none
Forefront Protection 2010 for Exchange File Filtering stripping Read Receipts

    Dotaz

  • Hello,

    a customer is using Exchange 2010 SP2 EDGE with FFPe 2010 RU4.

    A filter list is configured to strip all unwanted attachments from incoming mail.

    The filter works perfect except for one thing: Read Receipts are also filtered.

    Does anyone know how to configure an exception so that Read Receipts don't get filtered?

    Thanks

    Christian

    14. února 2012 14:18

Odpovědi

Všechny reakce

  • Hi,

    you could create another filterlist for read receipts with the following settings:

    Type: subject line
    Action: skip detect
    Keywords: Read:, Gelesen:,....

    Due to the action is set to skip detect the read receipt will be delivered.

    Greetings

    Christian


    Christian Groebner MVP Forefront

    14. února 2012 14:45
  • Thanks for your answer.

    So this is what I also thought. But I would have to specify every language...

    I thought that Read Receipts are a special message type that I can specify in a rule...

    Christian

    14. února 2012 19:50
  • Hi,

    adding the subject lines to a filter list and skip them could be one way. Due to most companies only do business with some foreign countries in my eyes this is possible to handle.

    But what makes me wonder is, why are read receipts filtered by your file filter list. Normally read receipts don't have an attachment?

    Greetings

    Christian


    Christian Groebner MVP Forefront

    14. února 2012 20:30
  • Hi,

    sorry for the long post. Here's an excerpt from an FSE Settings Export(Filter List only):

    <FSSFilterList>
            <FileType>
              <ForefrontServerAbstractSettings>ZIP</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>AUTOCAD</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>EPS</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>JPEG</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>GIF</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>BMP</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>PNG</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>TIFF</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>TNEF</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>IMCMIME</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>PDF</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>TEXT</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>UNICODE</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>RTF</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>MSEXCEL1</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>DOC</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>OPENXML</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>MSWORD12</ForefrontServerAbstractSettings>
            </FileType>
            <Item>
              <string>&lt;in&gt;*</string>
            </Item>
            <List>INBOUND allow files</List>
            <Type>File</Type>
          </FSSFilterList>
          <FSSFilterList>
            <FileType>
              <ForefrontServerAbstractSettings>ALL</ForefrontServerAbstractSettings>
            </FileType>
            <Item>
              <string>&lt;in&gt;*Body of Message*</string>
              <string>&lt;in&gt;MDNPart3.txt</string>
              <string>&lt;in&gt;*.emz</string>
            </Item>
            <List>INBOUND allow indiv files</List>
            <Type>File</Type>
          </FSSFilterList>
          <FSSFilterList>
            <FileType>
              <ForefrontServerAbstractSettings>ZIP</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>AUTOCAD</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>EPS</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>JPEG</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>GIF</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>PNG</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>TIFF</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>TNEF</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>IMCMIME</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>PDF</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>TEXT</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>UNICODE</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>RTF</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>MSEXCEL1</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>DOC</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>OPENXML</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>MSWORD12</ForefrontServerAbstractSettings>
            </FileType>
            <Item>
              <string>&lt;out&gt;*</string>
            </Item>
            <List>OUTBOUND allow files</List>
            <Type>File</Type>
          </FSSFilterList>
          <FSSFilterList>
            <FileType>
              <ForefrontServerAbstractSettings>ALL</ForefrontServerAbstractSettings>
            </FileType>
            <Item>
              <string>&lt;in&gt;*</string>
            </Item>
            <List>INBOUND block all files</List>
            <Type>File</Type>
          </FSSFilterList>
          <FSSFilterList>
            <FileType>
              <ForefrontServerAbstractSettings>ALL</ForefrontServerAbstractSettings>
            </FileType>
            <Item>
              <string>&lt;out&gt;*</string>
            </Item>
            <List>OUTBOUND block all files</List>
            <Type>File</Type>
          </FSSFilterList>
          <FSSFilterList>
            <FileType>
              <ForefrontServerAbstractSettings>EXE</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>SFXEXE</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>ARC</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>ARJ</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>HYPERARC</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>JAR</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>LHA</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>MSCAB</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>ISCAB</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>MSCOMPRESS</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>PKLITE</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>RAR</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>ZOO</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>TAR</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>UNIXCOMPRESS</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>BZIP2</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>AVI</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>MPEG1</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>MP3</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>QTMOVIE</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>WAV</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>ASF</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>EPS</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>RIF</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>ANI</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>ICO</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>WMF</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>PCX</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>WMFVISIO</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>XARA</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>PAL</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>EICAR</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>DATAZ</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>UNINST</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>NOTESDB</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>MACBIN</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>CLASS</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>OBJ</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>MDB</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>TRUETYPE</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>FONT1</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>HELP</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>CHI</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>MSLIBRARY</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>SHORTCUT</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>TYPELIB</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>PIF</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>WRITE</ForefrontServerAbstractSettings>
            </FileType>
            <Item>
              <string>&lt;in&gt;*</string>
            </Item>
            <List>INBOUND block files</List>
            <Type>File</Type>
          </FSSFilterList>
          <FSSFilterList>
            <FileType>
              <ForefrontServerAbstractSettings>EXE</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>SFXEXE</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>ARC</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>ARJ</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>GZIP</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>HYPERARC</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>JAR</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>LHA</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>MSCAB</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>ISCAB</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>MSCOMPRESS</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>PKLITE</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>RAR</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>ZOO</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>TAR</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>UNIXCOMPRESS</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>BZIP2</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>AVI</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>MPEG1</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>MP3</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>QTMOVIE</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>WAV</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>ASF</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>EPS</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>RIF</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>ANI</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>BMP</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>ICO</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>WMF</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>PCX</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>WMFVISIO</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>XARA</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>PAL</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>EICAR</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>DATAZ</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>UNINST</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>NOTESDB</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>MACBIN</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>CLASS</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>OBJ</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>MDB</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>TRUETYPE</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>FONT1</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>HELP</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>CHI</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>MSLIBRARY</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>SHORTCUT</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>TYPELIB</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>PIF</ForefrontServerAbstractSettings>
              <ForefrontServerAbstractSettings>WRITE</ForefrontServerAbstractSettings>
            </FileType>
            <Item>
              <string>&lt;out&gt;*</string>
            </Item>
            <List>OUTBOUND block files</List>
            <Type>File</Type>
          </FSSFilterList>
          <FSSFilterList>
            <FileType>
              <ForefrontServerAbstractSettings>ALL</ForefrontServerAbstractSettings>
            </FileType>
            <Item>
              <string>&lt;out&gt;*Body of Message*</string>
            </Item>
            <List>OUTBOUND allow indiv files</List>
            <Type>File</Type>
          </FSSFilterList>
        </FilterList>

    Thanks

    Christian

    16. února 2012 19:23
  • Hi,

    what is the list for?

    Greetings

    Christian


    Christian Groebner MVP Forefront

    16. února 2012 20:23
  • I thought it was clear from my posting...

    Basically the idea is to block all files with a list and have a second one that allows certain file type(e.g. Office , PDF, etc.)

    And basically it works as expected. Except for read receipts... :-(

    Christian

    16. února 2012 20:41
  • Hi,

    have you checked the incidents. There should be more information in the column showing the filterlist and the content type.

    Normally it should be "multipart/report". 

    http://blogs.technet.com/b/exchange/archive/2011/02/23/3412028.aspx

    Do you know the following article about file filtering?

    http://technet.microsoft.com/en-us/library/dd639376.aspx

    Greetings

    Christian


    Christian Groebner MVP Forefront

    17. února 2012 13:42
  • Thnaks I will have a look at it!

    Christian

    17. února 2012 13:58