Forefront 2010 - No messages visible in incidents & quarantine


  • I have a single Exchange 2010 server, running on Windows 2008 R2 with Forefront 2010 installed, it is co-existing with a Exchange 2007 server.

    Although the dashboard shows spam messages to have been stopped, I cannot see these anywhere. When I check server security views/incidents or quarantine they are empty. With the previous version of forefront, it was occassionally necessary to release messages that have been marked incorrectly as spam from the equivalent panels.

    Friday, February 12, 2010 10:06 AM

All replies

  • Ok, now for no apparent reason they are showing in the incident list. I will keep monitoring it.
    Friday, February 12, 2010 6:02 PM
  • We're having the same issue here, but it aint showing up after a few hours like it did for you.
    Any suggestions?
    Thursday, March 18, 2010 11:48 AM
  • So, I've just got the ForeFront Protection 2010 for Exchange running.

    I'm having this issue.

    The dashboard informs me that incidents have occoured, however, the are not shown in the Incidents list - or in any other list for that matter.

    Does any one have a resolution for this ?

    Wednesday, November 03, 2010 7:39 AM
  • Me too, does anybody have a solution??
    Tuesday, December 07, 2010 2:04 AM
  • I'm having the same isssue also, any solution????
    Saturday, January 08, 2011 5:20 AM
  • I am also having this problem. Over 1400 messages in my Spam Blocking summary, yet not a single one displays in my quarantine list. How am I supposed to release messages if I cant see them? Also, what good is a quarantine system if the users have no idea messages have been quarantined, why not just delete them outright?. Other systems I've used have sent a daily digest of blocked spam each day, with an easy link to release that spam. Does Forefront not do similar?
    Sunday, January 23, 2011 1:18 AM
  • I know this is an old thread, but I am still having this same issuse an have not been able to find an answer.  Dashboard shows 21 incidents, but when I open the Incidents section to view them, nothing.  I have installed Rollup 4.  Any help out there?
    Saturday, January 07, 2012 7:43 PM
  • What incidents are you referring to?

    By default, FPE does not write content filtering data to the incidents pane unless you enable "Enable content filtering incident logging" in Global settings -> Advanced Options.

    You will never see DNSBL or connection filtering incidents written here.

    Friday, March 09, 2012 10:03 PM
  • Same problem to me. Is there anyone could answer?
    Tuesday, April 30, 2013 7:41 AM
  • Hi,

    first of all make sure you are running the latest build of your software.

    The Answer from Ryan McGrath is right, because e-mails detected by Cloudmark won't show up in the indcidents, but they are counted in the statistics. So enable the incident logging and you will see them.



    Christian Groebner MVP Forefront

    Wednesday, May 01, 2013 5:41 AM