TACTEAM -- Dallas 1 Whacking Spam with ISA Server 2000 Thomas W Shinder MD

TACTEAM -- Dallas2 TECHNICAL FAQs Here are answers to the most common technical problems users encounter during a Webcast: Q: Why can’t I hear the audio part of the webcast? A: Try increasing the volume on your computer. Q: I just entered the webcast and do not see the slide that the speaker is referring to. What should I do? A: The slides are constantly being pushed to your screen. You should refresh (hit F5) to view the latest slide. If your technical question is still not answered, please and describe your problem. A technical support person will respond within 24 hours. You can also visit the Broadcast Help page for more information or to test your browser compatibility. Click here:

TACTEAM -- Dallas3 Dr. Tom Shinder  ISA Server guru in residence at  Editor of the Brainbuzz Network Admin Weekly Newsletter  Editor of Sunbelt-Software WinXPNews  Author of best selling “Configuring ISA Server 2000: Creating Firewalls with Windows 2000  Author or contributors to over 20 Windows 2000 and networking books

TACTEAM -- Dallas4 Introduction  Spam Blocking Methods  ISA Server Message Screener  GFI Software’s MailSecurity  Summary and Analysis of Spam whacking

TACTEAM -- Dallas5 Spam Blocking Methods  Client side solutions –Outlook Junk Mail Filters –Outlook Express Message Rules –iHateSpam, Mail Washer, etc.  Server side solutions –ISA Server Message Screener –GFI MailSecurity

TACTEAM -- Dallas6 ISA Server Message Screener  Message Screener works with the SMTP Filter –SMTP Filter must be enabled  Message Screener is not the same as the SMTP Filter  Message Screener can be installed on the ISA Server, an SMTP Relay or an Exchange Server –Preferred solution is on a dedicated SMTP relay  IIS 5.0 required – cannot install on IIS 4.0 SMTP service  Message Screener does not control relay!  Can screen both incoming and outgoing traffic –Message Screener does not recognize incoming and outgoing traffic –Same rules apply to incoming and outgoing SMTP traffic

TACTEAM -- Dallas7 Installing and Configuring the SMTP Message Screener  Install the Message Screener Software on the IIS 5.0 machine  Enable the SMTP Application Filter  Configure the IIS 5.0 SMTP Server –Configure Remote Domains –Configure Relay  Configure permissions with the SMTPCred tool  Configure DCOM Permissions

TACTEAM -- Dallas8 Installing the Message Screener  Run from the ISA Server CD if installing on an SMTP Relay or the Exchange Server  Use the Add/Remove button to add the Message Screener to the ISA Server if you did not install it when the ISA Server was installed  If you install on a dedicated SMTP relay or the ISA Server, you need to enable the IIS 5.0 SMTP service  If you install on the ISA Server, you must disable SMTP service socket pooling

TACTEAM -- Dallas9 Enable the SMTP Filter

TACTEAM -- Dallas10 Enable the SMTP Filter  SMTP Application Filter is disabled by default  SMTP filter examines SMTP traffic even without Message Screener  Only examines for SMTP buffer overflows as stand-alone  Current implementation of the SMTP Filter does not support AUTH

TACTEAM -- Dallas11 Configure IIS 5.0 SMTP Service

TACTEAM -- Dallas12 Configure IIS 5.0 SMTP Service  Configure a Remote Domain  Remote domains for all your domains  You will allow relay only for these domains  All mail not directed to a Remote domain is rejected

TACTEAM -- Dallas13 Configure IIS 5.0 SMTP Servce

TACTEAM -- Dallas14 Configure IIS 5.0 SMTP Service  Relay configuration for default SMTP virtual server  NO relay if used only for incoming messages  Limited relay if used for outgoing messages  Allow only internal mail servers to access outbound relay

TACTEAM -- Dallas15 Configure Credentials  Message Screener on independent relay or internal Exchange Server  Do not need to configure credentials if on ISA Server  Use credentials of user that installed the ISA Server or local Admin

TACTEAM -- Dallas16 DCOM Permissions

TACTEAM -- Dallas17 Message Screener Variations  Do not need to configure SMTPcred tool credentials when installed on ISA Server  Do not need to configure DCOM permissions when installed on the ISA Server  If the Message Screener is installed on an Exchange Server, it will not reliably screen outbound messages from Outlook MAPI clients  If Message Screener is installed on the Exchange Server, it will screen all messages inbound and outbound using SMTP

TACTEAM -- Dallas18 Configuring the Message Screener  Filtering Attachments  Filtering by account or domain  Filtering by keywords

TACTEAM -- Dallas19 Message Screener Configuration

TACTEAM -- Dallas20 Message Screener Configuration

TACTEAM -- Dallas21 Message Screener Configuration

TACTEAM -- Dallas22 Message Screener Recommendations  Use a dedicated SMTP relay  Keep the Message Screener off the ISA Server and Exchange Server  If the Message Screener is off the ISA Server, make sure to configure SMTP credentials and DCOM permissions  Image your server regularly, since you can’t back up your configuration!

TACTEAM -- Dallas23 For More Information

TACTEAM -- Dallas24 Thank you  If you have any additional questions or comments for Tom, send them to Be sure to note that the question relates to the ISA Server Message Screener webcast.  For an immediate response to a question, go to the new SearchWin2000.com Webcast Question and Answer forum. Navigate from the home page. Tom will patrol the forum through the end of November.  For more information on our library of on-demand webcasts, or to pre-register for an upcoming live event, go to  To submit your comments or suggestions for future webcasts, send an to the SearchWin2000.com Site Editor at