Spam is Not Detected When Symantec Mail Security for Microsoft Exchange (SMSMSE) Transport Agents are Low Priority

Article: TECH95584

|

Created: 2009-01-17

|

Updated: 2011-03-18

Source:
http://www.symantec.com/business/support/index?page=content&id=TECH95584

Problem

Symantec Message Security for Microsoft Exchange (SMSMSE) is not detecting spam despite detecting content filtering and virus violations.


Premium Anti Spam "spam scans" number on the SMSMSE homepage never changes.

Conditions

• SMSMSE has been configured to scan messages even if marked with SCL value of minus one (-1). See the following article for details: Messages not Scanned for Spam When Marked by Microsoft Exchange with an AntiSpam X-Header. Transport Agent Debug Log Shows Message: "Whitelisted by other, bypass SPA".
  
• Microsoft's AntiSpam agents are installed and have a higher priority then the SMSMSE agents.
  
  To verify this follow these steps:
  1. On the Exchange server open the Exchange Management Shell
  2. At the prompt type the command "Get-TransportAgent". The results should look like the following:
  Identity Enabled Priority
  -------- ------- --------
  Transport Rule Agent True 1
  Journaling Agent True 2
  AD RMS Prelicensing Agent False 3
  Connection Filtering Agent True 4
  Content Filter Agent True 5
  Sender Id Agent True 6
  Sender Filter Agent True 7
  Recipient Filter Agent True 8
  SMSMSERoutingAgent True 9
  SMSMSESMTPAgent True 10
  Protocol Analysis Agent True 11
  3. If the SMSMSE agents have a lower priority (being lower on the list and having a higher priority number), this conditions is met.

Environment

• Exchange 2007/2010

Cause

If the Microsoft's AntiSpam agents have a higher priority than SMSMSE AntiSpam agents, the message may not be passed to the Premium AntiSpam scanner for verification. If Premium AntiSpam is partially working, but not detecting all spam emails, please review the following document: Title: 'Premium AntiSpam for Symantec Mail Security for Microsoft Exchange fails to detect spam' Document ID: 2007020615531854 > Web URL: http://service1.symantec.com/SUPPORT/ent-gate.nsf/docid/2007020615531854?Open&seg=ent

Solution

Configure the Agents to grant the SMSMSE agent a higher priority.

• Set the SMSMSE Agents to higher priority than the Exchange AntiSpam agents:
  At the Exchange management shell, run the following 2 commands:
  1. Set-transportagent –identity “SMSMSESMTPAgent” –priority 4
  2. Set-transportagent –identity “SMSMSERoutingAgent” –priority 5
• Restart the Microsoft Exchange Transport service

OR

• Disable the built in Exchange agents by running the following 5 commands:
  At the Exchange management shell, run the following 2 commands:
  1. disable-transportagent -identity "Connection Filtering Agent"
  2. disable-transportagent -identity "Sender Id Agent"
  3. disable-transportagent -identity "Sender Filter Agent"
  4. disable-transportagent -identity "Recipient Filter Agent"
  5. disable-transportagent -identity "Protocol Analysis Agent"
• Restart the Microsoft Exchange Transport service

You might encounter an error when executing the commands about not being able to edit the config file. This can be resolved by opening the Exchange Management Console as administrator and executing the commands again.