretty good.  Very good on the malware 
side.  AV well I just don't see many viruses anymore with good AV and multiple 
scanners on incomming email so I'm guessing it working...
Matt
  - Original Message - 
  From: Bill Lambert 
  To: MS-Exchange Admin Issues 
  Sent: Wednesday, April 08, 2009 4:11 PM
  Subject: Forefront?


  Hello all.

   

  I'm tired of using multiple products to protect desktops and email from spam, 
viruses and spyware.  I've taken a look at the MS Forefront product line and it 
looks like a pretty good solution.  I have Exchange 2003 and XP clients.  

   

  Can anyone comment on its effectiveness, installation, management and use 
both at the admin and user levels?

   

  Any other recommendations are welcome as well.

   

  Thanks.  

   

  Bill Lambert

  Windows System Administrator

  Concuity

  A healthcare division of Trintech, Inc.  

  Phone  847-941-9206

  Fax  847-465-9147



  NASDAQ: TTPA

  The information contained in this e-mail message, including any attached 
files, is intended only for the personal and confidential use of the 
recipient(s) named above. If you are not the intended recipient (or authorized 
to receive information for the recipient) you are hereby notified that you have 
received this communication in error and that any review, dissemination, 
distribution, or copying of this message is strictly prohibited. If you have 
received this communication in error, please contact the sender by reply email 
and delete all copies of this message.  Thank you.

   



~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~
~ http://www.sunbeltsoftware.com/Ninja~<>

RE: Forefront?

[Steve Hart]

We've used Antigen from the Sybari days and use Forefront today. AFAIK, there's 
no spam prevention in Forefront and the anti-spam agents in Antigen were pretty 
weak. For AV and file filtering though, we love it. We haven't had an email 
born virus in the seven years since we first rolled it out. We also filter 20 
or so file extensions that we really don't need.




From: Matt Moore [mailto:mattmoore...@hotmail.com]
Sent: Wednesday, April 08, 2009 5:24 PM
To: MS-Exchange Admin Issues
Subject: Re: Forefront?

We've been using it for about 2 months now.  The jury is out.  Mom bugs the 
crap out of me on a daily basis because pc's go to sleep and it takes too long 
for them to wake up and mom sends out a communication error and an update not 
done for that machine.  If you're thinking green and you turn the PC's off at 
night it's a flood of warnings.  It's huge pain for me because mom is tied into 
our helpdesk software and it generats a helpdesk ticket for each comm error mom 
has.  Other than that it seems to work pretty good.  Very good on the malware 
side.  AV well I just don't see many viruses anymore with good AV and multiple 
scanners on incomming email so I'm guessing it working...
Matt
- Original Message -
From: Bill Lambert<mailto:blamb...@concuity.com>
To: MS-Exchange Admin Issues<mailto:exchangelist@lyris.sunbelt-software.com>
Sent: Wednesday, April 08, 2009 4:11 PM
Subject: Forefront?

Hello all...

I'm tired of using multiple products to protect desktops and email from spam, 
viruses and spyware.  I've taken a look at the MS Forefront product line and it 
looks like a pretty good solution.  I have Exchange 2003 and XP clients.

Can anyone comment on its effectiveness, installation, management and use both 
at the admin and user levels?

Any other recommendations are welcome as well.

Thanks.

Bill Lambert
Windows System Administrator
Concuity
A healthcare division of Trintech, Inc.
Phone  847-941-9206
Fax  847-465-9147
[cid:765253200@09042009-208B]
NASDAQ: TTPA
The information contained in this e-mail message, including any attached files, 
is intended only for the personal and confidential use of the recipient(s) 
named above. If you are not the intended recipient (or authorized to receive 
information for the recipient) you are hereby notified that you have received 
this communication in error and that any review, dissemination, distribution, 
or copying of this message is strictly prohibited. If you have received this 
communication in error, please contact the sender by reply email and delete all 
copies of this message.  Thank you.






~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~
~ http://www.sunbeltsoftware.com/Ninja~<>

RE: Forefront?

[Bill Lambert]

Wow...what a great responses!  Thanks, everyone for the input.

 

I'm going to be meeting with the tech's from other offices tomorrow and
will suggest Forefront for Exchange and client machines as a possible
solution.  If I'm reading the literature correctly, FF for Exchange does
do antispam so that's encouraging.  And it comes with an installation of
SQL that is dedicated to FF.

 

Again, thanks a million!

 

Bill Lambert

Concuity

847-941-9206

 

From: Jon Harris [mailto:jk.har...@gmail.com] 
Sent: Thursday, April 09, 2009 5:50 AM
To: NT System Admin Issues
Subject: Re: Forefront?

 

I didn't and would not suggest waiting either.  I was only making a
comment on the fact there are issues within certain context that I would
hope are fixed in the next version.  Thanks though for letting me know
about the push backs on the the releases.

 

Jon

On Thu, Apr 9, 2009 at 6:38 AM, Steve Burkett <
steve.burk...@stemcor.com> wrote:

Don't wait on the next version coming out, they pushed the Client
Security 2.0 back to first half of 2010 the other day, and the Forefront
Server Security for Exchange back to the fourth quarter of 2009.

 

http://blogs.technet.com/forefront/archive/2009/04/03/schedule-update-fo
r-forefront-stirling.aspx

 

Quite like how the ForeFront for Exchange and Sharepoint packages can
run anti-virus engines from Kaspersky Labs, CA and Sophos so you could
be quite covered by the different definitions from various
manufacturers.

 

Microsoft OneCare was the consumer product they're ditching.

 

 

From: Jon Harris [mailto:jk.har...@gmail.com] 
Sent: 09 April 2009 10:11 


To: NT System Admin Issues

Subject: Re: Forefront? 

 

Some if the things you need to watch out for are whether you are putting
it on Windows 2008 or 2003,  do you own SQL 2005 or 2008, are you using
any of the System Center products.  Like John the EDU discount just
about kills any price competition.  I use it here for that reason.  I
have had to touch it rarely, it works, it does seem to catch bugs, but
it is not simple to setup if you have any of the mixture I mentioned to
watch out for.  There is a new version coming out that I hope will
remove many of the issues I had.  It does need a full SQL to install and
function correctly but it can be installed without the management
portion but why do that.  Considering how hard NOD32 was to set up and
get running Forefront could be done by a teenager.  Considering just the
install of the management portion NOD beat on the install but getting
the configuration correct was much easier to do on Forefront.

 

If you have any specific questions I will try to help but there are
others using it that I know have more experience than me on the llist.

 

Jon

On Wed, Apr 8, 2009 at 8:40 PM, John Hornbuckle <
john.hornbuc...@taylor.k12.fl.us> wrote:

We use it, but I'm hardly an expert on it. To be honest, I don't mess
with it much. Which I guess could be viewed as a good thing!  J

 

I like that it's integrated with AD and WSUS-pushing it down to clients
and keeping it updated is simple.

 

I don't really know how to judge its efficacy. We've not had any known
malware infections while using it, but we also keep our workstations
locked pretty tight (e.g., users don't have admin rights and with many
accounts we restrict executables using GPO).

 

We like the pricing; as an educational entity, we get deep discounts
from Microsoft.

 

 

 

 

John Hornbuckle

MIS Department

Taylor County School District

www.taylor.k12.fl.us <http://www.taylor.k12.fl.us/> 

 

 

 

From: Bill Lambert [mailto:blamb...@concuity.com] 
Sent: Wednesday, April 08, 2009 7:12 PM 


To: NT System Admin Issues

Subject: Forefront? 

 

Hello all...

 

I'm tired of using multiple products to protect desktops and email from
spam, viruses and spyware.  I've taken a look at the MS Forefront
product line and it looks like a pretty good solution.  I have Exchange
2003 and XP clients.  

 

Can anyone comment on its effectiveness, installation, management and
use both at the admin and user levels?

 

Any other recommendations are welcome as well.

 

Thanks.  

 

Bill Lambert

Windows System Administrator

Concuity

A healthcare division of Trintech, Inc.  

Phone  847-941-9206

Fax  847-465-9147

 

NASDAQ: TTPA

The information contained in this e-mail message, including any attached
files, is intended only for the personal and confidential use of the
recipient(s) named above. If you are not the intended recipient (or
authorized to receive information for the recipient) you are hereby
notified that you have received this communication in error and that any
review, dissemination, distribution, or copying of this message is
strictly prohibited. If you have received this communication in error,
please contact the sender by reply email and delete all copies of this
message.  Thank you.

 

 

 

 

 

 

 

 

RE: Forefront?

[Brown, Larry]

We are using Exchange 2007 CCR, with two separate Hub Transports and two 
separate Edge Transports on our DMZ.  We use Forefront on all servers for 
Anti-virus (currently running 4 engines) and we use Forefront on the Edge 
Transports to filter for SPAM using Microsoft's engine and various Blacklists.

The anti-virus protection has been excellent.  The only email related viruses 
we've gotten is when someone falls for a Phishing scheme and clicks on a link.  
Well, I shouldn't say "we've gotten"...our desktop software has prevented the 
installation of the virus at that point...so far.

But that brings me to the weakness of Forefront.  Seems like a lot of SPAM gets 
through: we get calls to the help desk several times a week...especially when 
users get an email from themselves to themselves.  (No matter how many company 
wide emails we send telling users to just delete email they don't recognize 
they still call the Help Desk.)  We could set the parameters a little higher, 
like 6 instead of 7, but we already get 3 or 4 false positives a month.  We 
quarantine everything to a mailbox for 7 days, and get an average of about 700 
messages a day sent there.  This does not include SPAM bounced because of fake 
addresses (ADAM on the Edge Transport checks for legit addresses) or emails 
bounced due to Black Listing.

If I had my preference I think I might look in to a dedicated device in the 
stream before the Edge server for handling SPAM.


From: Steve Hart [mailto:sh...@wrightbg.com]
Sent: Wednesday, April 08, 2009 8:35 PM
To: MS-Exchange Admin Issues
Subject: RE: Forefront?

We've used Antigen from the Sybari days and use Forefront today. AFAIK, there's 
no spam prevention in Forefront and the anti-spam agents in Antigen were pretty 
weak. For AV and file filtering though, we love it. We haven't had an email 
born virus in the seven years since we first rolled it out. We also filter 20 
or so file extensions that we really don't need.




From: Matt Moore [mailto:mattmoore...@hotmail.com]
Sent: Wednesday, April 08, 2009 5:24 PM
To: MS-Exchange Admin Issues
Subject: Re: Forefront?
We've been using it for about 2 months now.  The jury is out.  Mom bugs the 
crap out of me on a daily basis because pc's go to sleep and it takes too long 
for them to wake up and mom sends out a communication error and an update not 
done for that machine.  If you're thinking green and you turn the PC's off at 
night it's a flood of warnings.  It's huge pain for me because mom is tied into 
our helpdesk software and it generats a helpdesk ticket for each comm error mom 
has.  Other than that it seems to work pretty good.  Very good on the malware 
side.  AV well I just don't see many viruses anymore with good AV and multiple 
scanners on incomming email so I'm guessing it working...
Matt
- Original Message -
From: Bill Lambert<mailto:blamb...@concuity.com>
To: MS-Exchange Admin Issues<mailto:exchangelist@lyris.sunbelt-software.com>
Sent: Wednesday, April 08, 2009 4:11 PM
Subject: Forefront?

Hello all...

I'm tired of using multiple products to protect desktops and email from spam, 
viruses and spyware.  I've taken a look at the MS Forefront product line and it 
looks like a pretty good solution.  I have Exchange 2003 and XP clients.

Can anyone comment on its effectiveness, installation, management and use both 
at the admin and user levels?

Any other recommendations are welcome as well.

Thanks.

Bill Lambert
Windows System Administrator
Concuity
A healthcare division of Trintech, Inc.
Phone  847-941-9206
Fax  847-465-9147
[cid:image001.gif@01C9BDD4.4D5B3830]
NASDAQ: TTPA
The information contained in this e-mail message, including any attached files, 
is intended only for the personal and confidential use of the recipient(s) 
named above. If you are not the intended recipient (or authorized to receive 
information for the recipient) you are hereby notified that you have received 
this communication in error and that any review, dissemination, distribution, 
or copying of this message is strictly prohibited. If you have received this 
communication in error, please contact the sender by reply email and delete all 
copies of this message.  Thank you.








~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~
~ http://www.sunbeltsoftware.com/Ninja~<>

RE: Forefront?

[Thomas W Shinder]

Forefront Security for Exchange doesn't do spam filtering -- only some
content filtering and anti-malware. The Exchange Edge machine can do the
spam filtering for you.

 

However, the next version of Forefront for Exchange (F14) will have some
nice anti-spam features. You can beta test F14 if you like.

 

Tom

 



TOM SHINDER   |   Sr. Consultant/Technical Writer 
206.443.1117   |   shin...@prowesscorp.com


5701 Sixth Avenue South   |   Seattle, WA 98108  
PROWESS   |   WWW.PROWESSCORP.COM <http://www.prowesscorp.com/> 



  <http://www.windows.com/>  and a Forefront MVP

 

From: Brown, Larry [mailto:larry.br...@dplinc.com] 
Sent: Wednesday, April 15, 2009 1:15 PM
To: MS-Exchange Admin Issues
Subject: RE: Forefront?

 

We are using Exchange 2007 CCR, with two separate Hub Transports and two
separate Edge Transports on our DMZ.  We use Forefront on all servers
for Anti-virus (currently running 4 engines) and we use Forefront on the
Edge Transports to filter for SPAM using Microsoft's engine and various
Blacklists.

 

The anti-virus protection has been excellent.  The only email related
viruses we've gotten is when someone falls for a Phishing scheme and
clicks on a link.  Well, I shouldn't say "we've gotten"...our desktop
software has prevented the installation of the virus at that point...so
far.

 

But that brings me to the weakness of Forefront.  Seems like a lot of
SPAM gets through: we get calls to the help desk several times a
week...especially when users get an email from themselves to themselves.
(No matter how many company wide emails we send telling users to just
delete email they don't recognize they still call the Help Desk.)  We
could set the parameters a little higher, like 6 instead of 7, but we
already get 3 or 4 false positives a month.  We quarantine everything to
a mailbox for 7 days, and get an average of about 700 messages a day
sent there.  This does not include SPAM bounced because of fake
addresses (ADAM on the Edge Transport checks for legit addresses) or
emails bounced due to Black Listing.

 

If I had my preference I think I might look in to a dedicated device in
the stream before the Edge server for handling SPAM.

 



From: Steve Hart [mailto:sh...@wrightbg.com] 
Sent: Wednesday, April 08, 2009 8:35 PM
To: MS-Exchange Admin Issues
Subject: RE: Forefront?

 

We've used Antigen from the Sybari days and use Forefront today. AFAIK,
there's no spam prevention in Forefront and the anti-spam agents in
Antigen were pretty weak. For AV and file filtering though, we love it.
We haven't had an email born virus in the seven years since we first
rolled it out. We also filter 20 or so file extensions that we really
don't need.

 

 

 



From: Matt Moore [mailto:mattmoore...@hotmail.com] 
Sent: Wednesday, April 08, 2009 5:24 PM
To: MS-Exchange Admin Issues
Subject: Re: Forefront?

We've been using it for about 2 months now.  The jury is out.  Mom bugs
the crap out of me on a daily basis because pc's go to sleep and it
takes too long for them to wake up and mom sends out a communication
error and an update not done for that machine.  If you're thinking green
and you turn the PC's off at night it's a flood of warnings.  It's huge
pain for me because mom is tied into our helpdesk software and it
generats a helpdesk ticket for each comm error mom has.  Other than that
it seems to work pretty good.  Very good on the malware side.  AV well I
just don't see many viruses anymore with good AV and multiple scanners
on incomming email so I'm guessing it working...

Matt

- Original Message - 

From: Bill Lambert <mailto:blamb...@concuity.com>  

To: MS-Exchange Admin Issues
<mailto:exchangelist@lyris.sunbelt-software.com>  

Sent: Wednesday, April 08, 2009 4:11 PM

Subject: Forefront?

 

Hello all...

 

I'm tired of using multiple products to protect desktops and
email from spam, viruses and spyware.  I've taken a look at the MS
Forefront product line and it looks like a pretty good solution.  I have
Exchange 2003 and XP clients.  

 

Can anyone comment on its effectiveness, installation,
management and use both at the admin and user levels?

 

Any other recommendations are welcome as well.

 

Thanks.  

 

Bill Lambert

Windows System Administrator

Concuity

A healthcare division of Trintech, Inc.  

Phone  847-941-9206

Fax  847-465-9147

 

NASDAQ: TTPA

The information contained in this e-mail message, including any
attached files, is intended only for the personal and confidential use
o

RE: Forefront?

[Brown, Larry]

You are correct sir.  I was getting my content filtering in Forefront mixed up 
with the anti-spam in the EMC.  Been 1½ years since we set this all up. I've 
slept a time or two since then.

So I would only change what I said about Forefront to Exchange Edge Transport 
2007 when discussing SPAM in my first email.


From: Thomas W Shinder [mailto:tshin...@tacteam.net]
Sent: Wednesday, April 15, 2009 3:32 PM
To: MS-Exchange Admin Issues
Subject: RE: Forefront?

Forefront Security for Exchange doesn't do spam filtering -- only some content 
filtering and anti-malware. The Exchange Edge machine can do the spam filtering 
for you.

However, the next version of Forefront for Exchange (F14) will have some nice 
anti-spam features. You can beta test F14 if you like.

Tom


TOM SHINDER   |   Sr. Consultant/Technical Writer
206.443.1117   |   shin...@prowesscorp.com<mailto:shin...@prowesscorp.com>

5701 Sixth Avenue South   |   Seattle, WA 98108
PROWESS   |   WWW.PROWESSCORP.COM<http://www.prowesscorp.com/>

[cid:image002.gif@01C9BE9D.9E7D8960]<http://www.windows.com/> and a Forefront 
MVP

From: Brown, Larry [mailto:larry.br...@dplinc.com]
Sent: Wednesday, April 15, 2009 1:15 PM
To: MS-Exchange Admin Issues
Subject: RE: Forefront?

We are using Exchange 2007 CCR, with two separate Hub Transports and two 
separate Edge Transports on our DMZ.  We use Forefront on all servers for 
Anti-virus (currently running 4 engines) and we use Forefront on the Edge 
Transports to filter for SPAM using Microsoft's engine and various Blacklists.

The anti-virus protection has been excellent.  The only email related viruses 
we've gotten is when someone falls for a Phishing scheme and clicks on a link.  
Well, I shouldn't say "we've gotten"...our desktop software has prevented the 
installation of the virus at that point...so far.

But that brings me to the weakness of Forefront.  Seems like a lot of SPAM gets 
through: we get calls to the help desk several times a week...especially when 
users get an email from themselves to themselves.  (No matter how many company 
wide emails we send telling users to just delete email they don't recognize 
they still call the Help Desk.)  We could set the parameters a little higher, 
like 6 instead of 7, but we already get 3 or 4 false positives a month.  We 
quarantine everything to a mailbox for 7 days, and get an average of about 700 
messages a day sent there.  This does not include SPAM bounced because of fake 
addresses (ADAM on the Edge Transport checks for legit addresses) or emails 
bounced due to Black Listing.

If I had my preference I think I might look in to a dedicated device in the 
stream before the Edge server for handling SPAM.


From: Steve Hart [mailto:sh...@wrightbg.com]
Sent: Wednesday, April 08, 2009 8:35 PM
To: MS-Exchange Admin Issues
Subject: RE: Forefront?

We've used Antigen from the Sybari days and use Forefront today. AFAIK, there's 
no spam prevention in Forefront and the anti-spam agents in Antigen were pretty 
weak. For AV and file filtering though, we love it. We haven't had an email 
born virus in the seven years since we first rolled it out. We also filter 20 
or so file extensions that we really don't need.




From: Matt Moore [mailto:mattmoore...@hotmail.com]
Sent: Wednesday, April 08, 2009 5:24 PM
To: MS-Exchange Admin Issues
Subject: Re: Forefront?
We've been using it for about 2 months now.  The jury is out.  Mom bugs the 
crap out of me on a daily basis because pc's go to sleep and it takes too long 
for them to wake up and mom sends out a communication error and an update not 
done for that machine.  If you're thinking green and you turn the PC's off at 
night it's a flood of warnings.  It's huge pain for me because mom is tied into 
our helpdesk software and it generats a helpdesk ticket for each comm error mom 
has.  Other than that it seems to work pretty good.  Very good on the malware 
side.  AV well I just don't see many viruses anymore with good AV and multiple 
scanners on incomming email so I'm guessing it working...
Matt
- Original Message -
From: Bill Lambert<mailto:blamb...@concuity.com>
To: MS-Exchange Admin Issues<mailto:exchangelist@lyris.sunbelt-software.com>
Sent: Wednesday, April 08, 2009 4:11 PM
Subject: Forefront?

Hello all...

I'm tired of using multiple products to protect desktops and email from spam, 
viruses and spyware.  I've taken a look at the MS Forefront product line and it 
looks like a pretty good solution.  I have Exchange 2003 and XP clients.

Can anyone comment on its effectiveness, installation, management and use both 
at the admin and user levels?

Any other recommendations are w

RE: Forefront?

[Thomas W Shinder]

Hi Larry,

 

Ha! Yes, sleeping a couple of times in a year and a half is good for you :)

 

I agree. While the anti-spam in Exchange is pretty good, it isn't as robust as 
many dedicated anti-spam solutions. 

 

I haven't tried Stu's solution yet, but from what I've read it's pretty good. 
I've been trying out SpamTitan, a BSD based solution which has been working 
well for us.

 

Tom

 



TOM SHINDER   |   Sr. Consultant/Technical Writer 
206.443.1117   |   shin...@prowesscorp.com


5701 Sixth Avenue South   |   Seattle, WA 98108  
PROWESS   |   WWW.PROWESSCORP.COM <http://www.prowesscorp.com/> 



  <http://www.windows.com/> 

 

From: Brown, Larry [mailto:larry.br...@dplinc.com] 
Sent: Thursday, April 16, 2009 1:14 PM
To: MS-Exchange Admin Issues
Subject: RE: Forefront?

 

You are correct sir.  I was getting my content filtering in Forefront mixed up 
with the anti-spam in the EMC.  Been 1½ years since we set this all up. I've 
slept a time or two since then.

 

So I would only change what I said about Forefront to Exchange Edge Transport 
2007 when discussing SPAM in my first email.

 



From: Thomas W Shinder [mailto:tshin...@tacteam.net] 
Sent: Wednesday, April 15, 2009 3:32 PM
To: MS-Exchange Admin Issues
Subject: RE: Forefront?

 

Forefront Security for Exchange doesn't do spam filtering -- only some content 
filtering and anti-malware. The Exchange Edge machine can do the spam filtering 
for you.

 

However, the next version of Forefront for Exchange (F14) will have some nice 
anti-spam features. You can beta test F14 if you like.

 

Tom

 



TOM SHINDER   |   Sr. Consultant/Technical Writer 
206.443.1117   |   shin...@prowesscorp.com


5701 Sixth Avenue South   |   Seattle, WA 98108  
PROWESS   |   WWW.PROWESSCORP.COM <http://www.prowesscorp.com/> 



  <http://www.windows.com/>  and a Forefront MVP

 

From: Brown, Larry [mailto:larry.br...@dplinc.com] 
Sent: Wednesday, April 15, 2009 1:15 PM
To: MS-Exchange Admin Issues
Subject: RE: Forefront?

 

We are using Exchange 2007 CCR, with two separate Hub Transports and two 
separate Edge Transports on our DMZ.  We use Forefront on all servers for 
Anti-virus (currently running 4 engines) and we use Forefront on the Edge 
Transports to filter for SPAM using Microsoft's engine and various Blacklists.

 

The anti-virus protection has been excellent.  The only email related viruses 
we've gotten is when someone falls for a Phishing scheme and clicks on a link.  
Well, I shouldn't say "we've gotten"...our desktop software has prevented the 
installation of the virus at that point...so far.

 

But that brings me to the weakness of Forefront.  Seems like a lot of SPAM gets 
through: we get calls to the help desk several times a week...especially when 
users get an email from themselves to themselves.  (No matter how many company 
wide emails we send telling users to just delete email they don't recognize 
they still call the Help Desk.)  We could set the parameters a little higher, 
like 6 instead of 7, but we already get 3 or 4 false positives a month.  We 
quarantine everything to a mailbox for 7 days, and get an average of about 700 
messages a day sent there.  This does not include SPAM bounced because of fake 
addresses (ADAM on the Edge Transport checks for legit addresses) or emails 
bounced due to Black Listing.

 

If I had my preference I think I might look in to a dedicated device in the 
stream before the Edge server for handling SPAM.

 



From: Steve Hart [mailto:sh...@wrightbg.com] 
Sent: Wednesday, April 08, 2009 8:35 PM
To: MS-Exchange Admin Issues
Subject: RE: Forefront?

 

We've used Antigen from the Sybari days and use Forefront today. AFAIK, there's 
no spam prevention in Forefront and the anti-spam agents in Antigen were pretty 
weak. For AV and file filtering though, we love it. We haven't had an email 
born virus in the seven years since we first rolled it out. We also filter 20 
or so file extensions that we really don't need.

 

 

 



From: Matt Moore [mailto:mattmoore...@hotmail.com] 
Sent: Wednesday, April 08, 2009 5:24 PM
To: MS-Exchange Admin Issues
Subject: Re: Forefront?

We've been using it for about 2 months now.  The jury is out.  Mom bugs the 
crap out of me on a daily basis because pc's go to sleep and it takes too long 
for them to wake up and mom sends out a communication error and an update not 
done for that machine.  If you're thinking green and you turn the PC's off at 
night it's a flood of warnings.  It's huge pain for me because mom is tied into 
our helpdesk software and i

RE: Forefront?

[Brown, Larry]

Unfortunately we're going to have to live with what we have for the foreseeable 
future.  Budget cuts and all that fun jazz...

Honestly its not that a ton of SPAM gets through...it hearing about it from the 
same 5 or 6 users over and over and over.  "Why am I getting these two spam 
messages a week?"  Doesn't matter how many we block on the Edge or 
quarantine/delete.  In important people's eyes, one or two a week is a disaster.


From: Thomas W Shinder [mailto:tshin...@tacteam.net]
Sent: Thursday, April 16, 2009 2:21 PM
To: MS-Exchange Admin Issues
Subject: RE: Forefront?

Hi Larry,

Ha! Yes, sleeping a couple of times in a year and a half is good for you :)

I agree. While the anti-spam in Exchange is pretty good, it isn't as robust as 
many dedicated anti-spam solutions.

I haven't tried Stu's solution yet, but from what I've read it's pretty good. 
I've been trying out SpamTitan, a BSD based solution which has been working 
well for us.

Tom


TOM SHINDER   |   Sr. Consultant/Technical Writer
206.443.1117   |   shin...@prowesscorp.com<mailto:shin...@prowesscorp.com>

5701 Sixth Avenue South   |   Seattle, WA 98108
PROWESS   |   WWW.PROWESSCORP.COM<http://www.prowesscorp.com/>

[cid:image004.gif@01C9BEA3.402DA650]<http://www.windows.com/>

From: Brown, Larry [mailto:larry.br...@dplinc.com]
Sent: Thursday, April 16, 2009 1:14 PM
To: MS-Exchange Admin Issues
Subject: RE: Forefront?

You are correct sir.  I was getting my content filtering in Forefront mixed up 
with the anti-spam in the EMC.  Been 1½ years since we set this all up. I've 
slept a time or two since then.

So I would only change what I said about Forefront to Exchange Edge Transport 
2007 when discussing SPAM in my first email.


From: Thomas W Shinder [mailto:tshin...@tacteam.net]
Sent: Wednesday, April 15, 2009 3:32 PM
To: MS-Exchange Admin Issues
Subject: RE: Forefront?

Forefront Security for Exchange doesn't do spam filtering -- only some content 
filtering and anti-malware. The Exchange Edge machine can do the spam filtering 
for you.

However, the next version of Forefront for Exchange (F14) will have some nice 
anti-spam features. You can beta test F14 if you like.

Tom


TOM SHINDER   |   Sr. Consultant/Technical Writer
206.443.1117   |   shin...@prowesscorp.com<mailto:shin...@prowesscorp.com>

5701 Sixth Avenue South   |   Seattle, WA 98108
PROWESS   |   WWW.PROWESSCORP.COM<http://www.prowesscorp.com/>

[cid:image005.gif@01C9BEA3.402DA650]<http://www.windows.com/> and a Forefront 
MVP

From: Brown, Larry [mailto:larry.br...@dplinc.com]
Sent: Wednesday, April 15, 2009 1:15 PM
To: MS-Exchange Admin Issues
Subject: RE: Forefront?

We are using Exchange 2007 CCR, with two separate Hub Transports and two 
separate Edge Transports on our DMZ.  We use Forefront on all servers for 
Anti-virus (currently running 4 engines) and we use Forefront on the Edge 
Transports to filter for SPAM using Microsoft's engine and various Blacklists.

The anti-virus protection has been excellent.  The only email related viruses 
we've gotten is when someone falls for a Phishing scheme and clicks on a link.  
Well, I shouldn't say "we've gotten"...our desktop software has prevented the 
installation of the virus at that point...so far.

But that brings me to the weakness of Forefront.  Seems like a lot of SPAM gets 
through: we get calls to the help desk several times a week...especially when 
users get an email from themselves to themselves.  (No matter how many company 
wide emails we send telling users to just delete email they don't recognize 
they still call the Help Desk.)  We could set the parameters a little higher, 
like 6 instead of 7, but we already get 3 or 4 false positives a month.  We 
quarantine everything to a mailbox for 7 days, and get an average of about 700 
messages a day sent there.  This does not include SPAM bounced because of fake 
addresses (ADAM on the Edge Transport checks for legit addresses) or emails 
bounced due to Black Listing.

If I had my preference I think I might look in to a dedicated device in the 
stream before the Edge server for handling SPAM.

____
From: Steve Hart [mailto:sh...@wrightbg.com]
Sent: Wednesday, April 08, 2009 8:35 PM
To: MS-Exchange Admin Issues
Subject: RE: Forefront?

We've used Antigen from the Sybari days and use Forefront today. AFAIK, there's 
no spam prevention in Forefront and the anti-spam agents in Antigen were pretty 
weak. For AV and file filtering though, we love it. We haven't had an email 
born virus in the seven years since we first rolled it out. We also filter 20 

RE: forefront

[Steve Hart]

We ran Antigen for Exchange back in the Sybari days and later Forefront for 
Exchange. Liked the earlier versions of the product, but moved away from after 
MS bought them out, mostly do a horrible falloff in the quality of customer 
service. At the time, we were a small shop with 80 mailboxes on one server.

The biggest problem we had was on underpowered hardware. Twice we had Forefront 
begin quarantining all email, once during a RAID failure and once during an 
i-phone swamp. In both cases, the underpowered server got very slow and 
Forefront began timing out and quarantining all email.

I was never really happy with the mechanism to forward quarantined email 
either. The emails would show up as forwarded from Forefront and that confused 
the end users.  To be honest though, this might have been solvable, if I'd had 
more time to troubleshoot it.

We're a lot happier with SpamTitan.



Steve Hart
Network Administrator
503.491.4343 -Direct | 503.492.8160 - Fax

From: Jason Benway [mailto:benw...@jsjcorp.com]
Sent: Thursday, July 21, 2011 10:27 AM
To: MS-Exchange Admin Issues
Subject: forefront

Just wondering how many on the list were running Microsoft forefront for 
exchange and/or forefront for endpoints

What have has been your experience, better or worse than other products?

We currently run Trend on the desktops and soncwall email security for email 
viruses and spam.

Thanks,jb

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

Re: forefront

[Joseph Heaton]

I'm using Forefront Endpoint Protection, but not the Exchange product.  I 
really like FEP, as it's managed through SCCM, and installing on a new machine 
is as simple as adding it to the right collection, and within minutes FEP is 
installed.  Definition updates are pushed automatically, and it's really a 
hands-free operation.

>>> Jason Benway  7/21/2011 10:27 AM >>>
Just wondering how many on the list were running Microsoft forefront for
exchange and/or forefront for endpoints

 

What have has been your experience, better or worse than other products?

 

We currently run Trend on the desktops and soncwall email security for
email viruses and spam.

 

Thanks,jb


---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/ 
or send an email to listmana...@lyris.sunbeltsoftware.com 
with the body: unsubscribe exchangelist



---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

RE: forefront

[Jason Benway]

How well has it worked keeping viruses and malware off the workstations?
A lot of malware gets past Trend on the desktop

jb

-Original Message-
From: Joseph Heaton [mailto:jhea...@dfg.ca.gov] 
Sent: Thursday, July 21, 2011 2:25 PM
To: MS-Exchange Admin Issues
Subject: Re: forefront

I'm using Forefront Endpoint Protection, but not the Exchange product.
I really like FEP, as it's managed through SCCM, and installing on a new
machine is as simple as adding it to the right collection, and within
minutes FEP is installed.  Definition updates are pushed automatically,
and it's really a hands-free operation.

>>> Jason Benway  7/21/2011 10:27 AM >>>
Just wondering how many on the list were running Microsoft forefront for
exchange and/or forefront for endpoints

 

What have has been your experience, better or worse than other products?

 

We currently run Trend on the desktops and soncwall email security for
email viruses and spam.

 

Thanks,jb


---
To manage subscriptions click here:
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist



---
To manage subscriptions click here:
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist


---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

Re: forefront

[Roger Wright]

We used Forefront for a couple years before switching to VIPRE.  Our primary
issue was too many desktop infections.  VIPRE reduced this noticeably.

Forefront also requires SQL Server so if you don't already have that be sure
to include it in your costs.


Roger Wright
___

Dr. Seuss is my favorite rapper!  Cat - Hat... sheer genius!




On Thu, Jul 21, 2011 at 3:23 PM, Jason Benway  wrote:

> How well has it worked keeping viruses and malware off the workstations?
> A lot of malware gets past Trend on the desktop
>
> jb
>
> -Original Message-
> From: Joseph Heaton [mailto:jhea...@dfg.ca.gov]
> Sent: Thursday, July 21, 2011 2:25 PM
> To: MS-Exchange Admin Issues
> Subject: Re: forefront
>
> I'm using Forefront Endpoint Protection, but not the Exchange product.
> I really like FEP, as it's managed through SCCM, and installing on a new
> machine is as simple as adding it to the right collection, and within
> minutes FEP is installed.  Definition updates are pushed automatically,
> and it's really a hands-free operation.
>
> >>> Jason Benway  7/21/2011 10:27 AM >>>
> Just wondering how many on the list were running Microsoft forefront for
> exchange and/or forefront for endpoints
>
>
>
> What have has been your experience, better or worse than other products?
>
>
>
> We currently run Trend on the desktops and soncwall email security for
> email viruses and spam.
>
>
>
> Thanks,jb
>
>
> ---
> To manage subscriptions click here:
> http://lyris.sunbelt-software.com/read/my_forums/
> or send an email to listmana...@lyris.sunbeltsoftware.com
> with the body: unsubscribe exchangelist
>
>
>
> ---
> To manage subscriptions click here:
> http://lyris.sunbelt-software.com/read/my_forums/
> or send an email to listmana...@lyris.sunbeltsoftware.com
> with the body: unsubscribe exchangelist
>
>
> ---
> To manage subscriptions click here:
> http://lyris.sunbelt-software.com/read/my_forums/
> or send an email to listmana...@lyris.sunbeltsoftware.com
> with the body: unsubscribe exchangelist
>
>

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

Re: forefront

[Brian McGloin]

We use Trend and get VERY little malware.

On Thu, Jul 21, 2011 at 3:23 PM, Jason Benway  wrote:

> How well has it worked keeping viruses and malware off the workstations?
> A lot of malware gets past Trend on the desktop
>
> jb
>
> -Original Message-
> From: Joseph Heaton [mailto:jhea...@dfg.ca.gov]
> Sent: Thursday, July 21, 2011 2:25 PM
> To: MS-Exchange Admin Issues
> Subject: Re: forefront
>
> I'm using Forefront Endpoint Protection, but not the Exchange product.
> I really like FEP, as it's managed through SCCM, and installing on a new
> machine is as simple as adding it to the right collection, and within
> minutes FEP is installed.  Definition updates are pushed automatically,
> and it's really a hands-free operation.
>
> >>> Jason Benway  7/21/2011 10:27 AM >>>
> Just wondering how many on the list were running Microsoft forefront for
> exchange and/or forefront for endpoints
>
>
>
> What have has been your experience, better or worse than other products?
>
>
>
> We currently run Trend on the desktops and soncwall email security for
> email viruses and spam.
>
>
>
> Thanks,jb
>
>
> ---
> To manage subscriptions click here:
> http://lyris.sunbelt-software.com/read/my_forums/
> or send an email to listmana...@lyris.sunbeltsoftware.com
> with the body: unsubscribe exchangelist
>
>
>
> ---
> To manage subscriptions click here:
> http://lyris.sunbelt-software.com/read/my_forums/
> or send an email to listmana...@lyris.sunbeltsoftware.com
> with the body: unsubscribe exchangelist
>
>
> ---
> To manage subscriptions click here:
> http://lyris.sunbelt-software.com/read/my_forums/
> or send an email to listmana...@lyris.sunbeltsoftware.com
> with the body: unsubscribe exchangelist
>
>


-- 
smsadm

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

Re: forefront

[kz20fl]

Hate to sound like a whitelisting evangelist but SRPs keep more stuff at bay 
for us than AV ever has. Reading SRP logs gives a fascinating insight into user 
behaviour

--Original Message--
From: Wayne Dueck
To: MS-Exchange Admin Issues
ReplyTo: MS-Exchange Admin Issues
Subject: re: forefront
Sent: 21 Jul 2011 22:46

We have Trend on the desktop, Proofpoint for the email gateway (SPAM)and 
Forefront on the Hub Transport servers. Forefront works very well for us. No 
SQL server needed for our implementation.
-Wayne
---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

Sent from my POS BlackBerry  wireless device, which may wipe itself at any 
moment

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

RE: forefront

[Rhett Thatcher]

We switched to Forefront for email and clients a few months ago from Sophos 
Puremessage and endpoint.  Coincidentally we got hit with a phishing attack 
just after we switched and blame was ready to be placed, so I ran some sample 
thought the Puremessage and it would have passed that as well. We also ran 
quite a bit of mail though Forefront before the change and they performed 
roughly the same. 

Proper deployment, management and reporting for Forefront Endpoint protection 
is accomplished using System Center Configuration Manger which requires SQL. 
Protection for Exchange (and SharePoint) can be managed using the Forefront 
Server Management Console, which needs a SQL database. Right now we don't use 
the management console as we only have it running on two Hub Transport servers. 
If we had any more or were quarantining messages I would want to be utilizing 
that to manage it all. 

Rhett Thatcher | Manager, Server Technology | Information Technology
St. Lawrence University | Madill Hall | Canton, NY 13617 | 315.229.5413

Remember, Information Technology at St. Lawrence University will never request 
your personal information or password via email.


-Original Message-
From: Wayne Dueck [mailto:wayne.l.du...@state.or.us] 
Sent: Thursday, July 21, 2011 5:47 PM
To: MS-Exchange Admin Issues
Subject: re: forefront

We have Trend on the desktop, Proofpoint for the email gateway (SPAM)and 
Forefront on the Hub Transport servers. Forefront works very well for us. No 
SQL server needed for our implementation.
-Wayne
---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

Re: forefront

[Joseph Heaton]

Well, Forefront is integrated into SCCM now, so if you're running SCCM, you'll 
just use the same SQL.

>>> Roger Wright  7/21/2011 12:30 PM >>>
We used Forefront for a couple years before switching to VIPRE.  Our primary
issue was too many desktop infections.  VIPRE reduced this noticeably.

Forefront also requires SQL Server so if you don't already have that be sure
to include it in your costs.


Roger Wright
___

Dr. Seuss is my favorite rapper!  Cat - Hat... sheer genius!




On Thu, Jul 21, 2011 at 3:23 PM, Jason Benway  wrote:

> How well has it worked keeping viruses and malware off the workstations?
> A lot of malware gets past Trend on the desktop
>
> jb
>
> -Original Message-
> From: Joseph Heaton [mailto:jhea...@dfg.ca.gov] 
> Sent: Thursday, July 21, 2011 2:25 PM
> To: MS-Exchange Admin Issues
> Subject: Re: forefront
>
> I'm using Forefront Endpoint Protection, but not the Exchange product.
> I really like FEP, as it's managed through SCCM, and installing on a new
> machine is as simple as adding it to the right collection, and within
> minutes FEP is installed.  Definition updates are pushed automatically,
> and it's really a hands-free operation.
>
> >>> Jason Benway  7/21/2011 10:27 AM >>>
> Just wondering how many on the list were running Microsoft forefront for
> exchange and/or forefront for endpoints
>
>
>
> What have has been your experience, better or worse than other products?
>
>
>
> We currently run Trend on the desktops and soncwall email security for
> email viruses and spam.
>
>
>
> Thanks,jb
>
>
> ---
> To manage subscriptions click here:
> http://lyris.sunbelt-software.com/read/my_forums/ 
> or send an email to listmana...@lyris.sunbeltsoftware.com 
> with the body: unsubscribe exchangelist
>
>
>
> ---
> To manage subscriptions click here:
> http://lyris.sunbelt-software.com/read/my_forums/ 
> or send an email to listmana...@lyris.sunbeltsoftware.com 
> with the body: unsubscribe exchangelist
>
>
> ---
> To manage subscriptions click here:
> http://lyris.sunbelt-software.com/read/my_forums/ 
> or send an email to listmana...@lyris.sunbeltsoftware.com 
> with the body: unsubscribe exchangelist
>
>

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/ 
or send an email to listmana...@lyris.sunbeltsoftware.com 
with the body: unsubscribe exchangelist



---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

Re: Forefront Quarantine

[Alex Fontana]

Rob, you want to set the "Deliver from Quarantine Security" to
"Compatability Mode", this is found in the General Options of the Forefront
security admin console or during install.

-alex

On Mon, Nov 30, 2009 at 7:50 AM, McCready, Rob wrote:

>  I have a File Filter setup in Forefront to block potentially harmful
> files (Exchange 2007).  I currently have the box selected to “Quarantine
> Files”.  The problem is, when I want to release a legitimate business file
> that has been quarantined, and I select the DELIVER option, it just
> re-quarantines the file.
>
> How can I set it up so that the DELIVER option actually works without
> re-quarantining?
>
> Thanks.
>
> Rob
>

RE: Forefront Quarantine

[McCready, Rob]

Thanks Alex!  I am getting closer.

I now have Forefront setup with a File Filter to block certain attachments.  
The email still goes through, but the attached file is replaced with a .txt 
file with the following message

FILE QUARANTINED

Microsoft Forefront Security for Exchange Server removed a file since it was 
found to match a filter.
File name: "Copy of reports.mdb"
Filter name: "FILE FILTER= Custom stripped file extensions: *.mdb*"

Sooo, the user is now aware a file was blocked for them.  The problem is 
though, IF it's legitimate, I still can't release it.  When I select the 
DELIVER button along with the Original Recipients option, nothing happens.  The 
original email never hits my Inbox.

Under Filtering, I have
File Filter = Enabled
Action = Delete: Remove Contents
Quarantine Files is checked.
Under my General Options
Deliver from Quarantine Security: = Compatibility Mode

I've tried changing the Action to
Skip: detect only

But all that does is send the original message through with no attachment and 
no indication a file was blocked.

Hmm.



From: Alex Fontana [mailto:afontana...@gmail.com]
Sent: Monday, November 30, 2009 5:51 PM
To: MS-Exchange Admin Issues
Subject: Re: Forefront Quarantine

Rob, you want to set the "Deliver from Quarantine Security" to "Compatability 
Mode", this is found in the General Options of the Forefront security admin 
console or during install.

-alex
On Mon, Nov 30, 2009 at 7:50 AM, McCready, Rob 
mailto:rob.mccrea...@dplinc.com>> wrote:
I have a File Filter setup in Forefront to block potentially harmful files 
(Exchange 2007).  I currently have the box selected to "Quarantine Files".  The 
problem is, when I want to release a legitimate business file that has been 
quarantined, and I select the DELIVER option, it just re-quarantines the file.

How can I set it up so that the DELIVER option actually works without 
re-quarantining?

Thanks.

Rob

RE: Forefront Quarantine

[McCready, Rob]

Hmm,

It looks like hitting the DELIVER button did send something to me, but it did 
not include the attachment with either of these options selected.

 "Skip: Detect only"

or

"Delete: remove contents"...




The file attachment from the message "Delete: Remove Contents", originally sent 
to you by joh...@user.com<mailto:joh...@user.com> has been forwarded to you 
from the Microsoft Forefront Server Security Quarantine area.

This attachment may have been re-scanned by Microsoft Forefront Server Security 
and handled according to the appropriate scan job's settings.









<>


From: McCready, Rob [mailto:rob.mccrea...@dplinc.com]
Sent: Tuesday, December 08, 2009 4:36 PM
To: MS-Exchange Admin Issues
Subject: RE: Forefront Quarantine

Thanks Alex!  I am getting closer.

I now have Forefront setup with a File Filter to block certain attachments.  
The email still goes through, but the attached file is replaced with a .txt 
file with the following message

FILE QUARANTINED

Microsoft Forefront Security for Exchange Server removed a file since it was 
found to match a filter.
File name: "Copy of reports.mdb"
Filter name: "FILE FILTER= Custom stripped file extensions: *.mdb*"

Sooo, the user is now aware a file was blocked for them.  The problem is 
though, IF it's legitimate, I still can't release it.  When I select the 
DELIVER button along with the Original Recipients option, nothing happens.  The 
original email never hits my Inbox.

Under Filtering, I have
File Filter = Enabled
Action = Delete: Remove Contents
Quarantine Files is checked.
Under my General Options
Deliver from Quarantine Security: = Compatibility Mode

I've tried changing the Action to
Skip: detect only

But all that does is send the original message through with no attachment and 
no indication a file was blocked.

Hmm.



From: Alex Fontana [mailto:afontana...@gmail.com]
Sent: Monday, November 30, 2009 5:51 PM
To: MS-Exchange Admin Issues
Subject: Re: Forefront Quarantine

Rob, you want to set the "Deliver from Quarantine Security" to "Compatability 
Mode", this is found in the General Options of the Forefront security admin 
console or during install.

-alex
On Mon, Nov 30, 2009 at 7:50 AM, McCready, Rob 
mailto:rob.mccrea...@dplinc.com>> wrote:
I have a File Filter setup in Forefront to block potentially harmful files 
(Exchange 2007).  I currently have the box selected to "Quarantine Files".  The 
problem is, when I want to release a legitimate business file that has been 
quarantined, and I select the DELIVER option, it just re-quarantines the file.

How can I set it up so that the DELIVER option actually works without 
re-quarantining?

Thanks.

Rob

RE: Forefront Quarantine

[Andrew Mclaren]

Hi Rob

In my setup, I added the email address that Forefront uses when releasing the 
quarantine to the list of "Allowed Senders" so that the filter check is totally 
bypassed.

Cheers, Andrew.

From: McCready, Rob [mailto:rob.mccrea...@dplinc.com]
Sent: 09 December 2009 03:23 PM
To: MS-Exchange Admin Issues
Subject: RE: Forefront Quarantine

Hmm,

It looks like hitting the DELIVER button did send something to me, but it did 
not include the attachment with either of these options selected.

 "Skip: Detect only"

or

"Delete: remove contents"...




The file attachment from the message "Delete: Remove Contents", originally sent 
to you by joh...@user.com<mailto:joh...@user.com> has been forwarded to you 
from the Microsoft Forefront Server Security Quarantine area.

This attachment may have been re-scanned by Microsoft Forefront Server Security 
and handled according to the appropriate scan job's settings.









<>


From: McCready, Rob [mailto:rob.mccrea...@dplinc.com]
Sent: Tuesday, December 08, 2009 4:36 PM
To: MS-Exchange Admin Issues
Subject: RE: Forefront Quarantine

Thanks Alex!  I am getting closer.

I now have Forefront setup with a File Filter to block certain attachments.  
The email still goes through, but the attached file is replaced with a .txt 
file with the following message

FILE QUARANTINED

Microsoft Forefront Security for Exchange Server removed a file since it was 
found to match a filter.
File name: "Copy of reports.mdb"
Filter name: "FILE FILTER= Custom stripped file extensions: *.mdb*"

Sooo, the user is now aware a file was blocked for them.  The problem is 
though, IF it's legitimate, I still can't release it.  When I select the 
DELIVER button along with the Original Recipients option, nothing happens.  The 
original email never hits my Inbox.

Under Filtering, I have
File Filter = Enabled
Action = Delete: Remove Contents
Quarantine Files is checked.
Under my General Options
Deliver from Quarantine Security: = Compatibility Mode

I've tried changing the Action to
Skip: detect only

But all that does is send the original message through with no attachment and 
no indication a file was blocked.

Hmm.



From: Alex Fontana [mailto:afontana...@gmail.com]
Sent: Monday, November 30, 2009 5:51 PM
To: MS-Exchange Admin Issues
Subject: Re: Forefront Quarantine

Rob, you want to set the "Deliver from Quarantine Security" to "Compatability 
Mode", this is found in the General Options of the Forefront security admin 
console or during install.

-alex
On Mon, Nov 30, 2009 at 7:50 AM, McCready, Rob 
mailto:rob.mccrea...@dplinc.com>> wrote:
I have a File Filter setup in Forefront to block potentially harmful files 
(Exchange 2007).  I currently have the box selected to "Quarantine Files".  The 
problem is, when I want to release a legitimate business file that has been 
quarantined, and I select the DELIVER option, it just re-quarantines the file.

How can I set it up so that the DELIVER option actually works without 
re-quarantining?

Thanks.

Rob

RE: Forefront Quarantine

[McCready, Rob]

Nevermind Gurus, it appears to be working now.

Thanks anyway!

-Original Message-
From: McCready, Rob [mailto:rob.mccrea...@dplinc.com] 
Sent: Thursday, October 07, 2010 2:41 PM
To: MS-Exchange Admin Issues
Subject: Forefront Quarantine

I'm not sure what changed, but we have a Filter List setup via Forefront on our 
Microsoft Exchange 2007 Edge Transport server, and up until a few days ago, it 
would automatically quarantine file extensions we had on the list.  .COM for 
instance.  After being quarantined, we could open Forefront, go to the report 
tab and highlight quarantine to deliver the file if it was actually business 
related.  However, the files are no longer being quarantined, they are just 
automatically deleted.  If I look under the "Incidents" section instead of 
"quarantine", I can see where the file was purged.

Does anybody know what I might need to correct to get things back to normal?


If I open Forefront, look under the Filtering tab and highlight "File", I can 
see that the Filter List is enabled with the Action: Delete: remove contents.  
My only other 3 options are

Skip: detect only  (which punches the file straight through)
Purge eliminate message:  (which gives me a warning that the attachments will 
be purged and unrecoverable...not what I want)
Identify: tag message  (which also punches the file through but puts a SUSPECT 
alert in the subject

I can't figured out what has changed that has stopped the files from being 
reviewable by the Exchange Admins without being auto delivered to the user.

Thanks!

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist


---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

RE: Forefront Quarantine

[Charles A Ransom]

So...

What does it say under the Filter List now?   I'm interested 'cause I'm 
thinking about trying it out.

>>> McCready, Rob 10/7/2010 3:17 PM >>>
Nevermind Gurus, it appears to be working now.

Thanks anyway!



---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

RE: Forefront Quarantine

[McCready, Rob]

My Filter List has the list I created called "Potentially Harmful Files".  It 
contains stuff like

*.bat*
*.com*

Etc.

When I go under File and highlight my Filter List, I check the box for "All 
Types".
Under File Filter: it is set to Enabled.
Action: Delete: Remove Contents
General = Check the box to quarantine files.

When any files come in with a matching category, they are quarantined for 
review and I can release them manually if needed.



-Original Message-
From: Charles A Ransom [mailto:rans...@gao.gov] 
Sent: Thursday, October 07, 2010 3:21 PM
To: MS-Exchange Admin Issues
Subject: RE: Forefront Quarantine

So...

What does it say under the Filter List now?   I'm interested 'cause I'm 
thinking about trying it out.

>>> McCready, Rob 10/7/2010 3:17 PM >>>
Nevermind Gurus, it appears to be working now.

Thanks anyway!



---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist


---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

RE: Forefront Quarantine

[Don Andrews]

It still sounds like MS fails to believe that individuals will first think of 
renaming a file to get around filtering.

If I attempt to send test.exe through our solution it gets blocked - even if I 
rename the file to say, test.txt, zip it, rename the .zip extension to 
something.

I doubt if these filename (or type i.e. extension) filters will do that.

Just sayin

-Original Message-
From: McCready, Rob [mailto:rob.mccrea...@dplinc.com] 
Sent: Friday, October 08, 2010 10:02 AM
To: MS-Exchange Admin Issues
Subject: RE: Forefront Quarantine

My Filter List has the list I created called "Potentially Harmful Files".  It 
contains stuff like

*.bat*
*.com*

Etc.

When I go under File and highlight my Filter List, I check the box for "All 
Types".
Under File Filter: it is set to Enabled.
Action: Delete: Remove Contents
General = Check the box to quarantine files.

When any files come in with a matching category, they are quarantined for 
review and I can release them manually if needed.



-Original Message-
From: Charles A Ransom [mailto:rans...@gao.gov] 
Sent: Thursday, October 07, 2010 3:21 PM
To: MS-Exchange Admin Issues
Subject: RE: Forefront Quarantine

So...

What does it say under the Filter List now?   I'm interested 'cause I'm 
thinking about trying it out.

>>> McCready, Rob 10/7/2010 3:17 PM >>>
Nevermind Gurus, it appears to be working now.

Thanks anyway!



---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist


---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist




---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

Re: Forefront numbers

[Joseph Heaton]

Sounds like 50% spam?  That's not too bad, really.  That's my guess anyway.

>>> Steve Hart  11/19/2010 11:21 AM >>>
We just cutover to a new Exchange server last night. The old server runs 
Forefront 10.2, the new server is running Forefront 2010. Both are Exchange 
2007 SP3.

The new Forefront interface has a lot more information. In the spam details 
screen, there's a field called "Messages Processed by Connection Filtering". It 
put me in a bit of a panic this morning, when it showed 9,932 messages 
processed and 9,521 Messages Blocked by DNS Block List. Our spam ratio might be 
high but that seemed impossible. I've reset the counters now it's showing 101 
processed and 100 blocked by the DNS block list. Farther down 1 message is 
blocked by SMTP filtering.

Answering the obvious question, we're getting email and no one is complaining 
of things not going through.

I'm guessing that these are poorly labeled numbers. Is "Messages processed by 
Connection Filtering" really a counter of only the blocked messages?



---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/ 
or send an email to listmana...@lyris.sunbeltsoftware.com 
with the body: unsubscribe exchangelist



---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

Re: Forefront numbers

[Sean Martin]

I agree with Joseph.

http://technet.microsoft.com/en-us/library/ee358897.aspx

- Sean

On Fri, Nov 19, 2010 at 10:31 AM, Joseph Heaton  wrote:

> Sounds like 50% spam?  That's not too bad, really.  That's my guess anyway.
>
> >>> Steve Hart  11/19/2010 11:21 AM >>>
>  We just cutover to a new Exchange server last night. The old server runs
> Forefront 10.2, the new server is running Forefront 2010. Both are Exchange
> 2007 SP3.
>
> The new Forefront interface has a lot more information. In the spam details
> screen, there's a field called "Messages Processed by Connection Filtering".
> It put me in a bit of a panic this morning, when it showed 9,932 messages
> processed and 9,521 Messages Blocked by DNS Block List. Our spam ratio might
> be high but that seemed impossible. I've reset the counters now it's showing
> 101 processed and 100 blocked by the DNS block list. Farther down 1 message
> is blocked by SMTP filtering.
>
> Answering the obvious question, we're getting email and no one is
> complaining of things not going through.
>
> I'm guessing that these are poorly labeled numbers. Is "Messages processed
> by Connection Filtering" really a counter of only the blocked messages?
>
>
>
> ---
> To manage subscriptions click here:
> http://lyris.sunbelt-software.com/read/my_forums/
> or send an email to listmana...@lyris.sunbeltsoftware.com
> with the body: unsubscribe exchangelist
>
>
>
> ---
> To manage subscriptions click here:
> http://lyris.sunbelt-software.com/read/my_forums/
> or send an email to listmana...@lyris.sunbeltsoftware.com
> with the body: unsubscribe exchangelist
>
>

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

RE: Forefront numbers

[Campbell, Rob]

[PS] C:\>(9521/9932)*100
95.8618606524366

Almost 96% spam.

And I suspect that could be right.

-Original Message-
From: Joseph Heaton [mailto:jhea...@dfg.ca.gov] 
Sent: Friday, November 19, 2010 1:31 PM
To: MS-Exchange Admin Issues
Subject: Re: Forefront numbers

Sounds like 50% spam?  That's not too bad, really.  That's my guess anyway.

>>> Steve Hart  11/19/2010 11:21 AM >>>
We just cutover to a new Exchange server last night. The old server runs 
Forefront 10.2, the new server is running Forefront 2010. Both are Exchange 
2007 SP3.

The new Forefront interface has a lot more information. In the spam details 
screen, there's a field called "Messages Processed by Connection Filtering". It 
put me in a bit of a panic this morning, when it showed 9,932 messages 
processed and 9,521 Messages Blocked by DNS Block List. Our spam ratio might be 
high but that seemed impossible. I've reset the counters now it's showing 101 
processed and 100 blocked by the DNS block list. Farther down 1 message is 
blocked by SMTP filtering.

Answering the obvious question, we're getting email and no one is complaining 
of things not going through.

I'm guessing that these are poorly labeled numbers. Is "Messages processed by 
Connection Filtering" really a counter of only the blocked messages?



---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/ 
or send an email to listmana...@lyris.sunbeltsoftware.com 
with the body: unsubscribe exchangelist



---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist


**
Note: 
The information contained in this message may be privileged and confidential 
and 
protected from disclosure.  If the reader of this message is not the intended  
recipient, or an employee or agent responsible for delivering this message to  
the intended recipient, you are hereby notified that any dissemination,   
distribution or copying of this communication is strictly prohibited. If you  
have received this communication in error, please notify us immediately by  
replying to the message and deleting it from your computer. 
**



---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

RE: Forefront numbers

[Steve Hart]

By my initial assumptions, we had 9,932 total messages, of which 9,521 were 
blocked as spam. That meant only 411 messages getting through.

Now the numbers are showing 324 processed, 315 blocked by connection filtering 
and 9 blocked by SMTP filtering. I know that we're receiving emails, so 
everything isn't being blocked. The "processed" number seems to really be 
"total blocked".



Steve Hart

Network Administrator

503.491.4343 -Direct | 503.492.8160 - Fax

-Original Message-
From: Joseph Heaton [mailto:jhea...@dfg.ca.gov] 
Sent: Friday, November 19, 2010 11:31 AM
To: MS-Exchange Admin Issues
Subject: Re: Forefront numbers

Sounds like 50% spam?  That's not too bad, really.  That's my guess anyway.

>>> Steve Hart  11/19/2010 11:21 AM >>>
We just cutover to a new Exchange server last night. The old server runs 
Forefront 10.2, the new server is running Forefront 2010. Both are Exchange 
2007 SP3.

The new Forefront interface has a lot more information. In the spam details 
screen, there's a field called "Messages Processed by Connection Filtering". It 
put me in a bit of a panic this morning, when it showed 9,932 messages 
processed and 9,521 Messages Blocked by DNS Block List. Our spam ratio might be 
high but that seemed impossible. I've reset the counters now it's showing 101 
processed and 100 blocked by the DNS block list. Farther down 1 message is 
blocked by SMTP filtering.

Answering the obvious question, we're getting email and no one is complaining 
of things not going through.

I'm guessing that these are poorly labeled numbers. Is "Messages processed by 
Connection Filtering" really a counter of only the blocked messages?



---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/ 
or send an email to listmana...@lyris.sunbeltsoftware.com 
with the body: unsubscribe exchangelist



---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist


---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

RE: Forefront numbers

[Joseph Heaton]

After following the link from Sean, I agree with you.  The stats you're looking 
at are spam messages, not total messages coming in.  So, first number = total 
spam messages, then it breaks that down into which filter type caught it.

Maybe there's a different section that would show total incoming mail, and 
break it down into good vs. spam.

>>> Steve Hart  11/19/2010 11:36 AM >>>
By my initial assumptions, we had 9,932 total messages, of which 9,521 were 
blocked as spam. That meant only 411 messages getting through.

Now the numbers are showing 324 processed, 315 blocked by connection filtering 
and 9 blocked by SMTP filtering. I know that we're receiving emails, so 
everything isn't being blocked. The "processed" number seems to really be 
"total blocked".



Steve Hart

Network Administrator

503.491.4343 -Direct | 503.492.8160 - Fax

-Original Message-
From: Joseph Heaton [mailto:jhea...@dfg.ca.gov] 
Sent: Friday, November 19, 2010 11:31 AM
To: MS-Exchange Admin Issues
Subject: Re: Forefront numbers

Sounds like 50% spam?  That's not too bad, really.  That's my guess anyway.

>>> Steve Hart  11/19/2010 11:21 AM >>>
We just cutover to a new Exchange server last night. The old server runs 
Forefront 10.2, the new server is running Forefront 2010. Both are Exchange 
2007 SP3.

The new Forefront interface has a lot more information. In the spam details 
screen, there's a field called "Messages Processed by Connection Filtering". It 
put me in a bit of a panic this morning, when it showed 9,932 messages 
processed and 9,521 Messages Blocked by DNS Block List. Our spam ratio might be 
high but that seemed impossible. I've reset the counters now it's showing 101 
processed and 100 blocked by the DNS block list. Farther down 1 message is 
blocked by SMTP filtering.

Answering the obvious question, we're getting email and no one is complaining 
of things not going through.

I'm guessing that these are poorly labeled numbers. Is "Messages processed by 
Connection Filtering" really a counter of only the blocked messages?



---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/ 
or send an email to listmana...@lyris.sunbeltsoftware.com 
with the body: unsubscribe exchangelist



---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/ 
or send an email to listmana...@lyris.sunbeltsoftware.com 
with the body: unsubscribe exchangelist


---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/ 
or send an email to listmana...@lyris.sunbeltsoftware.com 
with the body: unsubscribe exchangelist





---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

RE: Forefront FSCUtility

[Michael B. Smith]

Yes.

From: chipsh...@comcast.net [mailto:chipsh...@comcast.net]
Sent: Thursday, November 29, 2012 2:17 PM
To: MS-Exchange Admin Issues
Subject: Forefront FSCUtility


Does "FSCUtility /disable" disable Forefront permanently until the /enable 
switch is run? To phrase it another way, if I disable Forefront and reboot the 
server does it stay disabled? Thanks.

Steve

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

RE: Forefront/antispamagent question

[Steve Hart]

If I remember correctly (admittedly not always the case), Forefront 2010 
leverages the Exchange Anti-Spam tools for a portion of its work. I think that 
includes whitelists and blacklists. When I installed Forefront on a server with 
the Anti-Spam agents previously installed, it brought many of my settings 
forward and just presented a much prettier interface with more reporting data.

One surprise was that it turned off the Exchange content filtering and utilized 
its own. Created a big problem because that is an "organization" level setting 
and we had other Exchange servers suddenly with no Content Filtering at all.





Steve Hart
Network Administrator
503.491.4343 -Direct | 503.492.8160 - Fax

From: Rhett Thatcher [mailto:rthatc...@stlawu.edu]
Sent: Thursday, February 03, 2011 1:36 PM
To: MS-Exchange Admin Issues
Subject: Forefront/antispamagent question

I am currently experimenting in a test environment with Forefront Protection 
2010 for Exchange and have it installed on some Hub Transport servers. I have 
been testing safe sender and block lists from user mailboxes and FPE is not 
using them.

I ran across some info on adding the AntiSpamAgent to the Hub Transport roles 
and with this enabled the lists are now working. It seems to me that FPE should 
do this without having to install the AntiSpamAgent on the Hub Transport 
server, is there a setting I am missing to accomplish that, or is it only 
accomplished by the AntiSpamAgent?

I wonder because in the technet docs I have read relating to safe senders it 
only mentions the Edge server role as filtering based on those lists. We have 
postfix at our perimeter and do not plan to use Edge Transport any time soon 
and minus this have no other need for the AntiSpamAgent on the Hub Transport.

Rhett Thatcher
Information Technology
St. Lawrence University
Madill Hall
Canton, NY 13617
Phone: 315-229-5413


---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

RE: Forefront roadmap changes

[May, Jeff]

Any ideas on the replacement, or maybe I am missing something, for the TMG???  
We are currently looking at this for our OWA and Outlook Anywhere publishing 
and moving off our old ISA systems.

Jeff A. May, MobileIron Certified SA and Security Specialist
Client Server Engineer IV
Client Server Engineering/IT Messaging Services
Mail Code  -  100-99-08-20
E-Mail - j...@bbandt.com

-Original Message-
From: Michael B. Smith [mailto:mich...@smithcons.com] 
Sent: Wednesday, September 12, 2012 2:19 PM
To: MS-Exchange Admin Issues
Subject: Forefront roadmap changes

FYI.

http://blogs.technet.com/b/server-cloud/archive/2012/09/12/important-changes-to-forefront-product-roadmaps.aspx

Regards,

Michael B. Smith
Consultant and Exchange MVP
http://TheEssentialExchange.com


---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist


---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

RE: Forefront roadmap changes

[Celone, Mike]

I know that UAG can also be used but that comes with much more expensive 
licensing than TMG.  TMG was licensed by CPU where UAG is CAL based.  It would 
be much more expensive to license UAG over TMG for just about everyone.

Mike

This message (including any attachments) contains confidential information 
intended for a specific individual and purpose, and is protected by law. If you 
are not the intended recipient, you should delete this message. Any disclosure, 
copying, or distribution of this message, or the taking of any action based on 
it, is strictly prohibited without the prior consent of its author.

-Original Message-
From: May, Jeff [mailto:j...@bbandt.com]
Sent: Wednesday, September 12, 2012 2:36 PM
To: MS-Exchange Admin Issues
Subject: RE: Forefront roadmap changes

Any ideas on the replacement, or maybe I am missing something, for the TMG???  
We are currently looking at this for our OWA and Outlook Anywhere publishing 
and moving off our old ISA systems.

Jeff A. May, MobileIron Certified SA and Security Specialist Client Server 
Engineer IV Client Server Engineering/IT Messaging Services Mail Code  -  
100-99-08-20 E-Mail - j...@bbandt.com

-Original Message-
From: Michael B. Smith [mailto:mich...@smithcons.com]
Sent: Wednesday, September 12, 2012 2:19 PM
To: MS-Exchange Admin Issues
Subject: Forefront roadmap changes

FYI.

http://blogs.technet.com/b/server-cloud/archive/2012/09/12/important-changes-to-forefront-product-roadmaps.aspx

Regards,

Michael B. Smith
Consultant and Exchange MVP
http://TheEssentialExchange.com


---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist


---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist


---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

RE: Forefront roadmap changes

[Michael B. Smith]

The official word is UAG.

However, for Exchange, UAG is missing some desirable functionality. I expect 
that it will grow that functionality, but it's not currently ideal.

Other devices incorporating that functionality are far more expensive.

-Original Message-
From: Celone, Mike [mailto:mike.cel...@rfsworld.com] 
Sent: Wednesday, September 12, 2012 2:49 PM
To: MS-Exchange Admin Issues
Subject: RE: Forefront roadmap changes

I know that UAG can also be used but that comes with much more expensive 
licensing than TMG.  TMG was licensed by CPU where UAG is CAL based.  It would 
be much more expensive to license UAG over TMG for just about everyone.

Mike

This message (including any attachments) contains confidential information 
intended for a specific individual and purpose, and is protected by law. If you 
are not the intended recipient, you should delete this message. Any disclosure, 
copying, or distribution of this message, or the taking of any action based on 
it, is strictly prohibited without the prior consent of its author.

-Original Message-
From: May, Jeff [mailto:j...@bbandt.com]
Sent: Wednesday, September 12, 2012 2:36 PM
To: MS-Exchange Admin Issues
Subject: RE: Forefront roadmap changes

Any ideas on the replacement, or maybe I am missing something, for the TMG???  
We are currently looking at this for our OWA and Outlook Anywhere publishing 
and moving off our old ISA systems.

Jeff A. May, MobileIron Certified SA and Security Specialist Client Server 
Engineer IV Client Server Engineering/IT Messaging Services Mail Code  -  
100-99-08-20 E-Mail - j...@bbandt.com

-Original Message-
From: Michael B. Smith [mailto:mich...@smithcons.com]
Sent: Wednesday, September 12, 2012 2:19 PM
To: MS-Exchange Admin Issues
Subject: Forefront roadmap changes

FYI.

http://blogs.technet.com/b/server-cloud/archive/2012/09/12/important-changes-to-forefront-product-roadmaps.aspx

Regards,

Michael B. Smith
Consultant and Exchange MVP
http://TheEssentialExchange.com


---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist


---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist


---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist


---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

Re: Forefront roadmap changes

[Adm]

We upgraded from ISA to TMG just before our Exch 2003 to 2010 migration.
Picked TMG because we did not want to pay for the UAG CALs

YMMV

On Wed, Sep 12, 2012 at 3:05 PM, Michael B. Smith wrote:

> The official word is UAG.
>
> However, for Exchange, UAG is missing some desirable functionality. I
> expect that it will grow that functionality, but it's not currently ideal.
>
> Other devices incorporating that functionality are far more expensive.
>
> -Original Message-
> From: Celone, Mike [mailto:mike.cel...@rfsworld.com]
> Sent: Wednesday, September 12, 2012 2:49 PM
> To: MS-Exchange Admin Issues
> Subject: RE: Forefront roadmap changes
>
> I know that UAG can also be used but that comes with much more expensive
> licensing than TMG.  TMG was licensed by CPU where UAG is CAL based.  It
> would be much more expensive to license UAG over TMG for just about
> everyone.
>
> Mike
>
> This message (including any attachments) contains confidential information
> intended for a specific individual and purpose, and is protected by law. If
> you are not the intended recipient, you should delete this message. Any
> disclosure, copying, or distribution of this message, or the taking of any
> action based on it, is strictly prohibited without the prior consent of its
> author.
>
> -Original Message-
> From: May, Jeff [mailto:j...@bbandt.com]
> Sent: Wednesday, September 12, 2012 2:36 PM
> To: MS-Exchange Admin Issues
> Subject: RE: Forefront roadmap changes
>
> Any ideas on the replacement, or maybe I am missing something, for the
> TMG???  We are currently looking at this for our OWA and Outlook Anywhere
> publishing and moving off our old ISA systems.
>
> Jeff A. May, MobileIron Certified SA and Security Specialist Client Server
> Engineer IV Client Server Engineering/IT Messaging Services Mail Code  -
>  100-99-08-20 E-Mail - j...@bbandt.com
>
> -Original Message-
> From: Michael B. Smith [mailto:mich...@smithcons.com]
> Sent: Wednesday, September 12, 2012 2:19 PM
> To: MS-Exchange Admin Issues
> Subject: Forefront roadmap changes
>
> FYI.
>
>
> http://blogs.technet.com/b/server-cloud/archive/2012/09/12/important-changes-to-forefront-product-roadmaps.aspx
>
> Regards,
>
> Michael B. Smith
> Consultant and Exchange MVP
> http://TheEssentialExchange.com
>
>
> ---
> To manage subscriptions click here:
> http://lyris.sunbelt-software.com/read/my_forums/
> or send an email to listmana...@lyris.sunbeltsoftware.com
> with the body: unsubscribe exchangelist
>
>
> ---
> To manage subscriptions click here:
> http://lyris.sunbelt-software.com/read/my_forums/
> or send an email to listmana...@lyris.sunbeltsoftware.com
> with the body: unsubscribe exchangelist
>
>
> ---
> To manage subscriptions click here:
> http://lyris.sunbelt-software.com/read/my_forums/
> or send an email to listmana...@lyris.sunbeltsoftware.com
> with the body: unsubscribe exchangelist
>
>
> ---
> To manage subscriptions click here:
> http://lyris.sunbelt-software.com/read/my_forums/
> or send an email to listmana...@lyris.sunbeltsoftware.com
> with the body: unsubscribe exchangelist
>
>


-- 
smsadm

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

RE: Forefront roadmap changes

[Heaton, Joseph@DFG]

You still have support (extended, anyway) for TMG until 2020, so I wouldn't let 
that sway your decision away from TMG.

Joe Heaton
ITB - Enterprise Server Support

-Original Message-
From: Jeff May [mailto:j...@bbandt.com] 
Sent: Wednesday, September 12, 2012 11:36 AM
To: Heaton, Joseph@DFG; MS-Exchange Admin Issues
Subject: RE: Forefront roadmap changes

Any ideas on the replacement, or maybe I am missing something, for the TMG???  
We are currently looking at this for our OWA and Outlook Anywhere publishing 
and moving off our old ISA systems.

Jeff A. May, MobileIron Certified SA and Security Specialist Client Server 
Engineer IV Client Server Engineering/IT Messaging Services Mail Code  -  
100-99-08-20 E-Mail - j...@bbandt.com

-Original Message-
From: Michael B. Smith [mailto:mich...@smithcons.com]
Sent: Wednesday, September 12, 2012 2:19 PM
To: MS-Exchange Admin Issues
Subject: Forefront roadmap changes

FYI.

http://blogs.technet.com/b/server-cloud/archive/2012/09/12/important-changes-to-forefront-product-roadmaps.aspx

Regards,

Michael B. Smith
Consultant and Exchange MVP
http://TheEssentialExchange.com


---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist


---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist




---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

RE: Forefront roadmap changes

[Jason Benway]

It sounds like FOPE is just getting renamed? But will still be a service moving 
forward?

We use it to front our onsite Exchange 2010.

jb

-Original Message-
From: Heaton, Joseph@DFG [mailto:jhea...@dfg.ca.gov] 
Sent: Thursday, September 13, 2012 11:56 AM
To: MS-Exchange Admin Issues
Subject: RE: Forefront roadmap changes

You still have support (extended, anyway) for TMG until 2020, so I wouldn't let 
that sway your decision away from TMG.

Joe Heaton
ITB - Enterprise Server Support

-Original Message-
From: Jeff May [mailto:j...@bbandt.com] 
Sent: Wednesday, September 12, 2012 11:36 AM
To: Heaton, Joseph@DFG; MS-Exchange Admin Issues
Subject: RE: Forefront roadmap changes

Any ideas on the replacement, or maybe I am missing something, for the TMG???  
We are currently looking at this for our OWA and Outlook Anywhere publishing 
and moving off our old ISA systems.

Jeff A. May, MobileIron Certified SA and Security Specialist Client Server 
Engineer IV Client Server Engineering/IT Messaging Services Mail Code  -  
100-99-08-20 E-Mail - j...@bbandt.com

-Original Message-
From: Michael B. Smith [mailto:mich...@smithcons.com]
Sent: Wednesday, September 12, 2012 2:19 PM
To: MS-Exchange Admin Issues
Subject: Forefront roadmap changes

FYI.

http://blogs.technet.com/b/server-cloud/archive/2012/09/12/important-changes-to-forefront-product-roadmaps.aspx

Regards,

Michael B. Smith
Consultant and Exchange MVP
http://TheEssentialExchange.com


---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist


---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist




---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist



---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

Re: Forefront roadmap changes

[Steve Goodman]

Yep, just looks like a rename to bring it in line with the Office 365/Exchange 
Online line-up

On 13 Sep 2012, at 17:05, "Jason Benway"  wrote:

> It sounds like FOPE is just getting renamed? But will still be a service 
> moving forward?
> 
> We use it to front our onsite Exchange 2010.
> 
> jb
> 
> -Original Message-
> From: Heaton, Joseph@DFG [mailto:jhea...@dfg.ca.gov] 
> Sent: Thursday, September 13, 2012 11:56 AM
> To: MS-Exchange Admin Issues
> Subject: RE: Forefront roadmap changes
> 
> You still have support (extended, anyway) for TMG until 2020, so I wouldn't 
> let that sway your decision away from TMG.
> 
> Joe Heaton
> ITB - Enterprise Server Support
> 
> -Original Message-
> From: Jeff May [mailto:j...@bbandt.com] 
> Sent: Wednesday, September 12, 2012 11:36 AM
> To: Heaton, Joseph@DFG; MS-Exchange Admin Issues
> Subject: RE: Forefront roadmap changes
> 
> Any ideas on the replacement, or maybe I am missing something, for the TMG??? 
>  We are currently looking at this for our OWA and Outlook Anywhere publishing 
> and moving off our old ISA systems.
> 
> Jeff A. May, MobileIron Certified SA and Security Specialist Client Server 
> Engineer IV Client Server Engineering/IT Messaging Services Mail Code  -  
> 100-99-08-20 E-Mail - j...@bbandt.com
> 
> -Original Message-
> From: Michael B. Smith [mailto:mich...@smithcons.com]
> Sent: Wednesday, September 12, 2012 2:19 PM
> To: MS-Exchange Admin Issues
> Subject: Forefront roadmap changes
> 
> FYI.
> 
> http://blogs.technet.com/b/server-cloud/archive/2012/09/12/important-changes-to-forefront-product-roadmaps.aspx
> 
> Regards,
> 
> Michael B. Smith
> Consultant and Exchange MVP
> http://TheEssentialExchange.com
> 
> 
> ---
> To manage subscriptions click here: 
> http://lyris.sunbelt-software.com/read/my_forums/
> or send an email to listmana...@lyris.sunbeltsoftware.com
> with the body: unsubscribe exchangelist
> 
> 
> ---
> To manage subscriptions click here: 
> http://lyris.sunbelt-software.com/read/my_forums/
> or send an email to listmana...@lyris.sunbeltsoftware.com
> with the body: unsubscribe exchangelist
> 
> 
> 
> 
> ---
> To manage subscriptions click here: 
> http://lyris.sunbelt-software.com/read/my_forums/
> or send an email to listmana...@lyris.sunbeltsoftware.com
> with the body: unsubscribe exchangelist
> 
> 
> 
> ---
> To manage subscriptions click here: 
> http://lyris.sunbelt-software.com/read/my_forums/
> or send an email to listmana...@lyris.sunbeltsoftware.com
> with the body: unsubscribe exchangelist
> 
> 


---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

Re: Forefront roadmap changes

[Steve Goodman]

Yep, though might need to act fast to purchase it if you were going to. I'd 
suggest speaking to your VL reseller to find out what the situation will be (ie 
is TMG going to be available via EA/VL etc after Dec 1st)

Steve

On 13 Sep 2012, at 17:00, "Heaton, Joseph@DFG"  wrote:

> You still have support (extended, anyway) for TMG until 2020, so I wouldn't 
> let that sway your decision away from TMG.
> 
> Joe Heaton
> ITB - Enterprise Server Support
> 
> -Original Message-
> From: Jeff May [mailto:j...@bbandt.com] 
> Sent: Wednesday, September 12, 2012 11:36 AM
> To: Heaton, Joseph@DFG; MS-Exchange Admin Issues
> Subject: RE: Forefront roadmap changes
> 
> Any ideas on the replacement, or maybe I am missing something, for the TMG??? 
>  We are currently looking at this for our OWA and Outlook Anywhere publishing 
> and moving off our old ISA systems.
> 
> Jeff A. May, MobileIron Certified SA and Security Specialist Client Server 
> Engineer IV Client Server Engineering/IT Messaging Services Mail Code  -  
> 100-99-08-20 E-Mail - j...@bbandt.com
> 
> -Original Message-
> From: Michael B. Smith [mailto:mich...@smithcons.com]
> Sent: Wednesday, September 12, 2012 2:19 PM
> To: MS-Exchange Admin Issues
> Subject: Forefront roadmap changes
> 
> FYI.
> 
> http://blogs.technet.com/b/server-cloud/archive/2012/09/12/important-changes-to-forefront-product-roadmaps.aspx
> 
> Regards,
> 
> Michael B. Smith
> Consultant and Exchange MVP
> http://TheEssentialExchange.com
> 
> 
> ---
> To manage subscriptions click here: 
> http://lyris.sunbelt-software.com/read/my_forums/
> or send an email to listmana...@lyris.sunbeltsoftware.com
> with the body: unsubscribe exchangelist
> 
> 
> ---
> To manage subscriptions click here: 
> http://lyris.sunbelt-software.com/read/my_forums/
> or send an email to listmana...@lyris.sunbeltsoftware.com
> with the body: unsubscribe exchangelist
> 
> 
> 
> 
> ---
> To manage subscriptions click here: 
> http://lyris.sunbelt-software.com/read/my_forums/
> or send an email to listmana...@lyris.sunbeltsoftware.com
> with the body: unsubscribe exchangelist
> 
> 


---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

RE: Forefront on 2007 SP3

[Michael B. Smith]

[PS] C:\Scripts>get-antispamupdates -id $env:computername

RunspaceId  : b18ce448-484c-4b24-9b46-72042cfc076f
UpdateMode  : Automatic
LatestContentFilterVersion  : 3.3.8921.1150
SpamSignatureUpdatesEnabled : True
LatestSpamSignatureVersion  : 3.3.4604.600
IPReputationUpdatesEnabled  : False
LatestIPReputationVersion   : 3.3.4604.001
MicrosoftUpdate : Configured

If that isn't what you mean, you need to be a little more specific in your 
question...there are LOTS of different Forefronts these days...

Regards,

Michael B. Smith
Consultant and Exchange MVP
http://TheEssentialExchange.com

From: Steve Hart [mailto:sh...@wrightbg.com]
Sent: Friday, August 20, 2010 4:30 PM
To: MS-Exchange Admin Issues
Subject: Forefront on 2007 SP3

Another Google search is failing me today.  TGIF!

What version of Forefront is current for Exchange 2007 SP3?

RE: Forefront on 2007 SP3

[Steve Hart]

Good point!!

Microsoft Forefront Security for Exchange Server

We're currently running SP2 on our Exchange 2007 SP2 boxes.  I also see that 
Forefront Protection 2010 for Exchange Server is an available licensed 
download, but I'm unclear on whether that works for E2007 or is exclusively for 
E2010.

Steve Hart
Network Administrator
503.491.4343 -Direct | 503.492.8160 - Fax

From: Michael B. Smith [mailto:mich...@smithcons.com]
Sent: Friday, August 20, 2010 1:36 PM
To: MS-Exchange Admin Issues
Subject: RE: Forefront on 2007 SP3

[PS] C:\Scripts>get-antispamupdates -id $env:computername

RunspaceId  : b18ce448-484c-4b24-9b46-72042cfc076f
UpdateMode  : Automatic
LatestContentFilterVersion  : 3.3.8921.1150
SpamSignatureUpdatesEnabled : True
LatestSpamSignatureVersion  : 3.3.4604.600
IPReputationUpdatesEnabled  : False
LatestIPReputationVersion   : 3.3.4604.001
MicrosoftUpdate : Configured

If that isn't what you mean, you need to be a little more specific in your 
question...there are LOTS of different Forefronts these days...

Regards,

Michael B. Smith
Consultant and Exchange MVP
http://TheEssentialExchange.com

From: Steve Hart [mailto:sh...@wrightbg.com]
Sent: Friday, August 20, 2010 4:30 PM
To: MS-Exchange Admin Issues
Subject: Forefront on 2007 SP3

Another Google search is failing me today.  TGIF!

What version of Forefront is current for Exchange 2007 SP3?

RE: Forefront on 2007 SP3

[Michael B. Smith]

As far as I can see, Forefront 2007 SP2 is current and what you need to stay 
with.

Regards,

Michael B. Smith
Consultant and Exchange MVP
http://TheEssentialExchange.com

From: Steve Hart [mailto:sh...@wrightbg.com]
Sent: Friday, August 20, 2010 4:45 PM
To: MS-Exchange Admin Issues
Subject: RE: Forefront on 2007 SP3

Good point!!

Microsoft Forefront Security for Exchange Server

We're currently running SP2 on our Exchange 2007 SP2 boxes.  I also see that 
Forefront Protection 2010 for Exchange Server is an available licensed 
download, but I'm unclear on whether that works for E2007 or is exclusively for 
E2010.

Steve Hart
Network Administrator
503.491.4343 -Direct | 503.492.8160 - Fax

From: Michael B. Smith [mailto:mich...@smithcons.com]
Sent: Friday, August 20, 2010 1:36 PM
To: MS-Exchange Admin Issues
Subject: RE: Forefront on 2007 SP3

[PS] C:\Scripts>get-antispamupdates -id $env:computername

RunspaceId  : b18ce448-484c-4b24-9b46-72042cfc076f
UpdateMode  : Automatic
LatestContentFilterVersion  : 3.3.8921.1150
SpamSignatureUpdatesEnabled : True
LatestSpamSignatureVersion  : 3.3.4604.600
IPReputationUpdatesEnabled  : False
LatestIPReputationVersion   : 3.3.4604.001
MicrosoftUpdate : Configured

If that isn't what you mean, you need to be a little more specific in your 
question...there are LOTS of different Forefronts these days...

Regards,

Michael B. Smith
Consultant and Exchange MVP
http://TheEssentialExchange.com

From: Steve Hart [mailto:sh...@wrightbg.com]
Sent: Friday, August 20, 2010 4:30 PM
To: MS-Exchange Admin Issues
Subject: Forefront on 2007 SP3

Another Google search is failing me today.  TGIF!

What version of Forefront is current for Exchange 2007 SP3?

RE: Forefront Security for Exchange 2007

[McCready, Rob]

Well, I know have Forefront setup to quarantine all .ZIP files, but it appears 
when I forward them on for review, they just disappear into never never land.

-Original Message-
From: McCready, Rob [mailto:[EMAIL PROTECTED]
Sent: Monday, October 06, 2008 10:09 AM
To: MS-Exchange Admin Issues
Subject: Forefront Security for Exchange 2007

We applied Forefront Security for Exchange 2007 SP1 over the weekend.  It 
appears some of our settings may have been modified/change back to default.  We 
used to quarantine all .ZIP files for review before releasing them.  Forefront 
would quarantine them, and we could forward the entire original messages onto 
ourselves (if we so desire), and save try saving the file to the C:\ drive, 
using the local virus software as an extra layer of protection.

However, after installing Forefront SP1, no matter what I select, the emails 
tend to go straight through.  I've changed the .ZIP filter between...

Action - Purge: Eliminate
Action - Identify: tag message
Action - Delete: remove contents
Action - Skip: detect only

And selected "Quarantine Files".

Has anybody else ran into this issue?  We want to be able to quarantine all zip 
files coming into the company.

Thanks.

Rob

~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~
~ http://www.sunbeltsoftware.com/Ninja~

~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~
~ http://www.sunbeltsoftware.com/Ninja~

RE: Forefront Security for Exchange Capacity Planner

[Bill Lambert]

Thanks for the tip, Tom!

 

Bill Lambert

Concuity

847-941-9206

 

From: Thomas W Shinder [mailto:tshin...@tacteam.net] 
Sent: Friday, April 17, 2009 11:18 AM
To: MS-Exchange Admin Issues
Subject: Forefront Security for Exchange Capacity Planner

 

Just released today:

 

http://blogs.windowsecurity.com/shinder/2009/04/17/forefront-security-fo
r-exchange-server-sp1-capacity-planning-tool/

 

Tom

 



TOM SHINDER   |   Sr. Consultant/Technical Writer 
206.443.1117   |   shin...@prowesscorp.com


5701 Sixth Avenue South   |   Seattle, WA 98108  
PROWESS   |   WWW.PROWESSCORP.COM  



   

 

 


~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~
~ http://www.sunbeltsoftware.com/Ninja~<>

RE: Forefront Security for Exchange Capacity Planner

[Thomas W Shinder]

You bet! :)

 



TOM SHINDER   |   Sr. Consultant/Technical Writer 
206.443.1117   |   shin...@prowesscorp.com


5701 Sixth Avenue South   |   Seattle, WA 98108  
PROWESS   |   WWW.PROWESSCORP.COM <http://www.prowesscorp.com/> 



  <http://www.windows.com/> 

 

From: Bill Lambert [mailto:blamb...@concuity.com] 
Sent: Friday, April 17, 2009 11:33 AM
To: MS-Exchange Admin Issues
Subject: RE: Forefront Security for Exchange Capacity Planner

 

Thanks for the tip, Tom!

 

Bill Lambert

Concuity

847-941-9206

 

From: Thomas W Shinder [mailto:tshin...@tacteam.net] 
Sent: Friday, April 17, 2009 11:18 AM
To: MS-Exchange Admin Issues
Subject: Forefront Security for Exchange Capacity Planner

 

Just released today:

 

http://blogs.windowsecurity.com/shinder/2009/04/17/forefront-security-fo
r-exchange-server-sp1-capacity-planning-tool/

 

Tom

 



TOM SHINDER   |   Sr. Consultant/Technical Writer 
206.443.1117   |   shin...@prowesscorp.com


5701 Sixth Avenue South   |   Seattle, WA 98108  
PROWESS   |   WWW.PROWESSCORP.COM <http://www.prowesscorp.com/> 



 <http://www.windows.com/> 

 

 

 


~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~
~ http://www.sunbeltsoftware.com/Ninja~<>

RE: Forefront Sophos and CA Vet gone.

[Exchange (Sunbelt)]

Forefront in general is annoying.

From: McCready, Rob [mailto:rob.mccrea...@dplinc.com]
Sent: Monday, December 21, 2009 9:40 AM
To: MS-Exchange Admin Issues
Subject: Forefront Sophos and CA Vet gone.

I recently applied Forefront SP2 on Exchange 2007.  Ever since then, I get 
multiple alerts every morning at 2:00 am saying…..


The Sophos Virus Detection Engine scan engine is now obsolete and no longer 
supported. Updates are no longer available for this engine, and therefore the 
update check for this engine has been disabled.  Please review the scan engines 
chosen for your scan jobs and make another selection to ensure up-to-date 
protection. For more information, see 
http://go.microsoft.com/fwlink/?LinkId=152864


The CA Vet scan engine is now obsolete and no longer supported. Updates are no 
longer available for this engine, and therefore the update check for this 
engine has been disabled.  Please review the scan engines chosen for your scan 
jobs and make another selection to ensure up-to-date protection. For more 
information, see http://go.microsoft.com/fwlink/?LinkId=152864





I have six Exchange servers, and I’ve disabled CA VET and Sophos on every one 
of them, but I continue to get these alerts every morning at 2:00 AM.  Annoying.

Is anybody else having this issue?

Thanks!

Rob

RE: Forefront Sophos and CA Vet gone.

[Rimmel, Carl]

Yes!  We get them from just one of the servers that we applied SP2 on and they 
are from Sophos and AhnLab.  We have rebooted, re-enabled and re-disabled and 
still get them.

From: McCready, Rob [mailto:rob.mccrea...@dplinc.com]
Sent: Monday, December 21, 2009 8:39 AM
To: MS-Exchange Admin Issues
Subject: Forefront Sophos and CA Vet gone.

I recently applied Forefront SP2 on Exchange 2007.  Ever since then, I get 
multiple alerts every morning at 2:00 am saying…..


The Sophos Virus Detection Engine scan engine is now obsolete and no longer 
supported. Updates are no longer available for this engine, and therefore the 
update check for this engine has been disabled.  Please review the scan engines 
chosen for your scan jobs and make another selection to ensure up-to-date 
protection. For more information, see 
http://go.microsoft.com/fwlink/?LinkId=152864


The CA Vet scan engine is now obsolete and no longer supported. Updates are no 
longer available for this engine, and therefore the update check for this 
engine has been disabled.  Please review the scan engines chosen for your scan 
jobs and make another selection to ensure up-to-date protection. For more 
information, see http://go.microsoft.com/fwlink/?LinkId=152864





I have six Exchange servers, and I’ve disabled CA VET and Sophos on every one 
of them, but I continue to get these alerts every morning at 2:00 AM.  Annoying.

Is anybody else having this issue?

Thanks!

Rob


==
CONFIDENTIALITY NOTICE: This email contains information from the sender that 
may be CONFIDENTIAL, LEGALLY PRIVILEGED, PROPRIETARY or otherwise protected 
from disclosure. This email is intended for use only by the person or entity 
to whom it is addressed. If you are not the intended recipient, any use, 
disclosure, copying, distribution, printing, or any action taken in reliance 
on the contents of this email, is strictly prohibited. If you received this 
email in error, please contact the sending party by reply email, delete the 
email from your computer system and shred any paper copies.
 
Note to Patients: There are a number of risks you should consider before using 
e-mail to communicate with us. See our Privacy Policy and Henry Ford My Health 
at www.henryford.com for more detailed information. If you do not believe that 
our policy gives you the privacy and security protection you need, do not send 
e-mail or Internet communications to us.
==

RE: Forefront Sophos and CA Vet gone.

[McCready, Rob]

Well prepare to get more of them once you apply it to your other servers.  HA 
HA!

So far, I’ve heard of no solution to this issue, but if I do, I’ll be sure to 
post.

From: Rimmel, Carl [mailto:crimm...@hfhs.org]
Sent: Tuesday, December 22, 2009 10:09 AM
To: MS-Exchange Admin Issues
Subject: RE: Forefront Sophos and CA Vet gone.

Yes!  We get them from just one of the servers that we applied SP2 on and they 
are from Sophos and AhnLab.  We have rebooted, re-enabled and re-disabled and 
still get them.

From: McCready, Rob [mailto:rob.mccrea...@dplinc.com]
Sent: Monday, December 21, 2009 8:39 AM
To: MS-Exchange Admin Issues
Subject: Forefront Sophos and CA Vet gone.

I recently applied Forefront SP2 on Exchange 2007.  Ever since then, I get 
multiple alerts every morning at 2:00 am saying…..


The Sophos Virus Detection Engine scan engine is now obsolete and no longer 
supported. Updates are no longer available for this engine, and therefore the 
update check for this engine has been disabled.  Please review the scan engines 
chosen for your scan jobs and make another selection to ensure up-to-date 
protection. For more information, see 
http://go.microsoft.com/fwlink/?LinkId=152864


The CA Vet scan engine is now obsolete and no longer supported. Updates are no 
longer available for this engine, and therefore the update check for this 
engine has been disabled.  Please review the scan engines chosen for your scan 
jobs and make another selection to ensure up-to-date protection. For more 
information, see http://go.microsoft.com/fwlink/?LinkId=152864





I have six Exchange servers, and I’ve disabled CA VET and Sophos on every one 
of them, but I continue to get these alerts every morning at 2:00 AM.  Annoying.

Is anybody else having this issue?

Thanks!

Rob


==

CONFIDENTIALITY NOTICE: This email contains information from the sender that

may be CONFIDENTIAL, LEGALLY PRIVILEGED, PROPRIETARY or otherwise protected

from disclosure. This email is intended for use only by the person or entity

to whom it is addressed. If you are not the intended recipient, any use,

disclosure, copying, distribution, printing, or any action taken in reliance

on the contents of this email, is strictly prohibited. If you received this

email in error, please contact the sending party by reply email, delete the

email from your computer system and shred any paper copies.



Note to Patients: There are a number of risks you should consider before using

e-mail to communicate with us. See our Privacy Policy and Henry Ford My Health

at www.henryford.com for more detailed information. If you do not believe that

our policy gives you the privacy and security protection you need, do not send

e-mail or Internet communications to us.

==

RE: Forefront Sophos and CA Vet gone.

[Rimmel, Carl]

Arghh… I was afraid of that.  If I find anything I will post it too.

From: McCready, Rob [mailto:rob.mccrea...@dplinc.com]
Sent: Tuesday, December 22, 2009 10:20 AM
To: MS-Exchange Admin Issues
Subject: RE: Forefront Sophos and CA Vet gone.

Well prepare to get more of them once you apply it to your other servers.  HA 
HA!

So far, I’ve heard of no solution to this issue, but if I do, I’ll be sure to 
post.

From: Rimmel, Carl [mailto:crimm...@hfhs.org]
Sent: Tuesday, December 22, 2009 10:09 AM
To: MS-Exchange Admin Issues
Subject: RE: Forefront Sophos and CA Vet gone.

Yes!  We get them from just one of the servers that we applied SP2 on and they 
are from Sophos and AhnLab.  We have rebooted, re-enabled and re-disabled and 
still get them.

From: McCready, Rob [mailto:rob.mccrea...@dplinc.com]
Sent: Monday, December 21, 2009 8:39 AM
To: MS-Exchange Admin Issues
Subject: Forefront Sophos and CA Vet gone.

I recently applied Forefront SP2 on Exchange 2007.  Ever since then, I get 
multiple alerts every morning at 2:00 am saying…..


The Sophos Virus Detection Engine scan engine is now obsolete and no longer 
supported. Updates are no longer available for this engine, and therefore the 
update check for this engine has been disabled.  Please review the scan engines 
chosen for your scan jobs and make another selection to ensure up-to-date 
protection. For more information, see 
http://go.microsoft.com/fwlink/?LinkId=152864


The CA Vet scan engine is now obsolete and no longer supported. Updates are no 
longer available for this engine, and therefore the update check for this 
engine has been disabled.  Please review the scan engines chosen for your scan 
jobs and make another selection to ensure up-to-date protection. For more 
information, see http://go.microsoft.com/fwlink/?LinkId=152864





I have six Exchange servers, and I’ve disabled CA VET and Sophos on every one 
of them, but I continue to get these alerts every morning at 2:00 AM.  Annoying.

Is anybody else having this issue?

Thanks!

Rob


==

CONFIDENTIALITY NOTICE: This email contains information from the sender that

may be CONFIDENTIAL, LEGALLY PRIVILEGED, PROPRIETARY or otherwise protected

from disclosure. This email is intended for use only by the person or entity

to whom it is addressed. If you are not the intended recipient, any use,

disclosure, copying, distribution, printing, or any action taken in reliance

on the contents of this email, is strictly prohibited. If you received this

email in error, please contact the sending party by reply email, delete the

email from your computer system and shred any paper copies.



Note to Patients: There are a number of risks you should consider before using

e-mail to communicate with us. See our Privacy Policy and Henry Ford My Health

at www.henryford.com for more detailed information. If you do not believe that

our policy gives you the privacy and security protection you need, do not send

e-mail or Internet communications to us.

==

==
CONFIDENTIALITY NOTICE: This email contains information from the sender that 
may be CONFIDENTIAL, LEGALLY PRIVILEGED, PROPRIETARY or otherwise protected 
from disclosure. This email is intended for use only by the person or entity 
to whom it is addressed. If you are not the intended recipient, any use, 
disclosure, copying, distribution, printing, or any action taken in reliance 
on the contents of this email, is strictly prohibited. If you received this 
email in error, please contact the sending party by reply email, delete the 
email from your computer system and shred any paper copies.
 
Note to Patients: There are a number of risks you should consider before using 
e-mail to communicate with us. See our Privacy Policy and Henry Ford My Health 
at www.henryford.com for more detailed information. If you do not believe that 
our policy gives you the privacy and security protection you need, do not send 
e-mail or Internet communications to us.
==

RE: Forefront Sophos and CA Vet gone.

[Senter, John]

Follow this:
http://blogs.technet.com/fss/archive/2009/11/16/how-do-i-disable-these-engine-end-of-life-notifications-i-am-receiving-from-antigen-and-forefront.aspx

It stopped the messages on all but my hub transport servers and as the doc 
states to call MS for resolution on them, just have not had time to do this.

From: Rimmel, Carl [mailto:crimm...@hfhs.org]
Sent: Tuesday, December 22, 2009 10:09 AM
To: MS-Exchange Admin Issues
Subject: RE: Forefront Sophos and CA Vet gone.

Yes!  We get them from just one of the servers that we applied SP2 on and they 
are from Sophos and AhnLab.  We have rebooted, re-enabled and re-disabled and 
still get them.

From: McCready, Rob [mailto:rob.mccrea...@dplinc.com]
Sent: Monday, December 21, 2009 8:39 AM
To: MS-Exchange Admin Issues
Subject: Forefront Sophos and CA Vet gone.

I recently applied Forefront SP2 on Exchange 2007.  Ever since then, I get 
multiple alerts every morning at 2:00 am saying…..


The Sophos Virus Detection Engine scan engine is now obsolete and no longer 
supported. Updates are no longer available for this engine, and therefore the 
update check for this engine has been disabled.  Please review the scan engines 
chosen for your scan jobs and make another selection to ensure up-to-date 
protection. For more information, see 
http://go.microsoft.com/fwlink/?LinkId=152864


The CA Vet scan engine is now obsolete and no longer supported. Updates are no 
longer available for this engine, and therefore the update check for this 
engine has been disabled.  Please review the scan engines chosen for your scan 
jobs and make another selection to ensure up-to-date protection. For more 
information, see http://go.microsoft.com/fwlink/?LinkId=152864





I have six Exchange servers, and I’ve disabled CA VET and Sophos on every one 
of them, but I continue to get these alerts every morning at 2:00 AM.  Annoying.

Is anybody else having this issue?

Thanks!

Rob


==

CONFIDENTIALITY NOTICE: This email contains information from the sender that

may be CONFIDENTIAL, LEGALLY PRIVILEGED, PROPRIETARY or otherwise protected

from disclosure. This email is intended for use only by the person or entity

to whom it is addressed. If you are not the intended recipient, any use,

disclosure, copying, distribution, printing, or any action taken in reliance

on the contents of this email, is strictly prohibited. If you received this

email in error, please contact the sending party by reply email, delete the

email from your computer system and shred any paper copies.



Note to Patients: There are a number of risks you should consider before using

e-mail to communicate with us. See our Privacy Policy and Henry Ford My Health

at www.henryford.com for more detailed information. If you do not believe that

our policy gives you the privacy and security protection you need, do not send

e-mail or Internet communications to us.

==

RE: Forefront and Evil SPAM (follow up)

[McCready, Rob]

Oh, were using Exchange 2007.

-Original Message-
From: McCready, Rob [mailto:rob.mccrea...@dplinc.com] 
Sent: Tuesday, June 29, 2010 10:42 AM
To: MS-Exchange Admin Issues
Subject: Forefront and Evil SPAM

Does anybody know if there are any reporting tools for Forefront?  We'd like to 
find out exactly how many spam messages per day we block, but that may be 
pretty difficult considering we use 3 different methods with Forefront?

1.  Real Time Black List
2.  Blocking any email that doesn't match a legitimate company address.
3.  The regular Forefront spam filters (with a setting of 7)


I think the Real Time Black List creates a log file that mentions each blocked 
email, but who wants to sit there and count them one by one.

I don't know if there are any tools or methods to count blocked email messages 
that don't match a valid company email address or emails that are 
caught/rejected by the Forefront filters?

RE: Forefront and Evil SPAM (follow up)

[McCready, Rob]

Oh, another follow up.  There's a fourth way we block spam with Exchange 2007 
Forefront.

1.  Real Time Black List
2.  Blocking any email that doesn't match a legitimate company address.
3.  The regular Forefront spam filters (with a setting of 7)
4.  If the IP address of the sender doesn't match where it says it's from, 
whack.

It sure would be nice if there was some way to report the numbers on all of 
those???





-Original Message-
From: McCready, Rob [mailto:rob.mccrea...@dplinc.com] 
Sent: Tuesday, June 29, 2010 10:43 AM
To: MS-Exchange Admin Issues
Subject: RE: Forefront and Evil SPAM (follow up)

Oh, were using Exchange 2007.

-Original Message-
From: McCready, Rob [mailto:rob.mccrea...@dplinc.com] 
Sent: Tuesday, June 29, 2010 10:42 AM
To: MS-Exchange Admin Issues
Subject: Forefront and Evil SPAM

Does anybody know if there are any reporting tools for Forefront?  We'd like to 
find out exactly how many spam messages per day we block, but that may be 
pretty difficult considering we use 3 different methods with Forefront?

1.  Real Time Black List
2.  Blocking any email that doesn't match a legitimate company address.
3.  The regular Forefront spam filters (with a setting of 7)


I think the Real Time Black List creates a log file that mentions each blocked 
email, but who wants to sit there and count them one by one.

I don't know if there are any tools or methods to count blocked email messages 
that don't match a valid company email address or emails that are 
caught/rejected by the Forefront filters?