1. Planning and Configuring Message Hygiene
20341B
9: Planning and Configuring Message Hygiene
Presentation: 75 minutes
Lab: 45 minutes
After completing this module, the students will be able to:
Plan message security options.
Implement an antivirus solution for Microsoft® Exchange Server 2013.
Implement an anti-spam solution for Exchange Server 2013.
Required materials
To teach this module, you need the Microsoft® Office PowerPoint® file 20341B_09.pptx.
Important: We recommend that you use Microsoft Office PowerPoint 2007 or a newer version to display the slides for this course. If you use PowerPoint Viewer or an earlier version of Office PowerPoint, all of the features of the slides might not display correctly.
Preparation tasks
To prepare for this module:
Read all of the materials for this module.
Practice performing the demonstrations.
Practice performing the labs.
Work through the Module Review and Takeaways section, and determine how you will use this section to reinforce student learning and promote knowledge transfer to on-the-job performance.
As you prepare for this class, it is imperative that you complete the labs yourself so that you understand how they work and the concepts that are covered in each. This will allow you to provide meaningful hints to students who may experience difficulties in a lab. It also will help guide your lecture to ensure that you cover the concepts that the labs cover.
Module 9
Planning and Configuring Message Hygiene

2. Implementing an Anti-Spam Solution for Exchange Server 2013
20341B
Module Overview
9: Planning and Configuring Message Hygiene
Implementing an Anti-Spam Solution for Exchange Server 2013
Briefly present the module content.

3. Lesson 1: Planning Messaging Security
20341B
Lesson 1: Planning Messaging Security
9: Planning and Configuring Message Hygiene
Demonstration: Configuring Secure Message Routing Between Partner Organizations
Briefly present the lesson content.

4. Defining Message Security Requirements
20341B
Defining Message Security Requirements
9: Planning and Configuring Message Hygiene
Security requirements
Protection technology
Exchange Server 2013
Antimalware, anti-spam, security permissions, local firewall
Perimeter network
Firewall, reverse proxy, SMTP Gateway, antimalware, anti spam
Internal client
Antimalware, security permissions, local firewall
External client
Discuss in detail the aspects of planning an organization’s security strategy based on security requirements. Ask the students to describe how they would plan a security strategy, and their individual organization’s security requirements.

5. The SMTP Gateway solution:
20341B
SMTP Gateway Solution
9: Planning and Configuring Message Hygiene
The SMTP Gateway solution:
Should have antimalware and anti-spam protection
Must be configured with a FQDN
Should be installed in perimeter network
Requires a minimal number of ports opened on the internal and external firewalls
Must be configured with the IP addresses for DNS servers that can resolve DNS names on the Internet
Describe the benefits of having SMTP gateway solution to the students. You might create an illustration on the whiteboard to describe the network design and SMTP gateway solution placement in an organization’s IT infrastructure.
Some of the students may ask about scenarios without a SMTP gateway solution. Instruct them on how the SMTP gateway solution improves security by stopping malware and spam on the perimeter network. However, some smaller organizations might not use SMTP gateway, in which case antimalware and anti- spam protection should be configured on the Mailbox server role.
Also inform the students that using the Exchange Server 2010 Edge server role as an SMTP gateway solution in Exchange Server 2013 is supported scenario.

6. Planning Restrictions to Message Flow
20341B
Planning Restrictions to Message Flow
9: Planning and Configuring Message Hygiene
Restricting mail flow options:
Message delivery restrictions
Transport rules
Message moderation
Data loss prevention
Review with the students the message-restriction options covered in the previous modules. Discuss with the students how they would plan restrictions to message flow in their organizations

7. Planning SMTP Connector Security
20341B
Planning SMTP Connector Security
9: Planning and Configuring Message Hygiene
SMTP connector security options:
SMTP can be additionally secured by using authentication and authorization on the SMTP connector
Protocol
Layer
Purpose
IPsec
Network-based
Encrypts server-to-server or client-to-server traffic
VPN
Encrypts site-to-site traffic
TLS
Session-based
Encrypts server-to-server traffic
Provide an overview of the different options to secure SMTP . Describe sample scenarios in which each of the following options would be used.
TLS
VPN
IPSec
Authentication and authorization 

8. Planning Secure Message Routing Between Partner Organizations
9: Planning and Configuring Message Hygiene
Uses mutual TLS with business partners to enable secured message paths over the Internet
To set up mutual TLS:
Generate a certificate request for TLS certificates
Import and enable the certificate on the Mailbox server
Configure outbound Domain Security
Configure inbound Domain Security
Discuss with the students the scenarios where they would secure message routing between organizations.

9. Planning Client-Based Messaging Security
9: Planning and Configuring Message Hygiene
S/MIME Infrastructure requirements:
The sender must have a valid certificate installed
All target addresses must have a public certificate available either locally or in Active Directory
Can use either an internal or public CA
Method
Type of Security Provided
Digital signatures
Authentication: The message was sent by the person or organization who claims to have sent it
Nonrepudiation: Helps to prevent the sender from disowning the message
Data integrity: Any alteration of the message invalidates the signature
Message encryption
Only the intended recipient can view the contents
Describe different scenarios and discuss with the students when they would use client-based security.

10. 20341B
Demonstration: Configuring Secure Message Routing Between Partner Organizations
9: Planning and Configuring Message Hygiene
In this demonstration, you will see how to configure secure message routing between partner organizations
When you have completed the demonstration, please leave the virtual machines running for subsequent demonstrations.
Preparation Steps
You must have the 20341B-LON-DC1, 20341B-LON-MBX1, and 20341B-LON-CAS1 virtual machines for this demonstration. Start each machine and sign in to it before starting the next virtual machine. Sign into all virtual machines using the Adatum\Administrator account with the password Pa$$w0rd.
Important: Ensure that you start your virtual machines at least ten minutes prior to conducting the demonstration.
Demonstration Steps
On LON-CAS1, open Internet Explorer and navigate to and then sign in as Adatum\Administrator with the password Pa$$w0rd.
In the feature pane, click mail flow.
Click the send connectors tab.
Click New.
In the new send connector window, in Name, type contoso.com. In Type, click Partner. Click next.
On the Network settings page, click next.
On the Address space page, click Add.
In the Address Space window, in Fully Qualified Domain Name (FQDN), type contoso.com, and then click save.
Click next.
On the Source server page, click Add.
In the Select a Server window, click LON-MBX1, and then click add.
Click ok.
(More notes on the next slide)

11. 9: Planning and Configuring Message Hygiene
20341B
9: Planning and Configuring Message Hygiene
Click finish.
Double-click the contoso.com connector.
In Exchange Send Connector window, select the Proxy through client access server check box and then click save.
Click the receive connectors tab.
In the Select server drop-down box, select LON-CAS1.adatum.com.
Click New.
In the new receive connector window, in Name, type contoso.com, and then click Partner. Click next.
On the network adapter bindings page, click next.
On the Remote network settings page, click Add.
On the add IP address page, type , and then click save.
Select the range , and then click Remove.
Pause your mouse pointer in the lower left of the taskbar and then click Start.
Click Exchange Management Shell.
In the Exchange Management Shell, type: Set-TransportConfig –TLSSendDomainSecureList adatum.com, and press Enter.
Type Set-TransportConfig –TLSReceiveDomainSecureList contoso.com, and press Enter.
Close the Exchange Management Shell.
Note: The steps described in this demonstration also should be performed in the partner organization Contoso. Contoso should create partner send connector for adatum.com domain, create a receive connector for adatum.com, and configure TLS security for SMTP protocol with adatum.com domain.

12. Lesson 2: Implementing an Antivirus Solution for Exchange Server 2013
20341B
Lesson 2: Implementing an Antivirus Solution for Exchange Server 2013
9: Planning and Configuring Message Hygiene
Demonstration: Configuring Antimalware Protection for Exchange Server
Briefly present the lesson content.

13. Overview of Antivirus Solution Requirements
20341B
Overview of Antivirus Solution Requirements
9: Planning and Configuring Message Hygiene
Antivirus solution requirements:
Protection from malware
Protection from spam
Designed for Exchange Server 2013
Corporate antivirus solution
Discuss with the students different scenarios for antivirus software requirements. Ask the students about their strategy for protection from malware in their organizations.

14. Options for Implementing an Antivirus Solution in Exchange Server 2013
20341B
Options for Implementing an Antivirus Solution in Exchange Server 2013
9: Planning and Configuring Message Hygiene
Exchange Server 2013 antivirus solution options:
Built-in antimalware protection
Hosted, cloud-based solution or hybrid solution
Corporate antivirus solution
Antivirus solution in the perimeter network
Discuss with the students the different antivirus solution options. Ask the students which of the antivirus solution options is most appropriate for their organizations.

15. Antivirus Solution Features in Exchange Server 2013
20341B
Antivirus Solution Features in Exchange Server 2013
9: Planning and Configuring Message Hygiene
Exchange antimalware protection features include:
Options for enable, disable, or bypass
Download engine and definition updates
Scanning is performed during send or receive
Actions when malware is detected:
Delete entire message
Delete all attachments and use default alert text
Delete all attachments and use custom alert text
Notify the administrator and the sender
Introduce the students to the configuration options in the default antimalware protection policy. Ask the students which option they would choose in their corporate environment.

16. What Is Exchange Online Protection?
20341B
What Is Exchange Online Protection?
9: Planning and Configuring Message Hygiene
Exchange Online Protection has following features:
Web-based management console
Multi-engine antimalware
Real-time response
availability
Reporting
Describe to students Exchange Online Protection features. Discuss the different scenarios with the students: on premise Exchange antimalware protection, Exchange Online Protection, and the hybrid solution.

17. Best Practices for Deploying an Antivirus Solution
9: Planning and Configuring Message Hygiene
When you implement an antivirus solution, you should:
Implement multiple layers of antivirus such as:
Exchange on premise antimalware protection
Antivirus installed on firewall or SMTP gateway server
Antivirus installed on the client computers
Exchange Online Protection
Maintain regular antivirus updates
Regularly monitor antimalware reports
Regularly read about latest Internet security threats
Stress the importance of providing multiple layers of protection against viruses. Provide some comprehensive information on best-practice considerations for deploying antivirus solutions.

18. Demonstration: Configuring Antimalware Protection for Exchange Server
20341B
Demonstration: Configuring Antimalware Protection for Exchange Server
9: Planning and Configuring Message Hygiene
In this demonstration, you will see how to configure antimalware protection for Exchange Server
When you have completed the demonstration, please leave the virtual machines running for subsequent demonstrations.
Preparation Steps
You must have the 20341B-LON-DC1, 20341B-LON-CAS1, and 20341B-LON-MBX1 virtual machines for this demonstration. If required, sign in to all virtual machines as Adatum\Administrator with the password Pa$$w0rd.
Demonstration Steps
Enabling antimalware features in Exchange Server 2013
On LON-MBX1, from the Start screen, click Exchange Management Shell.
Type the following, and then press Enter:
CD “C:\Program Files\Microsoft\Exchange Server\V15\Scripts”
In the Exchange Management Shell, enable antimalware scanning by typing following script, and then press Enter.
.\Enable-AntimalwareScanning.ps1
Verify that the following message appears: Antimalware engines are updating. This may take a few minutes.
Type CTRL-C to stop running the script. Explain that if the server had Internet connectivity, then the latest engine updates would be downloaded.
In the Exchange Management Shell, restart the Microsoft Exchange Transport Service by typing following cmdlet, and then press Enter.
Restart-Service MSExchangeTransport
(More notes on the next slide)

19. 9: Planning and Configuring Message Hygiene
20341B
9: Planning and Configuring Message Hygiene
In the Exchange Management Shell, list installed transport agents by typing the following cmdlet, and then press Enter.
Get-TransportAgent
Verify that the following antimalware agent is listed: Malware Agent and that it is Enabled True.
Configuring the default antimalware policy
Switch to LON-CAS1.
In the EAC, on the feature pane, click protection.
In the EAC window, on the malware filter tab, click on the edit button on the toolbar.
In the Default window, click on settings.
Under Malware Detection Response, select Delete all attachments and use custom alert text.
In Custom alert text box, type following text: The attachment has been deleted because it contained malware. Contact your administrator.
Under Notifications, select both Notify internal senders and Notify external senders check boxes.
Under Administrator Notifications, select Notify administrator about undelivered messages from internal senders check box.
In Administrator address box, type
Under Administrator Notifications, select Notify administrator about undelivered messages from external senders check box.
In the Default window, click save.

20. Lesson 3: Implementing an Anti-Spam Solution for Exchange Server 2013
20341B
Lesson 3: Implementing an Anti-Spam Solution for Exchange Server 2013
9: Planning and Configuring Message Hygiene
Demonstration: Configuring Anti-Spam Features on Exchange Server 2013
Briefly present the lesson content.

21. Overview of Anti-Spam Solutions
20341B
Overview of Anti-Spam Solutions
9: Planning and Configuring Message Hygiene
Organizations should evaluate following anti-spam requirements:
Ease of configuration
Protection from malware
Exchange Server 2013 built-in anti-spam features
Exchange Online Protection or hybrid solution
SMTP gateway anti-spam solution
End user notification for quarantined messages
Discuss with the students the different scenarios for anti-spam software requirements. Ask the students to describe their strategy for spam protection in their organizations.

22. Overview of Spam-Filtering Features
20341B
Overview of Spam-Filtering Features
9: Planning and Configuring Message Hygiene
Feature
Filters messages based on:
Content Filtering
The message contents
Sender ID
The IP address of the sending server from which the message was received
Sender Filtering
The Sender in the MAIL FROM: SMTP header
Recipient Filtering
The Recipients in the RCPT TO: SMTP header
Sender Reputation
Several characteristics of the sender, accumulated over a period of time
As you start this topic, ask the students about the anti-spam tools they are using currently in their organizations. Ask them how effective the tools are, and how much effort is involved in managing the solution.
If the students are not familiar with the Microsoft® Exchange Server 2003, Exchange Server 2007 or Exchange Server 2010 anti-spam features, you might want to spend some additional time describing connection filtering, because this type of filtering is most efficient in blocking spam messages, but it is not included in Exchange Server 2013.

23. Applying Exchange Server 2013 Spam Filters
20341B
Applying Exchange Server 2013 Spam Filters
9: Planning and Configuring Message Hygiene
Exchange Server 2013
Mailbox server
Describe each step of the filtering process. Emphasize the order in which messages are processed. For example, a message from an SMTP host that is on the IP Block List will never be scanned for content. Mention the real-time block list (RBL) and its use.
Emphasize that for most filter types, the messages or SMTP connections are simply dropped, and there is no option for archiving or quarantining the message. Only content filtering provides the option of quarantining messages so that administrators can monitor them for false positives.
Introduce the student to the spam confidence level (SCL) threshold and its purpose.
Sender Filtering
Internet
Recipient Filtering
Outlook Safe Senders List
Sender ID Filtering
Exceed SCL Threshold
Content Filtering
Below SCL Threshold

24. What Is Sender and Recipient Filtering?
20341B
What Is Sender and Recipient Filtering?
9: Planning and Configuring Message Hygiene
Sender filtering:
Evaluates the sender SMTP address, address, domain, or domain with subdomains
Can be configured to reject
Can be configured to process to another anti-spam agent
Recipient filtering:
Evaluates recipient the SMTP address
Can be configured to reject to a non-existing user or to a specific internal user
Discuss the scenarios where organizations use sender and recipient filtering. Stress that malicious users who send spam are most effectively stopped by connection filtering, which is not available in Exchange Server Connection filtering is available in Exchange Server 2010 Edge, Exchange Online Protection and third-party anti-spam solutions. Malicious users who send spam can change their sending address dynamically, which makes sender filtering inefficient in fighting this kind of threat.

25. What Is Sender ID Filtering?
20341B
What Is Sender ID Filtering?
9: Planning and Configuring Message Hygiene
You can configure it to:
Reject messages and issue an NDR
Delete messages without sending an NDR
Stamp the messages with the SenderID result, and continue processing
Internet
SMTP
Server
DNS Server
Mailbox Server 1 3 4 2
Stress to the students that many organizations have not yet implemented the required Sender of Policy Framework (SPF) records in the domain name system (DNS). For this reason, the users should not configure the Sender ID filter to reject or delete messages.

26. What Is Sender Reputation Filtering?
20341B
What Is Sender Reputation Filtering?
9: Planning and Configuring Message Hygiene
Sender Reputation filtering filters messages based on information about recent messages received from specific senders
The Protocol Analysis agent assigns an SRL that is based on:
Sender open proxy test
HELO/EHLO analysis
Reverse DNS lookup
Analysis of SCL ratings on messages from a particular sender
Sender Reputation filtering is another spam-protection tool that was introduced in Exchange Server Discuss how Sender Reputation filtering works. Focus on the criteria that the Mailbox server uses when it makes the filtering decisions.
Discuss how this feature should be implemented. Suggest to the students that they will need to try different sender reputation levels (SRLs) to determine what will work best in their organization.

27. Understanding the SCL in Exchange Server 2013
20341B
Understanding the SCL in Exchange Server 2013
9: Planning and Configuring Message Hygiene
SCL is a numerical value between 0 and 9:
0 - the message is highly unlikely to be spam
9 - the message is very likely to be spam
SCL thresholds and actions:
SCL delete threshold
SCL reject threshold
SCL quarantine threshold
SCL junk folder threshold
Explain SCL to the students and discuss in detail the SCL thresholds and actions.

28. What Is Content Filtering?
20341B
What Is Content Filtering?
9: Planning and Configuring Message Hygiene
Content Filtering analyzes the content of each message and assigns an SCL to the message
You can configure content filtering to:
Delete, reject, or quarantine messages that exceed an SCL value
Block or allow messages based on a custom word list
Allow exceptions so that messages sent to specified recipients are not filtered
Quarantined messages are sent to a quarantine mailbox
As you describe content filtering, show the configuration options in the Exchange Shell. Emphasize the importance of monitoring the quarantine mailbox, especially during the initial deployment, to make sure that the SCL thresholds are configured correctly.

29. Best Practices for Deploying an Anti-Spam Solution
9: Planning and Configuring Message Hygiene
Consider following best practices:
Regularly update anti-spam definitions
Monitor anti-spam reports
Regularly read about latest Internet security and spam threats
Regularly evaluate end users’ feedback
Regularly evaluate anti-spam configuration
Use multi-layered anti-spam protection
Discuss best practices with the students, and ask them how they would implement best practices on anti- spam protection in their organizations.

30. Demonstration: Configuring Anti-Spam Features on Exchange Server 2013
20341B
Demonstration: Configuring Anti-Spam Features on Exchange Server 2013
9: Planning and Configuring Message Hygiene
In this demonstration, you will learn how to configure anti-spam features on Exchange Server 2013
When you have completed the demonstration, please revert the virtual machines.
Preparation Steps
You must have the 20341B-LON-DC1, 20341B-LON-CAS1, and 20341B-LON-MBX1 virtual machines for this demonstration. Sign in to all virtual machines as Adatum\Administrator with the password Pa$$w0rd.
Demonstration Steps
Enabling anti-spam features on LON-MBX1
Switch to LON-MBX1.
In the Exchange Management Shell, install anti-spam agents by typing the following script, and then press Enter.
.\Install-AntiSpamAgents.ps1
In the Exchange Management Shell, restart the Microsoft Exchange Transport Service by typing the following cmdlet, and then press Enter.
Restart-Service MSExchangeTransport
In the Exchange Management Shell, specify the IP addresses of the internal SMTP servers – LON-MBX1 and LON-MBX2 that should be ignored by the Sender ID agent, by typing the following cmdlet, and then press Enter.
Set-TransportConfig
In the Exchange Management Shell, list installed transport agents by typing the following cmdlet, and then press Enter.
Get-TransportAgent
Verify that the following anti-spam agents are listed: Content Filter Agent, Sender ID Agent, Sender Filter Agent, Recipient Filter Agent, Protocol Analysis Agent. Verify that the status of anti-spam agents is Enabled True.
(More notes on the next slide)

31. 9: Planning and Configuring Message Hygiene
20341B
9: Planning and Configuring Message Hygiene
Configuring content filtering on LON-MBX1
In the Exchange Management Shell, verify that content filtering is enabled by typing the following cmdlet, and then press Enter.
Get-ContentFilterConfig | Format-List Enabled
Verify that Enabled:True is displayed.
In the Exchange Management Shell, configure the blocked phrase Poker results by typing the following cmdlet, and then press Enter.
Add-ContentFilterPhrase -Influence BadWord -Phrase "Poker results"
In the Exchange Management Shell, configure the allowed phrase Report document by typing the following cmdlet, and then press Enter.
Add-ContentFilterPhrase -Influence GoodWord -Phrase "Report document"

32. Lab: Planning and Configuring Message Security
9: Planning and Configuring Message Hygiene
Exercise 3: Validating Antimalware and Anti-Spam Configuration
Before the students begin the lab, read the lab scenario and display the next slide. Before each exercise, read the scenario associated with the exercise to the class. The scenarios will give context to the lab and exercises, and will help to facilitate the discussion at the end of the lab. Remind the students to complete the discussion questions after the last lab exercise.
Exercise 1: Configure Antimalware Options in Exchange Server 2013
A. Datum organization has decided to use Exchange Server 2013 antimalware features. You have to configure antimalware features to prevent malware from entering your network.
Exercise 2: Configuring Anti-Spam Options on Exchange Server
A. Datum organization has decided to use Exchange Server 2013 anti-spam features. You have to configure anti-spam features to prevent spam from entering your network.
Exercise 3: Validating Antimalware and Anti-Spam Configuration
In this exercise, you will validate antimalware and anti-spam configuration by sending a test that contains simulated test malware. Then you will connect to LON-MBX1 by using the telnet command, and you will send messages that should be blocked by the anti-spam agents.
Virtual Machines B-LON-DC1
20341B-LON-CAS1
20341B-LON-MBX1
User Name Adatum\Administrator
Password Pa$$w0rd
Logon Information
Estimated time: 45 minutes

33. 20341B
Lab Scenario
9: Planning and Configuring Message Hygiene
You are a messaging administrator in A. Datum Corporation, which is a large multinational organization. Your organization has deployed Exchange Server 2013 internally, and now you must configure options for message security.

34. What is the purpose of the SCL threshold?
20341B
Lab Review
9: Planning and Configuring Message Hygiene
What is the purpose of the SCL threshold?
Question
What anti-spam agents are available in Exchange Server 2013?
Answer
The anti-spam agents include Content Filter, Sender ID, Sender Filter, and Recipient Filter.
What is the purpose of the SCL threshold?
The SCL threshold establishes a value that specifies whether a message is seen as spam, or as a valid message. The lower the number, the greater the likelihood that the message is not spam. The higher the number, the more likely it is that the message is spam.

35. Module Review and Takeaways
20341B
Module Review and Takeaways
9: Planning and Configuring Message Hygiene
Common Issues and Troubleshooting Tips
Tools
Review Question
Question
What strategy for anti-spam and antimalware protection are you going to suggest for your organization?
Answer
Answers might vary. Small organizations might have anti-spam and antimalware protection installed on premise only or hosted in the cloud only. Medium-sized and large organizations might choose to have multi-layer protection for both anti-spam and antimalware protection. Multi-layer protection can be configured with two solutions:
One anti-spam and antimalware protection solution on premise.
Another anti-spam and antimalware protection solution installed on the SMTP gateway or hosted in the cloud, such as Exchange Online Protection.
We also recommend that the solution on premise incorporate different antimalware antimalware agents than the SMTP gateway solution or the cloud solution.
Real-world Issues and Scenarios
Your employees often complain about being blocked as a spam or malware, when the was neither spam nor malware. Such false-positive is one of the biggest issues in anti-spam and antimalware protection. False positive means that an has been blocked due to anti-spam or antimalware scanning, but the actually is not a spam and does not contain malware.
To address the issue, contact security administrators to investigate the reasons why those s have been identified as a spam or malware. Re-evaluate your anti-spam and antimalware protection settings, and edit the settings if neccecery.
Tools
Exchange Administration Center (EAC) – Used for configuring antimalware policy
Exchange Management Shell – Used for configuring antimalware policy, antimalware settings, and anti- spam settings
(More notes on the next slide)

36. 9: Planning and Configuring Message Hygiene
20341B
9: Planning and Configuring Message Hygiene
Best Practice
When configuring an anti-spam and antivirus solution, always follow the vendor’s technical documentation on how to deploy, manage, and maintain those solutions. Internet threats are changing every day, so Exchange administrators and security administrators must be regularly educated on and aware of the latest security threats. As security threats change, an organization’s anti-spam and antivirus solutions and management best practices might also change.
Common Issues and Troubleshooting Tips
Common Issue:
You have configured anti-spam content filtering, but employees complain that they still receive spam .
Troubleshooting Tip:
Edit anti-spam content filtering and increase SCL values with the following parameters: SCLDeleteThreshold 9, SCLRejectThreshold 8, SCLQuarantineThreshold 7. Ask the employees after one day about the amount of spam received.
Common Issue: You have configured anti-spam content filtering, but employees complain that they do not receive from business partners.
Troubleshooting Tip: Configure anti-spam content filtering with a quarantine mailbox. Check the quarantine mailbox for messages from the business partners. Forward the messages from business partners to the employees who reported the problem. Evaluate your content-filtering policy to determine if the policy needs to be edited with lower SCL threshold values.
Common Issue: One employee complained that when he received an , the attachment was missing, and was replaced with another attachment with a warning about malware.
Troubleshooting Tip: Investigate the sender of the . If the sender was another employee from your organization, alert the security administrators that malware is present in the network. Security administrators should locate and delete the malware. Configure the default antimalware policy to notify both internal and external senders when malware is detected.
Instructor Note: Make sure that you cover the common issues and the corresponding troubleshooting tips listed in this section. Encourage the students to share tips from their own work environments.