Using Separate IMF Thresholds for Different Groups

I work for a school and want to apply one spam-filtering threshold for faculty and staff and another for students. Can I use the Microsoft Exchange Intelligent Message Filter (IMF) to do this?

If ease of use is important to you, I recommend using a third-party antispam product, such as Nemx Software's Power Tools for Exchange or NetIQ's MailMarshal, that lets you apply different filtering standards to different users. That said, you can achieve a certain level of differentiation with IMF. Just be aware that the process is a bit convoluted.

IMF lets you set two thresholds: a gateway threshold, applied at the server level as messages arrive from the outside world, and a Store threshold, applied at the Store level as messages are delivered to recipients' mailbox stores. (If you aren't already familiar with IMF, you can learn more by reading "Deploying Exchange Intelligent Message Filter," September 2004, InstantDoc ID 43151, or the Web-exclusive article "The Exchange Intelligent Message Filter," June 2004, InstantDoc ID 42682.) However, both of these thresholds are global: Both settings are stored in a forest's Configuration naming context (NC) and so apply to every IMF instance you add to your Exchange organization. If you need to set different thresholds at both the gateway and Store level, you'll need to put your faculty and staff's mailboxes on one server and your students' mailboxes on a different server—essentially creating a two-forest Exchange deployment. If differentiating between the groups is necessary at only the gateway level, you can take the following steps:

At the conclusion of this admittedly involved process, you'll be able to set separate gateway limits for address spaces F and S because IMF doesn't rescreen messages from authenticated users. When mail arrives for a recipient in address space S, IMF on the DC server scans the message and assigns it a spam confidence level (SCL), which persists as the message passes from the address space to the mailbox server. Mail for recipients in address space F arrives directly at the mailbox server and is evaluated according to the SCL you set on that server's instance of IMF. Messages for both sets of recipients are evaluated against the same Store threshold when the messages are submitted for delivery to the mailbox stores.

— Paul Robichaux