I have a box running Server 2008 R2, Exchange 2010 SP1, and Forefront Protection for Exchange 2010.
The issue is that I cannot for the life of me get my content filters to quarantine a single message that is supposed to be tripping the filters. I've been sending myself emails that should be quarantined from several personal email account with different providers. Nothing. FPE Content Filtering is enabled and set to scan Internal, Incoming, and Outgoing messages and I cant get it to filter!
To be more specific. I have a keyword filter set up with a few words like "Viagra" "Make Money Fast" and a few others. I send myself emails from gmail, cox.net, etc. to an email address within my domain, with these words in the body and subject.
Forefront is configured to scan Internal, Outgoing, and Incoming messages and is appending the default "Suspect:" string to the subject when the keyword filter is tripped, but the are not being quarantined as intended. All of the them get through to the intended recipient.
Each message was being assigned an SCL of -1 but I found a PS command that changed this to zero. This seemed to resolve the issue for some people, but it didn't for me.
My keyword filter Target Action was already set to "Purge", and Quarantine was already set to "Yes" and the filter is being applied to all traffic.
All of the incoming mail that trips the filter shows up in the Quarantine View correctly, like you say. The details specify that they are inbound traffic from an external sender, and the metrics on the Dashboard reflect the messages received so I know that they are being scanned.
However, the emails still make it to the users mailboxes. I'm stumped.
Best Answer
You seem to have configured the Target Action in your keyword filter list to the "Identify in Subject line" option.
Select either Purge or Delete as the action type and opt Yes to Quarantine files
The messages matching your keyword filter will now only be available from the Quarantine View
Be sure to enable the keyword list for inbound mail
Check out the TechNet documentation on Configuring filtering for more information