Microsoft's Intelligent Message Filter

Microsoft’s Intelligent Message Filter (IMF) is a downloadable add-in for non-clustered Exchange 2003 servers. It uses adaptive algorithms similar to Bayesian filtering to distinguish spam from legitimate email. When it developed IMF, Microsoft used email messages that its business partners classified as spam and submitted to create the base of data that allows IMF to distinguish spam from legitimate messages.

IMF examines email as it enters an Exchange server, but only if the message is not filtered by any active connection, recipient, or sender filters. IMF doesn't scan existing message stores. IMF assigns each email message a number that indicates the probability that the message is spam—this system constitutes the Spam Confidence Level (SCL). When implementing IMF, administrators specify a Gateway Threshold SCL value and actions, which IMF uses to determine whether messages should be deleted, rejected, archived, or forwarded to recipients. You can set a Mailbox Store SCL threshold value that Outlook Web Access for Exchange Server 2003 and Outlook 2003 use to determine whether a message should be delivered to a user’s Junk Email folder or to the user’s Inbox. Actions that result from actions that Outlook 2003’s safe and block lists take override the SCL.

Administrators configure IMF using Properties pages in the Exchange System Manager. You can install these components on a workstation for remote administration.

By default, IMF doesn't scan messages from authenticated senders or store archived messages that aren't delivered to users but rather are saved for administrative review. You can override both default settings with registry edits.

IMF posts to the Windows Server Application Event log and makes System Monitor performance counters available. Users of Microsoft Operations Manager (MOM) can download the Exchange Intelligent Message Filter Management Pack and add IMF monitoring to MOM. To most effectively use IMF, Microsoft recommends that you monitor the distribution of SCL ratings assigned to email in your organization to determine the proper gateway and mailbox store threshold values.