EzCloudInfo

In this article we will have a look at steps to identify the spam emails circulated in an environment. When a user suspects any spam email and informs the IT Team  first and the foremost thing that would come to an Admin is that whether the emails have been circulated to everyone or not.

There are multiple scenarios where the spam messages can be circulated in an environment.

• From single spam source  email address to single recipient.
• From Single spam email address to multiple recipients.
• From multiple spam email address to multiple recipients with different subject line.

Its always better to make a search in the whole organization to make sure the emails are not circulated to all the users.

The easiest way to identify the spam emails is to run a search command with the subject line so that all the affected mailbox can be identified.

Now we will have a look at the steps to perform this action with search-mailbox command.

First we need to add the user who is going to perform this task to Discovery Management group
This should be done in order to use the search-mailbox command. If we do not add this then the user won’t be able to run search command.

Create a new role group as below. We need this in order to export/Import the contents from the source mailbox and copy it to the target mailbox.
Run the below commands to create the role group if we don’t have already . If we have the import/export rolegroup already then just add the user who is going to perform this action into that rolegroup.
To Create –  New-RoleGroup “Mailbox Import-Export Management” -Roles “Mailbox Import Export”
To Add user – Add-RoleGroupMember “Mailbox Import-Export Management” -Member Administrator

Even if single user suspects a virus message it is better to search in the whole organization to make sure the emails are not circulated to others.Now run the below command to search the virus email throughout the organization. In our example we are going to identify an infected email with the subject “Virus Infected”

get-mailbox -ResultSize unlimited -IgnoreDefaultScope | search-mailbox -SearchQuery ‘Subject:”virus infected”’ -LogOnly -TargetMailbox administrator -TargetFolder filter -LogLevel Full

Once we run the command we could see the searching would be started as shown in the above screenshot. The search results may take some time depending upon the environment and number of mailboxes we have.

Upon a successful completion of search we can see the logs and the emails in the zip file attached as shown in the screenshot.

Now we need to run the below command to search the infected emails and delete all of them in the whole organization

get-mailbox -ResultSize unlimited -IgnoreDefaultScope | search-mailbox -SearchQuery ‘Subject:”virus infected”’ -TargetMailbox administrator -TargetFolder filter -deletecontent -LogLevel Full

Once it identifies the affected emails it would ask us for confirmation as shown above before deleting the suspected emails as shown in the screenshot above.

Apart from the above as an additional part of security check we can also run a message tracking with the subject in the whole organization to see to whom all the infected emails have been circulated and ensure all the emails have been deleted.

Run the below command to perform a Message Tracking with subject in the whole organization. In our case we are using the subject “Virus Infected” .

Get-ExchangeServer | where {$_.isHubTransportServer -eq $true -or $_.isMailboxServer -eq $true} | Get-MessageTrackingLog -Messagesubject “Virus Infected” | Select-Object Timestamp,ServerHostname,ClientHostname,Source,EventId,Recipients | Sort-Object -Property Timestamp

Imp Note Note:

Hi Please add your account to Discovery Management role group for the search-mailbox command to work.

Add-RoleGroupMember -Identity “Discovery Management” -Member Administrator

Above method can be used to identify and delete any circulated spam email in our organization.

Thanks

Sathish Veerapandian

MVP – Exchange Server

Microsoft has built in Anti spam feature which can be enabled from Exchange 2003 versions. We can enable this feature as a part of additional security along with additional spam configurations and settings that have been configured before it reaches our network.

But we need to always ensure that we are aware of all the settings configured in the spam filtering in our organization in all the levels as it can interrupt the end users in sending and receiving emails if this configuration is not correct.

In this article we will be looking at how about Anti spam features in Exchange 2013 and its features

Now we will look at how to enable the Anti spam feature in Exchange 2013

By default the Anti spam agents are installed in Exchange 2013 if enable Anti spam option  during the time of installation. Else we need to install them after the installation.

In Exchange 2010 the Anti-spam will be enabled on the HUB & Edge servers.

In Exchange 2013 we need to enable Anti-spam agents in the Mailbox servers since the transport categorization takes place on mailbox server.

 From Exchange 2013 SP1 we have edge servers in which we can enable the Anti-spam agents as well.

The installation of the Exchange Anti-spam agents is the same step as we do it for Exchange 2010.

We just need to navigate to the exchange installation path directory and navigate to below location and install the Exchange Anti-spam.

Once the Anti-spam is installed  we need to restart the Microsoft Exchange Transport Service for the changes to take effect.

After we restart the transport service we can run Get-Transport agent and see if Exchange Anti-spam agents are installed.

We can further have a look at this by pipe-lining the output 

Now comparing the differences between anti-spam agents in Exchange 2010 and 2013.

This is the output of the Exchange Anti-spam installed on Exchange 2010.

This is the output of the Exchange Anti-spam installed on Exchange 2013.

When we compare the Exchange Anti-spam agents between Exchange 2010 and 2013 we can see in Exchange 2013 there is a new transport agent  component called Malware agent which is been introduced. This is a built in Antimalware protection for on premise which can be enabled for additional security.

Also we can notice that the connection filtering agent is not present in Exchange 2013 mailbox servers and they are present in the Edge transport servers since the connection can be decided and filtered at the perimeter level itself.

Once after we enable this Anti-spam agents there will be a default Anti-spam created as we can modify them through EAC as well as shown below.

In addition to the default malware policy we can always create custom policies as per our requirement and assign to our organization. There are more parameters which can be altered. Below is an example.

This Exchange Anti-spam feature is a global level feature which cannot be altered server level and group level.

It’s always better to download antimalware engine and definition updates from Microsoft Download Engine and Definition Updates to keep the Anti-Spam Features up to date.

Microsoft Exchange 2013 has the basic antimalware settings which can be enabled during the installation

By default we have a default malware policy which can be modified according to our needs.But it cannot be deleted.

We can create our our malware policy according to the company needs.

Below are the steps to configure malware in Exchange 2013

Open EAC – Click on protection and you will get the malware filter tab

Click Edit to edit the default malware policy

Click on settings and you can give any desired description on our own for this policy

We have malware detection options as shown below and can use any of them .

Also we have options to send messages to the internal/External senders about the NDR

Also we can notify administrator about the spam messages. We can specify customized notification text message as well.