Intelligent Message Filter Updates

Exchange 2003 Server SP2 rounds out the anti-spam capabilities of Exchange Server 2003. With addition of Sender ID and IMF filters Exchange server is now capable of protecting an Exchange organization from many spam attack vectors. The flexible, reliable, and robust Exchange 2003 anti-spam framework proved to be very effective and instrumental in protecting Microsoft IT infrastructure from Unsolicited Commercial E-Mail (UCE). However, the anti-spam solution offered by Exchange 2003 SP2 would not be complete without regular updates to the filter and spam definitions.  Spammers constantly change tactics to find new ways to penetrate anti-spam defenses.  And while spam attack vectors become obsolete rather quickly, it is necessary to keep track of them to prevent potential future ‘re-use’ of the attack scheme.  All of this means that getting new spam definitions into production e-mail environments is truly imperative.   


The regular updates to the Intelligent Message Filter (IMF) will allow administrators to place the newest spam definitions onto mail processing Exchange Servers. 


The regular IMF updates functionality can be enabled on Exchange 2003 SP2 servers that have IMF turned on (meaning these servers process inbound Internet mail).  To make the functionality available on the server, new ContentFilterState registry key with the DWORD value 1 must be created under: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Exchange.  The registry entry should look similar to this:



After you create this registry key, the next step would be to go to the Microsoft Update website and select the “Custom” button to scan for IMF Updates package (as shown below):



IMF Updates detection logic will detect the key and offer the package.  


Both the regular IMF updates and the Exchange Intelligent Message Filter itself are language agnostic and supported on all Exchange Server languages.


The update mechanism will maintain the last three versions of the IMF data and binary files on the Exchange 2003 that the updates are being applied to.  Once installed, the IMF update package will appear in Add/Remove Programs under the following name: “Update for Intelligent Message Filter on Exchange Server 2003: 2005.12.09 (KB907747)”.  You should see an entry in the ‘Add or Remove Programs’ (ARP) Control Panel similar to the below:



If you look closely at the name, you will see that ‘2005.12.09’ corresponds to the date when the package was released.  Over the course of the regular update cycle, this date will change while the name/number of the KB itself ‘(KB907747)’ will remain intact.  For example, for the package released on January 18th 2006, the full name will be: “Update for Intelligent Message Filter on Exchange Server 2003: 2006.1.18 (KB907747)”. 


The IMF update package can be uninstalled through the Add or Remove Programs Control Panel.  Removing an update package will trigger Exchange 2003 SP2 IMF binary registration, which will cause the server to use the IMF update binary that was shipped in the original SP2 package.  Uninstalling the IMF updates package will remove the Add/Remove Programs entry, delete an appropriate registry key for the update, and re-register the SP2 IMF binary.  However, as I said earlier, the IMF updates installer will maintain the three most recent last packages on the system.  An actual directory structure should be similar to the below:



It is important to understand that these directories will remain on the system intact and will be available for manual registration if needed so that, for example, you could remove the current package through Add/Remove Programs and run IMF using the previous package.  Corresponding KB907747 goes into great details how to achieve this.


You may be wondering about the frequency IMF updates…  The good news is that updates will be offered every first and third Wednesday of the month!  IMF updates will be available not only through manual installation but also via scheduled Automatic Updates (AU)!  The updates are cumulative (as they incorporate the latest spam definitions and data derived from the continuous learning and feedback loop processes), classified as Rollup Updates, and will be available for WSUS and SMS distributions!  The bottom line is that the IMF Updates will be available through Microsoft Update technologies and the method of implementing an update – e.g. manual, Automatic Update, SMS, etc. – is flexible. 


IMF updates will only be supported on Exchange 2003 SP2 servers with IMF enabled.  For the updates to take effect, IMF updates installer will restart IISADMIN, so the best time to apply updates will be the time when the least amount of mail traffic is expected (e.g. during the night).  The IMF updates installer will always offer the DAT and binary files to keep the Exchange IMF server implementation up to date with the latest anti-spam protection.  IMF is not supported on Exchange clusters and as such IMF updates will not be offered for Exchange clusters.  To summarize IMF updates offerings in a few words:


  1. IMF updates are twice per month
  2. IMF updates are only supported on Exchange 2003 Servers with SP2 where IMF is enabled 
  3. IMF updates are supported on all Exchange server languages
  4. IMF updates are available from Microsoft Update via both manual and AU
  5. IMF updates supports uninstall through Add/Remove Programs and manual rollback

Alexander Nikolayev

Comments (105)
  1. Mitchel Weinberger says:

    Great stuff, however I made the registry change on an SBS2K3 server SP1, Exchange SP2, went to update site and no update found for IMF. Looking in add remove programs there is nothing listed for IMF either. Is there an issue with SBS and this feature?



  2. colin says:

    When will updates first appear in Windows Update?

    Will there be a location to download the updates without using Automatic updates? If so, what? doesn’t have any links for downloading the updates…

  3. Vlad Mazek says:

    Wonderful article Alexander. Thank you for posting it, everyone should get going on IMF v2 deployments.

    There is actually a very good podcast going on at Inside SBS ( I was just talking on it and asked them to discuss IMF and SenderID Specifically. We also talked about Exchange 2003 SP2 on my podcast at

    If any of you reading this blog are new to Exchange administration or are just getting started on deploying SP2 check out the articles on as they will help you get it done right.

  4. Alex Nikolayev says:

    Mitchel, please let me know if you still do not see the first IMF Update on the Microsoft Update website, the package should be availalbe now.

  5. Alex Nikolayev says:

    Colin, IMF Updates will be availalbe through the Microsoft Update service, it is now one-stop updating for all Microsoft products. Actually, preferred method of installation is manual. After all, AU is not 100% true auto-update as with this option you will get a bunch of other updaets that you might not even care about. If you opted-in for AU, you still need to select what updates you want to install (unless you want it all -:).

    Manual mode – you need to go to the MU website, and select ‘Custom’ button as described in my blog. The link to the website is also in the blog, please give it a try! The detection logic will offer an IMF Updates package to you and all you need to do is install it! Let me know if you have more questions.

  6. Alex Nikolayev says:

    Thanks Vlad, on January 17th I will have a webcast and discuss the entire Exchange Server anti-spam framework and then Konstantin Ryvkin from MSIT will shed more light on how Microsoft IT department implements these features. The link to it is:

    I will cover Sender ID and IMF in details, as well as a couple of new anti-spam features that will be available for E2K3 sp2 soon.

  7. David Lee says:

    The update does not show up on my SBS 2003 box either.

  8. Mitchel says:

    Just tried it and still no update on the update site.

  9. Eric Sabo says:

    Just tried it and no updates still.

  10. M Freitas says:

    Tried this and can’t see an update…

  11. Max Power says:

    I would like to mention a concern of ours with the IMF update being handled by auto-update.

    Prior to deploying software patches and fixes into production, we must test them. As a result, we do not use auto-update for deploying updates to our production environment. If IMF updates are only available via AU, it would require a lot of additional work to deploy updates manually twice per month.

    May we suggest making IMF updates available separately from other software updates, much like an anti-virus update is deployed that require minimal manual intervention?

  12. franc1 says:


    I also went to the microsoft update site, but it doesn’t report the update is available. Further more, the update is delivered to WSUS. I approved it for installation, but WSUS reports that the update is not needed on our exchange server ????

  13. Alex Nikolayev says:

    The package should be available by 4:00pm PST today. My apologies for the delay.

    The packages will be available via both AU and manual. If WSUS reports that update is not needed on the exchange server, please make sure yur Exchange server is 2003 SP2.

    We are looking into making IMF Updates available separately from other updates for Exchange 12 server.

  14. Alex Nikolayev says:

    The update is live on MU guys. Please be aware that the installer will restart iisadmin, so for a couple of minutes corresponding services (e.g. smtpsvc) will not be available.

  15. M Freitas says:

    Yes, it is live now!

    Thanks :)

  16. James Sanford says:

    I wonder how WSUS works with this. I would expect without any additional work…

    Also, I’ve followed Vlad’s instructions on enabling IMF, and my Registry Key Value shows ‘2’ instead of 1. I wonder what the difference is…

  17. Alexander Zammit says:

    Great! Regular updates will take IMF to the next level in my opinion.

    The registry key requirement will certainly cause some to miss the updates unfortunately.

    But nevertheless it is a good step forward.

  18. Alex Nikolayev says:

    IMF Updates is the key to maitaining your server’s ability to separate ham from spam so stay tuned!

  19. Joe Vivona says:

    Did all of the above (registry, restart, etc), the update discussed above is not visible on Windows Updates or my WSUS server. Is it still there or am I missing something ?

  20. franc1 says:


    AU reported this morning that it wanted to install the IMF update. It was delivered trhough WSUS, strange that WSUS reported earlier that it wasn’t needed though. But hey, it works now.


  21. Vlad Mazek says:


    Forgive me for the stupid question, but did you check Exchange 2003 as one of the updates to check under for your WSUS subscription?


  22. Chris says:

    I also did the registry addition, restarted and I still am not seeing the update in Windows Update. Help!

  23. franc1 says:


    yes I did. Otherwise the update doesn’t show up in WSUS at all. It just reported the updated wasn’t needed by exchange 2003, but weird thing, next day it wants to install it on the server.

  24. Alex Nikolayev says:

    Chris, IMF updates work on E2K3 sp2 only. What is your config?

  25. Chris says:

    Alex I am running E2K3 sp2 on a 2003 server. The IMF application is running and blocking spam but I am not able to see any updates.

  26. Dan Sheehan says:

    Am I reading the KB right in that SP3 will require the IMF updates to be manually removed before it can be safely applied?

    If so that sounds a little unecessary. I.E. Shouldn’t a goal of SP3 be to deal with admins who put this in place and forgot about it?

    Just remembering customers I support as a consultant who had another consultant enable IMF under SP1 which was supposed to be ripped out before SP2. Customers don’t always know who did what in their enviornment, so it is better IMHO if the service pack can account for that.

  27. Alex Nikolayev says:

    To answer Dan Sheehan:

    Dan, you do not have to remove anything, the case in KB applies to a situation when you apply service pack in a few months after its release. For example, the SP3 has been released in January, and you did not upgraded to it immediately. You, however, continue to apply IMF Updates on regular basis. By August you decide to upgrade to SP3. Now what happens is that the IMF files (both .dll and .dat) are much fresher (because you were installing updates regularly) than the IMF fiels that were released in January with SP3. During upgrade these newer files will be replaced by the older (back from january) IMF fiels that come with SP3, so you need after upgrade to go to Microsoft Updates and install the latest version of IMF files. You do not have to uninstall IMF in order to upgrade to SP3.

  28. Alex Nikolayev says:

    To answer Chris:

    Chris, please double check the ContentFilterState registry location (should be under Exchange). When you go to the MU site, can you see other updates?

  29. Chris says:

    Alex I double-checked and the ContentFilterState registry is in the correct location. When I go to Windows Update and click on Custom I have no High Priority updates listed and I have 2 Software, Optional updates listed which are Microsoft .NET Framework 2.0: x86 (KB829019) and Microsoft Base Smart Card Cryptographic Service Provider Package: x86 (KB909520). Thats the only updates available to me. Thanks for your help!

  30. Chris says:

    Alex I found the problem. I was going to Windows Update instead of Microsoft Update. The update is there and I am downloading it now! Thanks!

  31. Alex Nikolayev says:

    Chris, this is good news! New update will help with catching more spam!

  32. Chris says:

    Alex I have a quick question for you. I have the IMF set to move e-mail with a SCL rating of 5 to the User’s Junk e-mail folder. But, I had an e-mail come into my Inbox this morning that had a SCL rating of 5. Is there anything on my end that I need to do or was it a glitch? Thanks!

  33. Maxim Baturlov says:

    Alex, i wonder if i should copy my MSExchange.UceContentFilter.xml to the newly created subdir in MSCFV2 every time a new IMF update have been installed on my Exchange server? The update process described in KB907747 dont give me an answer to this question. Thanks in advance!

  34. Alex Nikolayev says:

    To answer Maxim’s question:

    Yes, you need to copy the Custom Weight List file to the newly created directory every time when the new update is installed. You also need to reset iis if the file is not working after the move. I will make changes to the KB to address this scenario.

    To answer Chris’s question:

    There is nothing wrong on your end, it was a typo in documentation and we are fixing it. The intended behavior is that mail items with SCL only above 5 will be moved to Junk, so this is the reason you see mail with SCL5 in your inbox.

  35. Jeffny says:

    Regarding the Custom Weigh List. Besides moving the xml file to the newly created directory, do you also have to register the new MSExchange.UceContentFilter.Dll file?



  36. Kerry Jefferies says:

    I have configured the IMF to update successfully on my SBS Server, I had previously been successfully archiveing messages that were given and SCL of 6.

    What I no longer have in my configuration is the ability to enable or disable the IMF on a Virtual SMTP Server under the protocolsSMTP, has something gone wrong with the updates/install?

    I have also tried to manually configure the Archive location in the registry without success either.

    Any ideas?



  37. Kevin Bird says:

    IMF updates are said here to be released _every_ first and third Wednesday, but I can’t get my machines to detect one for this past week, did the update get released?

  38. David Massey says:

    I followed all the advice from Alex and was able to get the update. IMF (with update) is now working fine. Stupidly I had updated to IMF Ver 2 via the exchange service pack and then not enabled it! (

    My problem is that I have been unable to register the UceContentFilter.dll. I get a "module not found" error.

    I have checked and rechecked the path (which is on a "D" drive not under "program files" and I’ve even tried upper/lower case. No joy. Any suggestions? I really want to try the "Custom Weighting Feature" (CWF)?

  39. Alex Nikolayev says:

    Jeff, you do not need to register the binary. IMF Updates installer will do it automatically for you during update. If the CWL file does not work after the move you might need to restart smtpsvc.

  40. Alex Nikolayev says:

    Kevin, due to holidays schedule we did not release IMF Update past week. However, it is scheduled to be released next Tuesday (Jan 10th). Stay tuned!

  41. Alex Nikolayev says:


    IMF Updates do not alter the IMF core functionality. Are you saying that before installing the first IMF Update package you were able to enable/disable IMF under the SMTP VSI and now you can no longer do it? To ease the administration, in SP2 all anti-spam filters located under one single dialog page. Have you looked there? Also, E2K3 SP2 does not create ContentFilter regkey during upgrade, so you need to create it manually.

  42. Alex Nikolayev says:


    This is a link to get you going on MSExchange.UCEContentFilter.xml (Custom Weighting):

    Are trying to register MSExchange.UCEContentFilter.dll or UCEContentFilter.dll? Try to find the binary and regsvr32 it from there.

    My I ask you – why you need to register the binary? It should already be registered either by SP2 upgrade or IMF Updates installer. There is really no need to re-register it. After you create the CWL file, make sure to restart smpsvc to load it into the IMF.

  43. Alex Nikolayev says:

    I really encourage you to sign up for the January 17th webcast. I will not only talk about latest advances in anti-spam technologies available from Microsoft, you will see how Microsoft IT department implements these technologies. As always, the webcast will
    conclude with Q&A session so you get a chance to get into details what these technologies are and how MSIT does it. This is the registration link:

  44. Michel says:

    Today I applied the second available update using WSUS. That AU went OK (I can check the registry for the active version), but now the AU notifies me about another IMF update to install: the old one!

    My control panel shows only the december update?!?

    Should I decline (or even uninstall) previous updates? The WSUS details don’t say this january update supersedes others so both are still available for install.

    (Also, please let me know if I should report this to PSS)

  45. Phil says:

    I installed the first IMF update 2005.12.15 successfully via microsoft update. Today I tried to install the second update 2006.01.05.

    The update failed with error code 0x80246002. This is the first time I have had this error with microsoft update. What does this error mean and what can I do to install the update?

  46. Jon says:

    We applied Exchange 2003 SP2 last year without incident, and we enabled and

    configured IMFv2 to pull updates down from Microsoft Update with no


    The December 15, 2005 IMF Update (6.5.7757.0) was identified and installed

    correctly last year.

    Last night as part of the regular monthly updates, a new update to IMF was

    identified, January 5, 2006 IMF Update (6.5.7765.0), we applied it along

    with the other Critical Updates and rebooted the server.

    When the server came back up shortly after, Automatic Updates identified the

    old December Update to IMF as needing to be installed even though it had

    already been installed a month ago. (The "updates needed" notification is

    from the yellow shield icon in the system tray.)

    We went ahead and re-installed it, and once it was applied, Automatic

    Updates then identified the January Update to IMF again, and we applied it


    Once again, Automatic Updates claimed that the December Update to IMF was

    needed – we stopped there and are for now ignoring the notification message.

    Automatic Updates notification appears to be caught in a loop trying to

    apply IMFv2 updates.

    Is anyone else seeing this behavior? How can this be fixed so that it

    doesn’t incorrectly identify IMF updates that have already been applied (yet

    will continue to look for _real_ new updates)?

  47. Scott says:

    I am experiencing the exact same issue you are Jon with a brand new install of Windows 2003 SP1 and Exchange 2003 SP2. In my case I am using Microsoft Updates. It first had me install the Dec 15th IMF Update, and then Jan 5th IMF Update. Then it wanted the Dec 15th IMF Update again. I have gone through installing both of these IMF Updates a few times and it doesn’t seem to stop.

  48. Alex Nikolayev says:


    Regarding the old update (December’s update) – you do not need it. The reason it appeared on MU is that it was not expired in timely manner and you got it. You do not need to have an old update re-installed and it’s gone from MU. Next time we release an update will be 1/18/06, we are back to normal release schedule – 1st and 3rd Wednesday of the month.

  49. Alex Nikolayev says:


    This error indicates that the downloaded content’s hash did not match what was expected. If you are flexible with your environment, try to reinstall again. Let us know if you still can not do it. I will look into this from the development side. My apologies for this.

  50. Dan Sheehan says:

    The 12-15-05 update still keeps showing up on MU. So either it wasn’t really pulled, the pull you did hasn’t replicated to all MU servers, or my server has it cached locally some how.

    It is 8:40AM EST on 1-12-05.

    So can you tell us what to do to clear this out?

  51. Phil says:


    thanks for the reply. I did manage to download and install the Jan. update. I was then in the cycle of being offered the Dec. update, Jan. update, etc. as others reported. I’m still not convinced that the Jan update installs correctly.

    After installing the Jan. 5 update, the following directories are present as expected:

    Drive_Letter:Program FilesExchsvrBinMSCFV2

    Drive_Letter:Program FilesExchsvrBinMSCFV26.5.7757.0

    Drive_Letter:Program FilesExchsvrBinMSCFV26.5.7765.0

    However, add/remove programs still shows the Dec. update for removal. According to your article, this should now show the Jan. 5 update.

    The registry has the following entries:

    [HKEY_LOCAL_MACHINESOFTWAREMicrosoftUpdatesExchange Server 2003SP3KB907747]





    "PublishingGroup"="Exchange Sustained Engineering"

    "Publisher"="Microsoft Corporation"


    "PackageName"="Update for Intelligent Message Filter on Exchange Server 2003: 2006.01.05 (KB907747)"

    "Description"="Update for Intelligent Message Filter on Exchange Server 2003: 2006.01.05 (KB907747)"



    "UninstallCommand"="C:\WINNT\$ExchUninstallKB907747$\spuninst\spuninst.exe "


    [HKEY_LOCAL_MACHINESOFTWAREMicrosoftUpdatesExchange Server 2003SP3KB907747Filelist]

    [HKEY_LOCAL_MACHINESOFTWAREMicrosoftUpdatesExchange Server 2003SP3KB907747Filelist]



    "BuildDate"="Thu Jun 16 18:19:10 2005"


    "Location"="C:\Program Files\Exchsrvr\bin\MSCFv2\6.5.7757.0"

    [HKEY_LOCAL_MACHINESOFTWAREMicrosoftUpdatesExchange Server 2003SP3KB907747Filelist1]



    "BuildDate"="Tue Dec 13 12:30:05 2005"


    "Location"="C:\Program Files\Exchsrvr\bin\MSCFv2\6.5.7757.0"

    Are these entries complete and as intended?

  52. Alex Nikolayev says:


    If you are using WSUS, new sync wirh MU will solve the problem. If you are using AU/site download, it should be fine by now. I’ve addressed this for the next release and looking into expiring the previous update 1 day in advance. What you think about this?

  53. Alex Nikolayev says:


    Can you please verify the Version of the package – under Add/Remove programs, Update for the Intelligent Message Filter …. click on the "Click here for support information". In the Support Info dialog box you will see the Version string. What do you have in there?

    The registry values you provided are expected.

  54. Phil says:


    ah! Yes, once I look at the support info. dialog box the version string is for the Jan 5th update.

  55. Alex Nikolayev says:


    I’m happy you are OK! Let me know if there are any other questions wrt IMF Update process.

  56. Dan Sheehan says:

    Not using WSUS.

    The MU site is no longer showing the old patches so thank you. I will set the server I am testing this on back to applying automatic updates.

    As far as expiring the update one day in advance – Why can you just expire it at the same time you post the new version? Does it not replicate out the expiration of the old hot fix?

    I.E. You should be able to post the new update just like any other signature solution. Always have one available until a new one is ready, and then swap them out.

    If MU can’t handle this, then maybe you shouldn’t be using MU to push out the updates?


  57. Alex Nikolayev says:


    It takes time to prop the expiration change to the front end servers, and during this expiration window both packages could appear. I want to avoid this. I’m looking into alternative solutions, stay tuned.

    Thank you for your feedback, I appreciate it!

  58. Dan Sheehan says:

    If expirations take a while to replicate to the front-end servers, then wouldn’t also new packages? I.E. Wouldn’t deletes take just as long as adds to replicate?

    Either way – I am noticing a lot more SPAM getting through the email system. It could be because I am somehow using the older files, even though MU doesn’t show any new updates. I will hold off until you all release your next update (soon I hope) before I make any assumptions though.

  59. Alex Nikolayev says:


    New update will be available on Wednesday, Jan 18th. When have you noticed an increase in spam? We released 2 updates after RTM, which one was working the best for you? Let me know if you see the trend after the newest update.

  60. aaron says:

    Since applying the two recent updates, I am receiving the following event error in Application Event Log:

    Event ID 7514 : SMTP Protocol

    "An error occurred while loading Microsoft Exchange Intelligent Message Filter. The error code is <0x80004005>."

    These appear sporadically in my event log, at no specific interval. I am *NOT* using the Custom Weighing functionality… or at least, I do not intend to be. I do not have the XML file in any of my folders, and I’m not aware of any registry keys that might make it think otherwise. I have also attempted to register the new DLL again and restarted the SMTP service.

    My mail services do appear to be functioning as expected though, so I consider it low priority, but still, I would like to identify a resolution. Any thoughts or solutions? If you require more info, please let me know.

  61. Alex Nikolayev says:


    We released new IMF Update package today. Please install it and let me know if you still have a repro.

  62. aaron says:

    Sorry Alex,

    I am still receiving the error message even after yesterday’s update.

    Also, I need to correct a typo in my original error message. It should read:

    Event ID 7514: SMTP Protocol

    "An error occurred while loading Microsoft Exchange Intelligent Message Filter. The error code is 0x80070005."

  63. I don’t know if we are unique in our Exchange architecture but we have a 2-node cluster without any front-end servers. This means, as I understand it, that we cannot use IMF?

    Is there any workaround, short of setting up a front-end server?


  64. Alex Nikolayev says:


    IMF is not supported on Exchange cluster, and there is no workaround. Sorry for the bad news.

  65. Alex Nikolayev says:


    I did not forget about you :)

    It looks like a new issue and I’m digging through the code to see what else can cause such behavior.

  66. aaron says:

    No worries Alex… I’ll keep checking back periodically. This is, for now, a low priority bug as mail is still being filtered so far as I can tell, and it’s not causing any apparent problems yet.

  67. Tran says:

    a little off topic, but does anyone know where i can get some information regarding IMF and its performance impact on the server? thanks.

  68. ML49448 says:

    I have just installed Exchange Service Pack 2. The Intelligent mail filter is working as the SPAM is being archived but I am unable to update the filters. I have checked all the previous comments and as far as I can tell I have the registry key installed and the updates should be working. The filters I have are dated 17th August 2005 and Microsoft update does not detect and ask to apply the new filters.

    Is there a way to manually download the updates away from Microsoft Update.

  69. Alex Nikolayev says:

    Guys, if anybody has the perf data for IMF I’d love to see and compare it to internal data derived from testing the filter inside of Exchange. Are you interested?

  70. Alex Nikolayev says:


    The detection logic based on 2 checks:

    1. The proper version of E2K3 SP2

    2. The registry key described in the article above.

    So if you have a binary that is not recognized, updates will not be offered. 8/17/05 is the time when we were running TAP pilot for IMFv2. Can you share the version# and registry info (look above at the sample provided by Phil) please? Any ideas how the binary landed on the box?

  71. Dan Sheehan says:

    The new IMF update went in like a charm. My system dramatically stops a lot more SPAM than it did with the messed up updates. So things seem to have straightened themselves out.

    BTW, I have notice that even with the IMF set to move anything with the SCL of 5 to Junk Email that this does not always happen. I have the SCL code turned on in my verison of Outlook and notice that Outlook itself moves mail to the Junk Email folder (it wasn’t there in OWA) and shows a SCL of 5 when it does. Does this mean the SCL hueristics in Outlook are different than the SCL heuristics in IMF?

    Thanks for the good work guys, the product gets better and better every year.

  72. ML49448 says:


    Thanks for the response

    I don’t have the SP3 keys in the registry as per Phil’s post I also only have the original MCVF2 sub folders.

    The filters I have were installed by the service pack and are the same files that were extracted from my original download late december with a date on the file of 16th December 2005.

    I have just redownloaded the Service pack and extracted and the 2 files in the MCVF2 folder are the same version that I have being dated 17th August 2005.

    I have attached the Exchange key for reference

    Windows Registry Editor Version 5.00


    "Server Language"=dword:00000409






    [HKEY_LOCAL_MACHINESOFTWAREMicrosoftExchangeActive Messaging]

    "Use Express"=dword:00000001



    "Exchange Scan"="4.0;C:\Program Files\Network Associates\VirusScan\scanemal.dll;1;11000000000000;1110000;"










    [HKEY_LOCAL_MACHINESOFTWAREMicrosoftExchangeExchange Provider]





    "NameForE2K"="E:\Program Files\Exchsrvr\exchweb\bin\exwform.dll"

    "ResourceDllBasePath"="E:\Program Files\Exchsrvr\res\"






    "Max Async Threads"=dword:0000000a













    "ForestPreparation"="E:\Program Files\Exchsrvr"

    "ForestPreparation Version"=dword:00000041

    "DomainPreparation"="C:\Program Files\Exchsrvr"

    "DomainPreparation Version"=dword:00000041

    "BrowseCap.ini"="E:\Program Files\Exchsrvr\bin\browscap.ini"

    "Services"="E:\Program Files\Exchsrvr"

    "Services Version"=dword:00000041

    "ExchangeServerAdmin"="E:\Program Files\Exchsrvr"

    "ExchangeServerAdmin Version"=dword:00000041










    "Doctor Watson.NET"=dword:00000002

    "Required machine-level settings"=dword:00000001

    "Administrative Group"=dword:00000001








    "DSAccess settings"=dword:00000001

    "Services Atom"=dword:00000002

    "Microsoft Exchange WMI Providers"=dword:00000002


    "Messaging and Collaboration Event Logging"=dword:00000002

    "DS Access Event Logging"=dword:00000002



    "Connectors Event Logging"=dword:00000001





  73. Vasilij Maksimenko says:

    A problem has been found after IMF update. It obviously much worse filters russian spam than before. Could you please comment this fact?

    P.S. The english version of IMF was updated from original version (supplied with Exchange Server 2003 SP2) to 6.5.7770.0

  74. Alex Nikolayev says:


    Your registry is looking golden, I see no issues. Please ensure you are going to the MU site, not Windows Update, and have the above regkey set in the correct location. You should not have any problems.

  75. Alex Nikolayev says:


    Are you saying that if you go back to the RTM files of IMF they filter Cyrillic spam more efficiently than new update?

  76. Vasilij Maksimenko says:


    Yes, and it is very essential.

  77. Alex Nikolayev says:


    IMF Updates are based on 7x24x365 machine learning process. Some of the spam definitions for Cyrillic mail (Cyrillic only), included with the RTM version of IMF engine, were too restrictive. Based on the feedback from multiple Russian customers, these ‘features’ were removed in December’s update. As always, there is a trade-off (FNs vs. FPs). Russian customers, who reported original problem, are satisfied with the current definition set and IMF behavior now. May I suggest to evaluate Custom Weight List file implementation and adjusting thresholds?

  78. Kaj Lehtinen says:


    I’ve installed the latest IMF update through MU, but I keep getting (and have gotten always on this server)

    "An error occurred while loading Microsoft Exchange Intelligent Message Filter. The error code is 0x800401f3."

    The server is a SBS2003 with SP1 & Exchange 2003 SP2


  79. sandyl says:

    I have Ex2003SP2 with IMF installed and active. One of my users has begun to have email from our internal organization sent to her junk email box. By displaying the SCL as a field, it clearly shows the SCL rating as -1 and when I right click and say "mark as not junk" it says "this message will be moved back to the inbox"…

    there are no individual alerts or rules set up on this workstation.

  80. Jeff25 says:

    did the IMF "enabled" setting under Server / Protocols / SMPT get removed in SP2?

    If the first release of IMF, it added a new tab along with the other content filtering, but it also added a new branch under "SMTP" protocol where you enabled IMF for each server instance. It is no longer in the system manager? The tab is still there, but the place to enable for each VSI is missing on my machine (after the SP2 upgrade)

    I uninstalled IMF version 1, and installed the required hotfixes before Sp2.

  81. Alex Nikolayev says:


    Please start troubleshooting with OLK. It looks like OLK not IMF placing the mail into Junk.

  82. Alex NIkolayev says:


    Correct, SP2 removed the IMFv1 anti-spam config object from the SMTP VSI. Now all anti-spam technologies have been integrated under single location for ease of administration.

  83. tom says:


    having same problem like Aron, after update recieving errors in log, not using custom dictionary too. Anything new about this? Thanks

  84. Mike W says:

    I have finally managed to get the IMF updates working – thanks for your comments in this blog everyone!

    But, now I want to tweak the filtering with custom weighting. Can anyone explain why the first of the two XML files below works, when the second one (with an extra line) doesn’t? There are no error messages in the event log – just a message to say the file has been updated.

    <?xml version="1.0" encoding="UTF-16"?>

    <CustomWeightEntries xmlns=""&gt;

        <CustomWeightEntry Type="SUBJECT" Change="MIN" Text="Alert Notification"/>

        <CustomWeightEntry Type="SUBJECT" Change="MIN" Text="[From web form]"/>

        <CustomWeightEntry Type="SUBJECT" Change="MAX" Text="Ultimate Online Pharmaceutical"/>

        <CustomWeightEntry Type="SUBJECT" Change="MIN" Text="[Web System Error]"/>

        <CustomWeightEntry Type="BOTH" Change="MIN" Text="XYZZY"/>



    <?xml version="1.0" encoding="UTF-16"?>

    <CustomWeightEntries xmlns=""&gt;

        <CustomWeightEntry Type="BOTH" Change="3" Text="loqo"/>

        <CustomWeightEntry Type="BOTH" Change="3" Text="Ioqo"/>

        <CustomWeightEntry Type="SUBJECT" Change="MAX" Text="Ultimate Online Pharmaceutical"/>

        <CustomWeightEntry Type="SUBJECT" Change="MIN" Text="[From web form]"/>

        <CustomWeightEntry Type="SUBJECT" Change="MIN" Text="[Web System Error]"/>

        <CustomWeightEntry Type="SUBJECT" Change="MIN" Text="Alert Notification"/>

        <CustomWeightEntry Type="SUBJECT" Change="MIN" Text="XYZZY"/>

        <CustomWeightEntry Type="BODY" Change="MIN" Text="XYZZY"/>


  85. wyosteven says:

    Alex and Jeff,

    I too experienced the missing IMF object from SMTP VSI… This is extremely poorly documented if it is by design and I have to say that all IMFv2 documentation I have found has instructions to enable it via IMFv1 methods!  I have also found that there is a missing binding in the registry HKLMSoftwareMicrosoftExchangeContentFilterContentfilteringbindings which is now null (blank)… is this by design too?  Getting this word out might be important as it is VERY confusing…  If the contentfilteringbinding key SHOULD have a value where might one find the hex ID for the SMTPVS in order to enable it?

    Thanks everyone!

  86. wyosteven says:

    Alex and Jeff (and rest of world):

    I did some research on some of the complexities I was complaining about above.  The following site has terrific explainations of the aformentioned:


  87. Larry Brandmeyer says:

    This is an awesome tool.  Thanks for taking the time and effort to create it.  I especially like the autoupdate feature through WSUS.

  88. CLWill says:

    I LOVE IMF, and this feature makes it all but perfect.  But help!?!

    I saw this blog and was ecstatic.  Been running IMF V1 since it first came out, was waiting to install EX2003 SP2 until I confirmed this update feature was added.  Here it is, WOW, great.  Except it broke my IMF!

    I had IMF V1, so I ran add/remove progs. to remove it, ran the SP2 update, all seemed to go OK,  paniced when I didn’t find the tab on the SMTP service, but read more here and find that’s gone (OK), but my IMF isn’t working.

    I’m getting all kinds of crap in my junk email folders, my IMF perf counters are all zero, the directory where I put all the archived UCE is empty, what’s up?  The IMF tab on Message Delivery is there (with all my V1 settings intact), all *looks* ok, but I’m hosed?

    Anyone have any ideas?

  89. CLWill says:

    OMG, Never Mind…

    The documentation for IMF truly stinks.  All it says is "be sure to enable it".  Nowhere in the world does it say to go into the SMTP Default Virtual Server, find the properties tab, click on the "advanced" button, etc., etc.  Sheesh…

    And if you search for IMF in the support pages, all you get is V1 docs!  This is terrible…

    Thanks to wyosteven for the excellent link to some real documentation.


  90. Chris Lau says:

    Dear Guys:

    I got a problem when I upgrade my exchange2003 to sp2.

    I uninstall the "Exchange Intelligent Message Filter" V1 from Add or Remove Program in Control Panel as usual…

    But it hangs for a days say cannot stop the IIS admin. I try to stop the IIS service manually but no use…

    It last for a day, so I need to end task the uninstallation in Task manager….

    I have a reboot and god bless all service start as normal.

    But the entry "Exchange Intelligent Message Filter" in Add or Remove Program disappeared.

    So, I cannot update my exchange2003 to sp2.

    I found that the old Exchange Intelligent Message Filter files still in my

    C:Program FilesExchsrvrbinMSCFv1

    Can anyone told me how can I unistall it / reinstall it manually.

    My database is near 16G capacity….

  91. Jeffny says:

    Everything with IMF including the updates is working smoothly for me (exchange 2003 SP2, IMF v2).  But I am having trouble with the MSExchange.UceContentFilter.xml file.  I don’t doubt for a moment that I being stupid, but when I format the file as follows:

    <?xml version="1.0" encoding="UTF-16"?>

    <CustomWeightEntries xmlns=""&gt;

        <…bunch of other entries that work fine until this final one>..    

    <CustomWeightEntry Type="SUBJECT" Change="MIN" Text="Your Ticket Purchase"/>    


    What happens is, every message with the subject "Your Ticket Purchase" gets an SCL rating of 9 and sent to the archive.  I thought the MIN keyword would give it a 0, but it isn’t happening.  I tried using Change="0", but it still gave every message a 9.  One thing, every other entry in the file uses Change="MAX".  This is the only record that uses MIN.  I’m lost.  Any ideas?  

    Thanks, Jeff

  92. Dutchy says:

    I must have missed something or just didn’t really notice. I loaded Exchange SP2 before I uninstalled IMF Ver 1, is this going to cause any problems. My ContentFilterVersion = 0 in regedt under Exchange and I have manually set this to = 2, or should I uninstall the lot and go again?

  93. leelo7 says:

    Hi Alex,

    Can you tell me if there is any way i can check what filter update version is being used? The reason I ask is because the update all ran smoothly for me and I wasn’t sure if the update restarted any services. So I restarted IISADMIN manually just for my own pice of mind. However, I’d like to write a vbscript or use some utility that actually confirms that version such and such is being used.

    I know if I go to add/remove the last update I downloaded/installed is there but I want to make sure.

    Maybe a future Exchange 2003 update could be a little report in the ESM a bit like the about dialogs in popular AV software. Or at the very least something in the event logs.



  94. leelo7 says:

    Ok I’ve actually just read my event logs again and noticed the entries confirming successfull installation. So now I’d just like to know if there is a way to check this with vbscript other than using vbscript to read the event logs.


  95. Fred Andreone says:

    Hi to all,

    The IMF V2 filter has been working well since it was installed.

    The only issue I have noticed is with the automatic update of the the filter. Everytime the filter updates at 11:00 EST the SBS2k3Sp1 ExchSP2 full system backup fails with a VSS 6013 error.

    Sqllib error: OLEDB Error encountered calling ICommandText::Execute. hr = 0x80004005. SQLSTATE: 08S01, Native Error: 11

    Error state: 1, Severity: 16

    Source: Microsoft OLE DB Provider for SQL Server

    Error message: [DBNETLIB][ConnectionWrite (WrapperWrite()).]General network error. Check your network documentation.

    This error only occurs when the IMF filter is updated. All other days the backup completes properly.

    The problem can be resolved if there is a way to change the time of this particular update.

    This is the only automatic update that causes this issue.

    Many thanks


  96. Anonymous says:

    I wasn’t aware of this but having IMF updated every 2 weeks without (much) work is very handy. By default you have to do it manually, unless you set HKLMSOFTWAREMicrosoftExchangeContentFilterState to a DWORD of 1.

    More technical details here:

  97. Anonymous says:

    Exchange 2003 SP2 includes Intelligent Message Filters (IMF) 2.0. Also an auto update option is available,…

  98. Anonymous says:

    Hi All,

    I thought I would introduce myself to the BLOG-O-Sphere, my name is Scott Roberts and I’m a…

  99. Anonymous says:

    Suite &#224; ma session avec Christophe Vall&#233;e des Microsoft TechDays, voici quelques ressources utiles sur

  100. Anonymous says:

    Suite &#224; ma session avec Christophe Vall&#233;e des Microsoft TechDays, voici quelques ressources utiles sur

  101. Anonymous says:

    Suite &#224; ma session avec Stanislas Quastana des Microsoft TechDays, voici quelques ressources utiles sur

  102. Anonymous says:

    Suite &#224; notre conf&#233;rence s&#233;curit&#233; avec Fabrice ( ) au Lyc&#233;e Gaston

  103. Anonymous says:

    Suite &#224; notre conf&#233;rence s&#233;curit&#233; avec Fabrice ( ) au Lyc&#233;e Gaston

Comments are closed.