Applies to: Exchange Server 2007 SP3, Exchange Server 2007 SP2, Exchange Server 2007 SP1, Exchange Server 2007
Topic Last Modified: 2006-09-18

This topic explains how to use the Exchange Management Console or the Exchange Management Shell to enable and configure the spam confidence level (SCL) thresholds. The SCL threshold is the value at which a particular message is identified as potential spam and is acted on. The Content Filter agent is the last filter to scan inbound messages. Therefore, the settings of the SCL thresholds and threshold actions are very important. If you set the SCL thresholds too high, you may not reduce the spam that enters your organization. If you set the SCL thresholds too low, the risk is that you will filter messages from legitimate users.

You can enable and set each SCL threshold action to a value between 0 and 9, where 0 is considered less likely to be spam, and 9 is considered more likely to be spam.

Note:
After you configure the SCL threshold actions, you should periodically monitor these settings and adjust them based on your organization's needs.

You enable and set the SCL thresholds and corresponding actions as follows:

Delete messages that have a SCL rating greater than or equal to This option deletes the message but does not inform the sending server of the deletion. In fact, the computer that has the Edge Transport server role installed sends a fake "OK" Simple Mail Transfer Protocol (SMTP) command to the sending server and then deletes the message. Because the sending server assumes that the message was sent, the sending server does not retry to send the message in the same session.
Reject messages that have a SCL rating greater than or equal to This option rejects the message and sends an SMTP error response to the sending server.

Quarantine messages that have a SCL rating greater than or equal to This option quarantines the message and sends it to the spam quarantine mailbox that you specified. For more information about how to configure the spam quarantine mailbox, see How to Specify a Spam Quarantine Mailbox.

Important:
By the nature of the feature, the IT administrator who is responsible for the spam quarantine mailbox can view potentially private and sensitive messages and send mail on behalf of anybody in the Exchange organization.

You can enable and configure the SCL thresholds and SCL threshold actions to work together. When you enable multiple SCL threshold actions to work together, consider the following requirements:

The SCL reject threshold must be greater than the SCL quarantine threshold.
The SCL delete threshold must be greater than the SCL reject threshold and the SCL quarantine threshold.

Before You Begin

To perform the following procedures on a computer that has the Edge Transport server role installed, you must log on by using an account that is a member of the local Administrators group on that computer.

Also, before you perform these procedures, confirm the following:

The spam quarantine mailbox has a valid SMTP address.
You have reviewed Anti-Spam and Antivirus Functionality to understand the general strategy for configuring all anti-spam agents so that they work together efficiently for your organization.
You have read Configuring Content Filtering.
You have read Configuring and Managing Spam Quarantine.

Procedure

To use the Exchange Management Console to enable and configure SCL thresholds and SCL threshold actions

In the Exchange Management Console, click Edge Transport.
In the work pane, click the Anti-spam tab, and then select Content Filtering.
In the action pane, click Properties.
Click the Action tab, and select the check box for the actions that you want to enable.
Set the SCL thresholds for the corresponding actions.
Click OK to save your changes and close the dialog box, or click Apply to save your changes without closing the dialog box.

To use the Exchange Management Shell to enable and configure SCL thresholds and SCL threshold actions

To enable the SCL reject action and configure the SCL reject threshold, run the following command:
Copy Code
Set-ContentFilterConfig -SCLRejectEnabled <$true | $false> -SCLRejectThreshold <Int32>
For example, to reject messages that have an SCL rating of 8 or more, run the following command:
Copy Code
Set-ContentFilterConfig -SCLRejectEnabled $true -SCLRejectThreshold 8
To enable the SCL delete action and configure the SCL delete threshold, run the following command:
Copy Code
Set-ContentFilterConfig -SCLDeleteEnabled <$true | $false> -SCLDeleteThreshold <Int32>
For example, to delete messages that have an SCL rating of 9 or more, run the following command:
Copy Code
Set-ContentFilterConfig -SCLDeleteEnabled $true -SCLDeleteThreshold 9
To enable the SCL quarantine action and configure the SCL quarantine threshold, run the following command:
Copy Code
Set-ContentFilterConfig -SCLQuarantineEnabled <$true | $false> -SCLQuarantineThreshold <Int32>
For example, to send messages that have an SCL rating of 7 or more to the spam quarantine mailbox, run the following command:
Copy Code
Set-ContentFilterConfig -SCLQuarantineEnabled $true -SCLQuarantineThreshold 7

	Copy Code
Set-ContentFilterConfig -SCLRejectEnabled <$true \| $false> -SCLRejectThreshold <Int32>

	Copy Code
Set-ContentFilterConfig -SCLRejectEnabled $true -SCLRejectThreshold 8

	Copy Code
Set-ContentFilterConfig -SCLDeleteEnabled <$true \| $false> -SCLDeleteThreshold <Int32>

	Copy Code
Set-ContentFilterConfig -SCLDeleteEnabled $true -SCLDeleteThreshold 9

	Copy Code
Set-ContentFilterConfig -SCLQuarantineEnabled <$true \| $false> -SCLQuarantineThreshold <Int32>

	Copy Code
Set-ContentFilterConfig -SCLQuarantineEnabled $true -SCLQuarantineThreshold 7

For detailed syntax and parameter information, see Set-ContentFilterConfig.

For More Information

For more information about how to configure content filtering, see the following topics;