Marshal Knowledge Base

Can't access Spam Quarantine Management system, 'Access denied'

Oliver Stanley — Mon, 18 Aug 2008 04:56:00 GMT

Abstract:

This article applies to:

MailMarshal SMTP 6.x
MailMarshal Web Components

Symptoms:

When logging into the Spam Quarantine Management website, you receive the following error:

CheckNTLMUser Failed - Error 5 - Access is Denied

Information:

The most common cause of this error is that a password has expired for the account specified within the MailMarshal Web Configuration Tool or the administrator account being used to connect to the MailMarshal Array Manager has been removed from the Active Directory.

If all MailMarshal servers are located within a DMZ, and no Global Catalog server is accessible by either the Web Components or the MailMarshal Array Manager, the account specified for the MailMarshal Web Configuration Tool should be a local account on the MailMarshal Array Manager server, with administrative privileges.

Fix:

To correct this error, open the MailMarshal Web Configuration Tool, and on the Spam Quarantine Management tab enter a username and password with sufficient privileges.

In MailMarshal 6.4 and above:

In the C:\Program Files\Marshal\MailMarshal Web Components\Spam Quarantine Management directory edit the web.config file and below <appsettings> change <add key="InitialConfigurationComplete" value="True" /> to <add key="InitialConfigurationComplete" value="False" />.
Save the

How do I troubleshoot LDAP connections to Microsoft Exchange 5.5 Server?

Oliver Stanley — Fri, 15 Aug 2008 06:14:00 GMT

Abstract:

This article applies to:

MailMarshal SMTP
Microsoft Exchange 5.5 Server

Question:

How do I troubleshoot LDAP connections to Microsoft Exchange 5.5 Server?

Symptoms:

Error: "Unable to connect to server, Do you want to continue?"
Error: "Failed to download any group. Make sure you have provided the correct login etc."
Error: "Downloaded five group(s) but could not get any member."
Error: "87 - The parameter is incorrect."

Procedure:

Depending on the error message or symptom, the following information should help to resolve the issue:

"Unable to connect to server, Do you want to continue?"

Incorrect user name and/or password in LDAP connection.
Or
Windows NT Challenge/Response is disabled as a form of authentication that clients are allowed to use. In Exchange 5.5 this is enabled in the LDAP Site Defaults Properties (go to Administrator | Configuration | Protocols | LDAP | Authentication).

"Failed to download any group. Make sure you have provided the correct login etc."

"This server requires me to logon" is not selected in the LDAP connection, and Anonymous access of LDAP groups is disabled on the Exchange Server.
Or
In the LDAP Site Defaults Properties, under the Search tab, the "Maximum number of search results returned" is less than the total number of groups to be returned.

Downloaded five group(s) but could not get any member. Make sure that you have provided the correct login.

"This server requires me to logon" is not selected in the LDAP connection, and Anonymous access of LDAP groups is enabled on the Exchange Server.

Problems Populating Groups

Once the LDAP connection is successful, when creating an LDAP group, problems may be encountered pop

How do I create a MailMarshal Test Environment on a single machine?

Oliver Stanley — Fri, 15 Aug 2008 03:31:00 GMT

Abstract:

This article applies to:

MailMarshal SMTP

Question:

How do I create a MailMarshal Test Environment on a single machine?

Procedure:

How to send and receive mail in a test environment using MailMarshal and Outlook Express only.

Create two Identities in Outlook Express. One will be used to send, the other to receive.
Sending Identity: create an Identity with the following Mail Account properties:

Display Name: Test Sender
Email Address: test@outsidedomain.com
My incoming mail server is Pop3
Incoming Mail Server: 127.0.0.1
Outgoing Mail Server: 127.0.0.1
Account name: test
Password: test
Receiving Identity: create another Identity with the following Mail Account properties:

Display Name: Test Receiver
Email Address: test@localdomain.com
My incoming mail server is Pop3
Incoming Mail Server: 127.0.0.1
Outgoing Mail Server: 127.0.0.1
Account name: test
Password: test

In the MailMarshal Configurator add localdomain.com as a local POP3 domain. Then create a test POP3 user with the following email address – test@localdomain.com

How do I send a test message?

In Outlook Express Switch Identities to Test Sender. Send a test email to test@localdomain.com.
To read email Switch Identities to Test Receiver. You may need to synchronise with the POP3 Mail Server (127.0.0.1)

The Console Mail Recycle Bin won't empty

Oliver Stanley — Fri, 15 Aug 2008 02:58:00 GMT

Abstract:

This article applies to:

MailMarshal SMTP 6.x

Symptoms:

The empty recycle bin option is disabled on the Console's Recycle Bin context menu, despite the presence of deleted e-mails in the Recycle Bin.
Cannot empty the Recycle Bin.

Resolution:

Upgrade to the latest version of MailMarshal SMTP to resolve the issue.

If you are still experiencing the symptoms contact Marshal support.

This article was previously published as:: NETIQKB49464

How do I use MailMarshal Secure with MailMarshal SMTP 6.X?

Charles Creegan — Thu, 14 Aug 2008 22:35:00 GMT

Abstract:

This article applies to:

MailMarshal SMTP 6.X

Question:

How do I use MailMarshal Secure with MailMarshal SMTP 6.X?

Procedure:

MailMarshal 6.X does not include the S/MIME secure email module (MailMarshal Secure) that was available in MailMarshal SMTP 5.5.
It is recommended you upgrade to MailMarshal 6.4.5 and install MailMarshal Secure Email Server. See the following Marshal knowledge base article for more information.

Q10525 : Configuring MailMarshal SES with MailMarshal SMTP

Refer to the user guide for installation instructions. See the MailMarshal Secure Email Server Support page at the Marshal website for more information. (log in required).

This article was previously published as:

NETIQKB40562

MailMarshal Vulnerability to TAR Directory Traversal Attacks

Charles Creegan — Thu, 14 Aug 2008 22:29:00 GMT

Abstract:

This article applies to:

MailMarshal SMTP
MailMarshal Exchange

Symptoms:

MailMarshal vulnerable to Directory Traversal attacks when unpacking .TAR archives
An attacker could create a specially crafted file to overwrite important operating system files and cause the system to execute malicious code.

Resolution:

For MailMarshal SMTP, upgrade to the latest version.

This vunerability was first fixed in version 6.2.2.3503 (released 11 October 2007).
If you cannot upgrade immediately, you can use the workaround steps below.

For MailMarshal Exchange 5.x, upgrade to the latest version.

This vunerability was first fixed in version 5.2.5813 (released 8 August 2008).
If you cannot upgrade immediately, you can use the workaround steps below.

Workaround:

A workaround is available for the following product versions:

MailMarshal SMTP 5.5
MailMarshal SMTP 6.x
MailMarshal SMTP 2006
MailMarshal Exchange 5.x

The steps for implementing the workaround are as follows:

MailMarshal SMTP

Note: If your MailMarshal installation is on a single server (including MailMarshal SMTP 5.5 or 6.x/2006), perform all the steps, in order, on that server.

Save the archive file Marshal_Q11780.zip that is attached to this article.
Unzip the archive to a temporary location. The archive includes two files:<

How do I install MailMarshal SMTP with Exchange 5.5?

Oliver Stanley — Thu, 14 Aug 2008 06:31:00 GMT

Abstract:

This article applies to:

MailMarshal SMTP
Microsoft Exchange Server 5.5

Question:

How do I install MailMarshal with Exchange 5.5?
How do I pass email from an Exchange server to MailMarshal SMTP?
How do I configure MailMarshal SMTP to use Exchange Server 5.5?
Do I install MailMarshal SMTP on the same server as Exchange 5.5, or on a different server?

Procedure:

This article explains how to set up MailMarshal SMTP with Exchange 5.5. MailMarshal can either be installed on the same server as Exchange or it can be installed on a different server. For information about installing MailMarshal in your network, refer to Q10469 .
http://www.marshal.com/KB/article.aspx?id=10469

When MailMarshal is installed on a Different Server from Exchange 5.5

Configure Exchange to Forward all Internet Mail to MailMarshal
1. Run the Microsoft Exchange Administrator.
2. Under the Configuration container, select Connections and then select Internet Mail Service.
3. Under the Connections tab, change Message Delivery from DNS to Forward all Messages to Host.
4. Enter the IP address of the MailMarshal server.
Configure MailMarshal to Forward Local Mail To Exchange
You can configure MailMarshal to forward local mail to Exchange either during the initial MailMarshal configuration, or at a later stage.

When prompted to add your local domains during the initial configuration of MailMarshal, specify the IP address and port number of your Exchange server. Typically Exchange will use port 25 to listen for incoming SMTP traffic.

Alternately, you can a

Digest messages not accepted by some mail systems due to UTF-7 encoding

Oliver Stanley — Thu, 14 Aug 2008 05:53:00 GMT

Abstract:

This article applies to:

MailMarshal SMTP 6.2 and above
Message Digest functionality

Symptoms:

Some email servers do not accept MailMarshal digest messages for delivery
Some email clients do not properly render the content of MailMarshal digest messages

Causes:

In version 6.2, Digest messages were altered to allow Unicode text in the body (subject lines of digested messages).
This enhancement allows users to view message subjects in non-european character sets including CJK (Chinese Traditional & Simplified, Japanese, Korean, and Korean EUC) as well as Vietnamese, Thai, UTF-7 and UTF-8 encoding.
Some software does not accept the encoding of these messages.

Workaround:

If you encounter this issue, you can apply the following Registry entry to revert to the pre-6.2 function. Unicode characters will not be available.

Note: This workaround was first made available in MailMarshal version 6.4.5. For MailMarshal 6.2 through 6.4.1, you must upgrade to 6.4.5 before applying the workaround.

On the Array Manager server, edit the Registry.
Navigate to HKEY_LOCAL_MACHINE\Software\NetIQ\MailMarshal\Manager
Add a DWORD value DisableUTF7Digest and set the value to 1.
Commit configuration changes.
Restart the Array Manager service.

Warning: As always, take due care when editing the Registry. Make a backup before making changes.

Resolution:

A more complete resolution for this issue will be included in a

How does MailMarshal determine where to deliver email?

Oliver Stanley — Thu, 14 Aug 2008 03:34:00 GMT

Abstract:

This article applies to:

MailMarshal SMTP 6.X

Question:

How does MailMarshal determine where to deliver email?
How does MailMarshal use DNS to resolve IP addresses for mail delivery?

Information:

Step 1 - Special cases

MailMarshal first checks to see if any Engine rules have applied specific Routing Rules to the message. By Routing Rules we refer to the Engine rule action of "Set message routing to host". If such an action was applied to the message at the Engine, then the Sender service will route that message to the host listed. This overrides all the other delivery options listed below.

Note: Prior to version 6.4, the Local Domains are evaluated before routing rules.

Step 2 - Inbound email

MailMarshal next checks to see if the domain part of the message is listed in the MailMarshal Local Domains. If there is a match the message is delivered to the first IP address in the Local Domains entry. If that first IP address is unavailable MailMarshal will deliver to the Alternative IP address listed for that local domain. Inbound email is defined as email addressed to any domain listed in Local Domains.

Note: If there are multiple matches in the Local Domains list, the message is delivered to the first matching Local Domain. This will typically only occur if you use local domain wildcards.

I.e. If your Local Domain list is as follows:
*.domain.com - 127.0.0.1
us.domain.com - 33.33.33.33
europe.domain.com - 22.22.22.22
<

If primary and secondary DNS servers are unavailable, can an optional forwarding host be specified?

Oliver Stanley — Wed, 13 Aug 2008 05:36:00 GMT

Abstract:

This article applies to:

MailMarshal SMTP

Question:

If primary and secondary DNS servers are unavailable, can an optional forwarding host be specified?

Procedure:

By default, MailMarshal will use DNS resolution to determine the appropriate destination for outbound email and attempt to deliver messages directly. In the event there is a DNS failure that prevents MailMarshal from connecting to the original destination server, a fallback host can be used. This setting is found in the MailMarshal Configurator under Tools | Server & Array Properties then clicking the Delivery tab.

You may optionally enter the name or IP address of a fallback host that will be used as a forwarding host for messages which MailMarshal is unable to deliver immediately.

MailMarshal 6.4 and above

The delivery tab in MailMarshal 6.4 and above has changed. If you access the Routes node in the left pane of the MailMarshal Configurator and select New Routing Table it is possible to create multiple failover routes for the delivery of mail and for load balancing purposes.
NOTE: In the event of DNS failure it is adviseable to create fall back routes based on IP address instead of fully qualified email host name.
For more information on forwarding email see the User Guide.

This article was previously published as:: NETIQKB39366

Windows Media Player 9 prompts for basic authentication when downloading external content with the WebMarshal proxy server enabled.

Charles Creegan — Tue, 12 Aug 2008 23:07:00 GMT

Abstract:

This article applies to:

WebMarshal
Windows Media Player

Question:

Windows Media Player 9 prompts for basic authentication when downloading external content with the WebMarshal proxy server enabled.

Symptoms:

I can download and view a file in Windows Media Player only after providing credentials via basic authentication.
I am receiving an authentication prompt in Windows Media Player when WebMarshal is enabled.
Windows Media Player is not passing NTLM credentials properly.

Causes:

Windows Media Player does not automatically pass NTLM credentials to a proxy server located in the local Intranet zone.
In some cases WMP might not recognize that the WebMarshal server is in the Intranet zone.

Information:

Problem 1 is due to the method by which Windows Media Player attempts (sometimes unsuccessfully) to automatically pass NTLM credentials to the WebMarshal proxy. The following Microsoft knowledge base article addresses this problem with Windows Media Player 9 and offeres a hotfix: http://support.microsoft.com/?kbid=816089
Problem 2 can be caused by the way you enter proxy server details in WMP or Internet Explorer. An IP address or fully qualified name might be interpreted as a serer outside the Intranet zone.

You should always enter the proxy server location as a local hostname (for instance, Proxy1).

Notes:

Users may still encounter authentication prompts in some cases, as stated in the Microsoft knowledge base article.

Users should still be able to download the file in question by providing valid credentials via basic authentication.

This article w

How can I apply my company logo to the Spam Quarantine Management site?

Oliver Stanley — Tue, 12 Aug 2008 08:11:00 GMT
Abstract:
This article applies to:
MailMarshal SMTP below 6.4
Question:
How can I apply my company logo to the Spam Quarantine Management site?
How can I re-brand the Spam Quarantine Management site with my company logo?
Procedure:
To re-brand the Spam Quarantine Management (SQM) site, you will need to modify three image files on the server where the SQM resides:

\<MailMarshal SQM Install Directory>\images\footer_logo.gif - This file contains the Marshal logo in the bottom left corner of the SQM pages.
\<MailMarshal SQM Install Directory>\images\footer_tag.gif - This file contains the Marshal "Work Smarter" tagline in the bottom right corner of the SQM pages.
\<MailMarshal SQM Install Directory>\images\th_welcome.gif - This file contains the Marshal logo in the top left corner of the SQM pages.
Note: The default install path of the SQM is C:\Program Files\NetIQ\MailMarshal Web Components\Spam Quarantine Management\.
The steps for re-branding are:
Backup the image files above.
Replace them with new .gif files. Note: These new image files must have the same name and dimensions as the old files to ensure that the site layout is not affected.
Note:
In order to configure the SQM for MailMarshal SMTP 6.4 see the following marshal knowledge base article for more information:
All site functionality is supported in each of these languages and themes.
You can create new language packs and themes. This article provided general guidance.
Best practice is not to change the default items. Always make a copy and work on the copy. Be sure to test any changes carefully.
You can set up a test environment by installing an additional copy of the SQM website on another computer.
When you add a language or Theme, you will see the new item the next time you open your browser and log in to the site.
Note: Marshal does not provide detailed support for new languages and themes. You will need to have an appropriate level of technical skill to make changes to web pages, Cascading Style Sheets, and resource files.
Creating New Language Packs:
To create a Language Pack:
On the computer where SQM is installed, navigate to the language resource folder in the SQM installation folder. By default this is C:\Program Files\Marshal\MailMarshal Web Components\Spam Quar

How do I configure the AdminConsole to use integrated Windows authentication?

Oliver Stanley — Tue, 12 Aug 2008 04:39:00 GMT
Abstract:
This article applies to:
MailMarshal SMTP below 6.4
Microsoft Internet Information Services
Question:
How do I configure the AdminConsole to use integrated Windows authentication?
Procedure:
To configure the AdminConsole to use integrated Windows authentication, there are several changes that need to be made in both MailMarshal and IIS:
Open the MailMarshal Web Configuration Tool and click on the Admin Web Console tab.
Under the User Authentication section, select Windows Authentication.
Click Apply and then OK to exit the Web Configuration Tool.
Open the IIS Manager.
Drill down to the AdminConsole site, right-click on it, and choose Properties.
Click on the Directory Security tab.
Click the Edit button under the Authentication and Access Control section.
Select Integrated Windows Authentication and de-select all other options.
Click OK on all open dialogs.
This article was previously published as:
NETIQKB42211

How does the MailMarshal Today page calculate its data?

Oliver Stanley — Tue, 12 Aug 2008 04:29:00 GMT
Abstract:
This article applies to:
MailMarshal SMTP 6.0.3.8
Question:
How does the MailMarshal Today page calculate its data?
Symptoms:
Data on MailMarshal Today page appears inaccurate.
Total for All Quarantine Messages is greater than 100%.
Causes:
NOTE: This issue was resolved in MailMarshal SMTP 6.0 Hotfix 45108.
We acknowledge that there are problems with the way data is displayed on the MailMarshal Today page in the MailMarshal SMTP 6.0.3.8 Console. This is primarily a result of poor arithmetic on the page itself, rather than an actual problem with source data.
Below is an explanation of how the Today page data is calculated: (a glossary of terms is provided at the end of the article):
Mail Statistics
Direction - Inbound
Message Number (Mi): Total number of inbound messages ignoring splits.
Percentage = Mi/(Mi + Mo) * 100
Direction - Outbound
Message Number (Mo): Total number of outbound messages ignoring splits.
Percentage: = Mo/(Mi + Mo) * 100
Inappropriate Content
Content Type - Spam
Message Number (Sp): Total Spam Logging Classifications + Total Spam Folder Classifications (counting all splits)
Percentage: = Sp/(Mi + Mo) * 100
Content Type - Viruses
Message Number (Vi): Total Virus Logging Classifications + Total Virus Folder Classifications (counting all splits)
Percentage: = Vi/(Mi + Mo) * 100
Top Quarantine Folders
Folder - All Quarantine Folders
Message Number (Qt): True total message count across ALL quarantine folders (counting all splits)
Percentage: Qt/(Mi + Mo) * 100
Folder - Specific Folder

How do I troubleshoot the POP3 collection when messages from mail lists are not being delivered to recipient?

Oliver Stanley — Tue, 12 Aug 2008 04:19:00 GMT
Abstract:
This article applies to:
MailMarshal SMTP
KB93 - Historic Marshal Software Knowledge Base ID.
Question:
How do I troubleshoot the POP3 collection when messages from mail lists are not being delivered to recipient?
Symptoms:
Subscribers of mail lists do not receive their messages.
Messages of mail list subscribers get sent to the MailMarshal SMTP administrator.
Causes:
NOTE: MailMarshal 6.4 and above has discontinued mail batching and dial-up support within the main product. Very few sites still use these methods to collect POP3 incoming email. For more information on how to configure MailMarshal 6.4 and above to have POP3 collection of messages see the following marshal knowledge base article for more information:
Q11025 How do I use ETRN to collect mail with MailMarshal 6.4?
Your Internet Service Provider (ISP) would have placed the message in your POP3 mailbox because someone in your organization subscribed to that list.
The addressing information in the message envelope is stripped off by the ISP by the time it is placed in the POP3 mailbox. Typically, messages distributed by a mailing list do not contain within the message body any reference to the addresses of the recipients. The list engine simply inserts the name of the mailing list into the TO: field. The TO: field is often an address like maillist@infoprovider.com. As the original addressing information is lost, MailMarshal can only see the TO: field and promptly delivers it to the nominated MailMarshal administrator because the address is not a local domain or user.
Procedure:
If you examine one of the problem messages with Notepad, you will see the following sort of

Mail Delivery problems when using a dial-up connection

Oliver Stanley — Tue, 12 Aug 2008 03:39:00 GMT
Abstract:
This article applies to:
MailMarshal SMTP
Symptoms:
Mail Delivery problems when using a dial-up connection.
Mail not getting delivered at all to your site when using dial-up connection.
Only some email gets delivered with the remaining mail left on remote server when using dial-up connection.
Reply:
NOTE: In MailMarshal 6.4 and above retrieving email through mail batching and using a dial-up connection is no longer supported. If your installation requires you to use a dial-up connection the MMGetMail helper application can be used. See the following Marshal knowledge base article for more information:
Q12032 : How do I use ETRN to collect mail with MailMarshal 6.4?
Mail not getting delivered at all to your site.
In the Configurator / Properties / Mail Batching tab, ensure that the ETRN is sent to your ISP's mail server. Note that in the Mailbatching tab it says to send ETRN to a domain – this is misleading – what is required is the full name of their Mail Exchanger or its IP address. You can check with your ISP to confirm this or you can use NSLOOKUP to find the name / IP address.

Open a command prompt window.

Type 'nslookup' and press Enter.

Type 'set type=mx' and press Enter.

Enter in the ISP domain name, e.g. 'marshal.com' and press Enter

The results should yield the name and IP address of mail exchanger(s) for that domain.

Only some email gets delivered with the remaining mail left on remote server.
If the modem hangs up after a short time (around 60 seconds) each time a dial-up session is initiated by MailMarshal then you need to check the following:
Note the IP addr

What certificate types does MailMarshal Secure version 5.5.X support?

Oliver Stanley — Tue, 12 Aug 2008 03:23:00 GMT
Abstract:
This article applies to:
MailMarshal SMTP
Question:
What certificate types does MailMarshal Secure version 5.5.X support?
What certificate types can I use with MailMarshal Secure?
What certificate types can I use with TLS?
Information:
MailMarshal Secure supports X.509, PKCS#7, and PKCS#12 certificates.
MailMarshal SMTP 2006 supports the same certificate types for the TLS (Transport Layer Security) feature.
Notes:
Related information:
Note that MailMarshal Secure is not supported in MailMarshal SMTP version 6.X or MailMarshal SMTP 2006.
Note that MailMarshal Secure Email Server integrates with MailMarshal SMTP 6.4.5 and above. For more information see the following Marshal knowledge base articles:
Q12062 : Configuring MailMarshal SES with Mailmarshal SMTP
Q11358 : Supported Operating Systems and Prerequisite Versions

Microsoft Article on importing and exporting certificates: http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/sag_cmimportexport.mspx
This article was previously published as:
NETIQKB45384

Supported Operating Systems and Prerequisite Versions

Charles Creegan — Tue, 12 Aug 2008 03:21:00 GMT
Abstract:
This article applies to:
MailMarshal SMTP 6.4
MailMarshal Exchange 5.2
WebMarshal 6.1
MailMarshal Secure Email Server 5.6
Question:
What are the supported operating systems for MailMarshal and WebMarshal?
What version of SQL Server can be used with MailMarshal and WebMarshal?
What versions of IIS and ASP.NET are supported by MailMarshal Web components?
What versions of ASP.NET are supported by WebMarshal?
What versions of Internet Explorer are supported for MailMarshal Web components?
What versions of ISA Server can be used with WebMarshal as a plugin?
What versions of Microsoft Exchange are supported by MailMarshal Exchange?
Information:
The following table shows supported versions of operating systems and supporting software.
The table reflects the latest versions of Marshal products. For details of previous versions, see the documentation for each version.
Note: VMWare deployments of the supported operating systems are also supported. See Marshal Knowledge Base article Q11828.
Key:
Symbol Meaning
Tested, Supported. No known issues.
Qxxxxxx
Tested, Supported. See the KB article listed

What are the software prerequisites for MailMarshal Secure?

Oliver Stanley — Tue, 12 Aug 2008 03:10:00 GMT
Abstract:
This article applies to:
MailMarshal SMTP 5.5
MailMarshal Secure
Question:
What are the software prerequisites for MailMarshal Secure?
Information:
MailMarshal Secure (the optional e-mail encryption module of MailMarshal 5.5 SMTP) requires the following:
Microsoft Windows 2000 with the High Encryption Pack installed. (The Microsoft Windows 2000 High Encryption Pack is included in SP2 and above.)
Microsoft SQL Server 7.0 SP2, SQL Server 2000, or MSDE for a Certificate Database
Notes:
It is highly recommended that the certificate database is located on the local machine to ensure greater availability of the database. This requires MSDE or SQL to be installed on the local machine. MSDE would normally be adequate as this database is not likely to be large. Email logging uses a different database and can be on a different server if desired.
MailMarshal Secure Email Server (MailMarshal SES) was released in 2008 and integrates with MailMarshal SMTP 6.4.5 and above. It is a gateway email server product that implements the S/MIME (Secure MIME) standard for encryption and signing of email messages using the Public Key Infrastructure. MailMarshal SES can communicate securely with any other encryption product that uses the S/MIME standard. See the MailMarshal Secure Email Server Support page available at the Marshal website for more information. (log in required).
This article was previously published as:
NETIQKB29685

What Corsaire Test Suite for MIME security cases does MailMarshal support?

Oliver Stanley — Tue, 12 Aug 2008 00:12:00 GMT
Abstract:
This article applies to:
MailMarshal SMTP 6.X
Question:
What Corsaire Test Suite for MIME security cases does MailMarshal support?
Hotfix 45108 ensures MailMarshal addresses certain vulnerabilities identified by the Corsaire Test Suite for MIME security.
Information:
Marshal has created Hotfix 45108 and it is a cumulative hotfix that includes all issue resolutions from previously released hotfixes. It addresses certain vulnerabilities identified by the Corsaire Test Suite for MIME security. NOTE: Hotfix 45967 is not included in this rollup.
You can find the hotfix at the following URL:
http://www.marshal.com/Support/MailMarshal_SMTP/hotfix.asp
To install this hotfix, run the MMAS60000_Hotfix45108.exe file on your MailMarshal server computer.
This hotfix modifies the following files on the MailMarshal server computer:
MMController.exe
MMEngine.exe
By default, these files are located in the Program Files\NetIQ\MailMarshal folder.
For more information, contact Marshal Technical Support at http://www.marshal.com/Support/.
This article was previously published as:
NETIQKB44046

MailMarshal is blocking all messages with zip attachments as virus infected

Oliver Stanley — Mon, 11 Aug 2008 23:52:00 GMT
Abstract:
This article applies to:
MailMarshal SMTP 6.X
McAfee for Marshal
Symptoms:
MailMarshal is blocking all messages with zip attachments as virus infected.
All messages with zipped attachments report a scanner error, which triggers the Block Virus rule.
Error: 'Virus scanner ERROR ... unexpected error: File is locked or access denied.'
Causes:
The issue appears to be caused by double backslash (\\) characters in the path of the file being scanned by McAfee for Marshal. You will most likely see entries similar to the one below in the MailMarshal Engine logs:
MSMcAfee.dll: Scanning file 'C:\Program Files\NetIQ\MailMarshal\\T3\U2\MsgHeader.txt'
The double backslash is usually present when there is no defined location for unpacking and virus scanning in the MailMarshal Server configuration.
Reply:
To address this issue, you will need to define a location for message unpacking and virus scanning:
Stop all the MailMarshal services. (Note: If the problem exists on a node that also serves as an Array Manager, you will need to stop the Array Manager service as well.)
On the problem MailMarshal node, run the MailMarshal Server Tool.
Go to Folders | Location For Unpacking and Virus Scanning.
Add a valid folder location for unpacking. The default location is C:\Program Files\NetIQ\MailMarshal\Unpacking.
Click OK or Apply. Do NOT choose to move files when prompted.
Restart the MailMarshal services
If the resolution above is not appropriate for your installation, please refer to the following alternative workaround:

Why add an alternative Email address to the SQM?

Charles Creegan — Mon, 11 Aug 2008 23:46:00 GMT
Abstract:
This article applies to:
Spam Quaratine Management website
MailMarshal SMTP
Question:
Why add an alternative email address to the SQM?
Information:
The MailMarshal SQM website allows a user to add "alternative email addresses" to their SQM view.
Each user should ensure that all the local addresses where they receive email are added to their view. The list of alternative email addresses is used for the following purposes:
The lists of safe and blocked senders that the user has entered will be applied to messages for the main address and all the alternative addresses.
Neglecting to add all addresses is a very common cause of user complaints that their preferences are not being applied by MailMarshal.
Blocked email messages for the main address and all the alternative addresses will be shown in the user's list of blocked email. (The messages will most often be addressed TO the user. Depending on the setup of the folders visible in SQM, some messages could be addressed FROM the user.)
Digests of blocked mail for the user (if configured) will include messages for the main address and all the alternative addresses. The authoritative email address used to log in to the SQM is the mailbox that will receive any digests.
Notes:
In most cases when SQM is configured to retrieve addresses from Active Directory, all email addresses for the user will automatically be associated with the authoratative email address. There may be some instances email addresses will need to be added manually within the Add Alternative Email Address window. For instance, distribution list addresses that the user wants to manage, and addresses that are not associated with any user's AD identity, must be ad

How do I make a reputation server work with MailMarshal?

Oliver Stanley — Mon, 11 Aug 2008 23:41:00 GMT
Abstract:
This article applies to:
MailMarshal SMTP 5.X
MailMarshal SMTP 6.X
Question:
How do I make a reputation server work with MailMarshal?
Procedure:
NOTE: You would need do this if for instance you have purchased a zone transfer subscription from a blacklist provider.
A local MAPS server runs as a DNS server in the environment. MailMarshal must be configured to use this DNS server as it's primary DNS server in order for it to be able to query the MAPS database.
To set up MailMarshal:
Open the MailMarshal Configurator.
Click on Tools | Server & Array Properties.
Select the Delivery tab.
Set the Primary DNS server to the IP address of the MAPS server. Keep in mind that if you put an IP address in the secondary DNS server field, your blacklist checks will fail if the primary is unavailable.
Additionally, set the Category script or host validation to use the apropriate blacklist host name (rbl-plus.mail-abuse.org is an examble).
Notes:
Reference Q10737 : for troubleshooting information.
This article was previously published as:
NETIQKB39540

Why can't I see all the emails in my archive folder?

Charles Creegan — Mon, 11 Aug 2008 23:29:00 GMT
Abstract:
This article applies to:
MailMarshal SMTP
Symptoms:
Why can't I see all the emails in my archive folders?
Causes:
This can occur if you have changed the location of the folder (typicallly, older messages would not be seen).
This can also occur due to database issues (new messages would not be seen).
Resolution:
If you have changed the location of folders, you must copy messages manually. To copy the old emails navigate to the original folder and transfer all the emails over to the new location. The old folder qill be a folder with a GUID name.
Note: For information about MailMarshal folder structure (GUID named and "symbolic" folders), see Marshal Knowledge Base article Q10220.
For more information about database issues, see Q10607.

How do I integrate CountryCensor into SpamCensor?

Oliver Stanley — Mon, 11 Aug 2008 23:21:00 GMT
Abstract:
This article applies to:
MailMarshal SMTP 2006
MailMarshal 6.1 and above
Question:
How do I integrate CountryCensor into SpamCensor?
How do I give a SpamCensor score to messages from a specific country?
Procedure:
The technology provided with CountryCensor enables the mail administrator to modify e-mail message processing based on any countries through which the message has travelled.
In many circumstances, it may not be ideal to simply block a message outright based upon the countries through which it has traversed. In these cases, it may be desirable to append a score to a message based on the countries through which it has travelled, contributing to a message's overall SpamCensor score
In order to implement the rules described in this article, you must be using MailMarshal SMTP 2006. This version includes the basic CountryCensor framework.
By default, MailMarshal includes CountryCensor.xml; however this is file is designed to block messages from specific countries outright, rather than simply appending a score.
If you wish to simply append a score based on a country, you can integrated the scoring into SpamCensor in the same way that UserDefined.xml is included in the overall SpamCensor score.
This requires two steps:
Downloading and preparing the attached XML category script for use with SpamCensor
Modifying SpamCensor.xml to include the country-based scoring checks done by the attached XML category script
Preparing the attached XML category script for use with SpamCensor:
Download the file RegionalScoring.zip from the Article Attachments section below.
Extract the example XML file into the MailMarshal "Config" directory (by default: C:\Program Files\NetIQ\MailMarshal\Config).
Open the XML category script

Should I use MailMarshal SMTP and/or MailMarshal Exchange?

Charles Creegan — Mon, 11 Aug 2008 22:56:00 GMT
Abstract:
This article applies to:
MailMarshal SMTP
MailMarshal Exchange
Question:
Should I use MailMarshal SMTP and/or MailMarshal Exchange?
Why would I choose MailMarshal SMTP?
Why would I choose MailMarshal Exchange?
Why would I implement both MailMarshal SMTP and MailMarshal Exchange?
What features are provided by MailMarshal SMTP, but not by MailMarshal Exchange?
Technical Comparison of MailMarshal SMTP and MailMarshal Exchange
Information:
The questions and answers below should assist you in selecting the appropriate MailMarshal product for your environment:
Why would I choose MailMarshal SMTP?
I want to implement some or all of my e-mail business policy within my DMZ.
I want to utilize the improved scalability of MailMarshal 6, with its single Array Manager, multiple mail-processing Node model.
I want to control spam, malicious code, and virus-infected data before it gets to my organization's primary e-mail environment.
I want to use real-time blackhole lists for blocking known spamming sources.
I want a single point of control over e-mail messages entering and leaving my organization.
I want my end users to be able to manage their own spam.
I want a web-based console to help end users with their problems.
I want to block large messages based on who they are sent to, before the body of the message is received, to save bandwidth.
I need to implement a secure e-mail relay at the gateway, as my primary e-mail server does not do this.
I need to perform domain name masquerading or other e-mail header re-writing functions.
I need to implement encryption and signing of messages for some or all of my users. (using MailMarshal Secure 5.X or MailMarshal SES)
Why would I choose MailMarshal Exc

How do I configure MailMarshal LDAP facilities?

Oliver Stanley — Mon, 11 Aug 2008 22:55:00 GMT
Abstract:
This article applies to:
MailMarshal SMTP below 6.1
Question:
How do I configure MailMarshal LDAP facilities?
Procedure:
LDAP (Lightweight Directory Access Protocol) is a method of communicating between computers. It is a protocol for enabling anyone to locate organizations, individuals, and other resources such as files and devices in a network, whether on the Internet or a corporate intranet.

MailMarshal uses the LDAP 4.1 or later protocol for two functions:

To download lists of members of user groups from programs such as Microsoft Exchange and Lotus Notes
To retrieve Security Certificates for use in S/MIME encryption
Note: Some networks block external LDAP connections. You may need to ask your network administrator to give MailMarshal LDAP access through your firewall.
To configure LDAP facilities in MailMarshal:
Create a new LDAP connection.
Configure MailMarshal to utilize the LDAP connection by selecting the user groups that will be populated from the LDAP server.
Configure MailMarshal to utilize the LDAP connection by adding the name of the LDAP connection to encryption rules.
To create a new LDAP connection, use the following steps:
Open MailMarshal Configurator.
Right-click the LDAP Connections node.
Select New LDAP Connection.
Select either User Groups or Certificates and click Next. If you need to retrieve both types of information from the same server, set up two connections pointing to the same server.
Complete the LDAP Connection Wizard - Server dialog box.

Complete the LDAP Server field. This is the network name of the LDAP server. This name and the information

Error: 'Size limit Exceeded', Error: 'Invalid authorization code', Unable to configure Email Digest Notifications, or Emails incorrectly categorized as spoofed emails.

Charles Creegan — Mon, 11 Aug 2008 22:44:00 GMT
Abstract:
This article applies to:
MailMarshal SMTP 6.0
Symptoms:
Error: 'Size limit Exceeded', Error: 'Invalid authorization code', Unable to configure Email Digest Notifications, or Emails incorrectly categorized as spoofed emails.
Issues addressed in MailMarshal 6.0.3.8 Hotfix 43495.
Error: 'Size limit Exceeded' when trying to 'Import one or more user groups from the connector'.
Unable to configure the Email Digest Notifications to use HTTPS in links.
Some emails are incorrectly categorized as spoofed emails if the Anti-Spoofing Analysis is set to 'Local Domain' and the Local Domain has two IP addresses configured.
Error: 'Invalid authorization code' displayed on the Spam Quarantine Management webpage after clicking the URL link in the 'Add Alternate Address' confirmation email.
Resolution:
To resolve this issue, upgrade to the latest version of MailMarshal SMTP. These issues are fixed in versions 6.1 and above.
If you cannot upgrade immediately, you can apply MailMarshal version 6.0.3.8 Hotfix 43495. The hotfix requires Hotfix 42096 to be applied first. You can find both of these hotfixes at the following URL:
http://www.marshal.com/Support/MailMarshal_SMTP/Hotfix.asp
Hotfix 43495 provides support for the following configurations:
Extends support of Microsoft Exchange 5.5 by providing the following LDAP query enhancements:
Support paging
Support use of special characters
Remove size limit for recipient containers
For example, MailMarshal now supports user group imports to a Microsoft Exchange 5.5 Serv

Error: 'Invalid authorization code' received after clicking on the Authorize button in the Web page to authorize an email address to be monitored by a user.

Charles Creegan — Mon, 11 Aug 2008 22:42:00 GMT
Abstract:
This article applies to:
MailMarshal SMTP 6.0
Lotus Notes Email Client
Symptoms:
Error: 'Invalid authorization code' received after clicking on the Authorize button in the Web page to authorize an email address to be monitored by a user.
The authorization link sent by the Spam Quarantine Management website does not work.
The Authorize action in the SpamConsole generates an email with an invalid link.
Hotfix 43495
Causes:
The URL that MailMarshal inserts into the authorization email is Microsoft compliant but not fully cross-platform compliant. MailMarshal uses a backslash in the domain\username portion of the URL. The Lotus Notes Win32 email client attempts to correct this by changing the backslash to a forward slash. This client modification breaks the link and causes the error above in the Spam Quarantine Management site.
Original URL sent in the authorization email:

http://mailmarshalserver/SpamConsole/confirm.aspx?username=Domain\UserID&alias=AlternateEmailAddress@test.com&code=1b5c5f12b59333293567a0f5ac4cc10b
URL after the Lotus Notes client has modified it:

http://mailmarshalserver/SpamConsole/confirm.aspx?username=Domain/UserID&alias=AlternateEmailAddress@test.com&code=1b5c5f12b59333293567a0f5ac4cc10b
Information:
As a temporary workaround:
Use the Lotus Notes Web based email client to perform this authorization because the iNotes client does not alter the URL as it is passed it to the web browser.
To resolve the issue:
Upgrade to the latest version of MailMarshal SMTP. This issue is fixed in versions 6.1 and above.
If you cannot upgrade, apply the MailMarshal SMTP 6.0&

How do I set up and use MailMarshal Email notifications?

Charles Creegan — Mon, 11 Aug 2008 22:38:00 GMT
Abstract:
This article applies to:
MailMarshal SMTP
MailMarshal Exchange
Question:
How do I set up and use MailMarshal Email notifications?
Procedure:
Using Email Notifications
Email Notifications can provide a very powerful tool to the Mail Administrator.

Some examples of the use of Email Notifications are:
Notify the sender and recipient when a virus is detected. This can be used to let users know that they have a virus problem.
Send a message to the administrator when a virus is detected. This message can contain extensive information on the original message, such as sender, recipient, etc. It can also include the Message log and Virus log so that you can immediately familiarize yourself with the problem.
Redirect a complete copy of the message to an alternative Email address. This could be used, for example, in conjunction with a rule to detect inappropriate words or images. When such an Email is detected, then MailMarshal can be set up to forward a copy to the Administrator.

Setting up Email Notifications

A notification Email is based on an Email Template. The template determines what information is included in the notification message. You then need to set up a rule to use the Email Template when triggered.

Note: MailMarshal ships with several Email Templates that are ready for use. Edit any of these to get ideas on creating your own templates.

Create an Email template.

In the MailMarshal Configurator, select Email Templates, right-click, and select New | Email Template. The template can use variables containing information from the original Email message, such as the Sender, Recipient, Subject, etc. A list is given below. To see a list of common variables used in any field,

MailMarshal SMTP is processing e-mail very slowly

Charles Creegan — Mon, 11 Aug 2008 05:14:00 GMT
Abstract:
This article applies to:
MailMarshal SMTP
Symptoms:
MailMarshal SMTP is processing e-mail very slowly.
Typically mail flows normally, but intermittently there are extended delays in mail delivery.
When Telnetting to port 25 on the MailMarshal server, there is no response to the initial connection attempt. It may time out or eventually give a response after a long wait.
When highlighting the Services node, there maybe multiple <Unknown> entries for the receiver and sender columns, and the 'Active Threads' field may never regress to zero.
Causes:
Unresponsive reputation services (DNS blacklists) are enabled in the MailMarshal SMTP Configurator.
In version 6.2 and below, check for DNS Blacklists enabled in the Host Validation tab of Server Properties, but not used in any enabled rules.
In version 6.4, check the Reputation Services item in the main tree of the Configurator.
Some default installations of MailMarshal 5.5.x have invalid DNS Blacklist (reputation service) entries listed in the Tools | Server Properties | Host Validation tab. If the ORBS, Osirusoft or Dorkslayers lists are enabled, then e-mail will be slow to process, and some end users may not received e-mail. This is because these services are no longer operating.
Also, if the MAPS or Spamhaus reputation services are enabled and no subscription has been purchased from the third party, then you can see the same problems with processing.
There are also static entries in the UserDefined.XML script to the same reputation service sites, which can cause slow processing in the engine. These can be commented out or deleted in the script to speed up processing (See below for instructions on how to do th

Why are my Active Directory user groups not refreshing in the WebMarshal console?

Charles Creegan — Mon, 11 Aug 2008 04:29:00 GMT
Abstract:
This article applies to:
WebMarshal 6.X
Question:
Why are my Active Directory user groups not refreshing in the WebMarshal console?
Symptoms:
Active Directory users imported into a User Group are missing
Reloading a User Group raises an error message in console 'Failed to refresh user', with a list of user names
Some users cannot browse through WebMarshal
Some users are listed twice in 'All Users'
Changes in user first and last name may not be correctly reflected in WebMarshal
Resolution:
To resolve this issue, upgraded to the latest version of WebMarshal. This issue was first corrected in release 6.1.3.4007 (August, 2008).
Workaround:
If you cannot upgrade immediately, follow the instructions below to resolve the user problems temporarily. You will have to perform these steps whenever user information changes.
Open the WebMarshal Console.
Right click on All Users in the left pane and select Purge Unreferenced Users.
Right click on All Users in the left pane and select Refresh User Descriptions.
Right click on each Usergroup and select Reload User Group.
Restart all the WebMarshal services.

How do I block junk email, or email that contains potentially malicious code?

Charles Creegan — Mon, 11 Aug 2008 04:17:00 GMT
Abstract:
This article applies to:
MailMarshal Exchange
MailMarshal SMTP
Question:
How do I block junk email, or email that contains potentially malicious code?
NOTE: For information about MailMarshal's anti-Spam abilities and settings, see Q10810: What are MailMarshal anti-spam best practices? http://www.marshal.com/kb/article.aspx?id=10810
Procedure:
There are several ways you can configure MailMarshal to block junk email, or email that contains potentially malicious code. You can implement one or more of the features below. Or, if you want to more strongly restrict the types of email your organization receives, you can implement them all.
SpamProfiler :
This feature allows MailMarshal SMTP to check messages at the receiver. MailMarshal can refuse, delete, or quarantine messages based on the SpamProfiler evaluation. SpamProfiler is a signature based service. SpamProfiler is efficient because it does not require messages to be processed by the MailMarshal Engine. This feature is not available in MailMarshal Exchange.
SpamCensor :
To classify spam, MailMarshal SMTP 5.5 and above includes a facility that performs a multi-dimensional XML based analysis of messages. This facility includes automatic updates provided by Marshal. You can choose to quarantine or mark messages within the Block Spam rule in the Anti-Spam Ruleset in version 5.X, or the Block Suspect Spam rule in the Anti-Spam Email Policy in version 6.X.

MailMarshal Exchange 5.2 includes the same automatically updating S

How do I disable MailMarshal Exchange from processing Mail?

Charles Creegan — Mon, 11 Aug 2008 03:59:00 GMT
Abstract:
This article applies to:
MailMarshal Exchange
Question:
How do I disable MailMarshal Exchange from processing Mail?
Information:
MailMarshal Exchange can be enabled separately for each Virtual Server configured within the Exchange Server. A list of the connection (“stub”) state for each Virtual Server is shown in the Exchange stub state window. This is accessed in the MailMarshal Exchange Configurator by selecting Tools > Server Properties > Advanced.
To alter the state, select a Virtual Server instance in the window and click the Edit button. Choose one of the three options:
Install and Activate: A connection to the Virtual Server will be established and MailMarshal Rules will be applied.
Install but bypass rule processing: A connection to the Virtual Server will be established but MailMarshal Rules will not be applied to messages.
Uninstall: MailMarshal's connection to the selected Virtual Server will be uninstalled.
MailMarshal Exchange 5.2 and above also allows you to bypass processing for specific email addresses. See Tools > Server Properties > Advanced >Additinoal Options > Address Bypass. For details and warnings about this feature, see the User Guide or Help.

CounterSpy updates failing

Oliver Stanley — Mon, 11 Aug 2008 03:18:00 GMT
Abstract:
This article applies to:
MailMarshal SMTP 6.X
MailMarshal Exchange 5.2 and above
WebMarshal 3.7
WebMarshal 6.X
CounterSpy for Marshal
Symptoms
CounterSpy for Marshal signature updates failing
Internet access to the update site is OK (see Q11357 : What ports need to be open in my firewall for Counterspy for Marshal?)
Causes
SunThreatIndex.idx file is corrupt
Resolution:
CounterSpy for Marshal performs incremental updates. If the SunThreatIndex.idx file becomes corrupt, the updates can fail.
To resolve this issue, you can force a full update of the signatures. Perform these steps on each MailMarshal email processing server or WebMarshal server where the updates fail.
Stop the MailMarshal and/or WebMarshal engine services.
Stop the Marshal CounterSpy Updater service.
Rename the file SunThreatIndex.idx to SunThreatIndex.idx.old
Note: By default this file is located in C:\Program Files\Marshal\CounterSpy for Marshal
Start the Marshal CounterSpy Updater service.
Open the CounterSpy for Marshal Configuration tool (found in the MailMarshal or WebMarshal folders on the Start menu). On the Status tab, click Start Update to initiate a full update.
When the update is complete, restart the MailMarshal and/or Webmarshal Engine services.

How to turn on debugging for the SQM

Charles Creegan — Mon, 11 Aug 2008 02:19:00 GMT
Abstract:
This article applies to:
MailMarshal SMTP 6.4 and above
Microsoft Windows Server 2003
Microsoft Windows XP
Question:
How to turn on debugging for the SQM
Procedure:
Follow the steps below to create a debugging log for the SQM (MailMarshal 6.4 and above).

When installed on Windows Server 2003
In the MailMarshal SMTP Web Components installation directory create a folder called Logging.
Right click on the folder and select the security tab. Ensure the group or users that are running IIS are granted read and write access to the logging folder.
In the C:\Program Files\Marshal\MailMarshal Web Components\Spam Quarantine Management directory edit the web.config file and below <appsettings> add <add key="Debug" value="True" />. Save the changes.
Open Internet Information Services (IIS) and expand the server where the the SQM website is stored.
Expand Application Pools and right click on DefaultAppPool and select Properties.
Select the Identity tab and change the drop down menu for the Predefined field to Local System.
Click OK.
Right click again on DefaultAppPool and select Recycle.
Expand the Web Sites directory under the server where the SQM is stored. Right click on Default Web Site and select Stop. Then click Start.
When installed on Windows XP

SpamProfiler cartridge update causes MailMarshal Receiver failures

Charles Creegan — Mon, 11 Aug 2008 00:16:00 GMT
Abstract:
This article applies to:
MailMarshal SMTP 6.4.X
SpamProfiler functionality
Symptoms:
SpamProfiler cartridge updated to version 3048.0.n.n
MailMarshal Receiver stops (this may happen repeatedly)
Event log entry: Faulting application MMReceiver.exe, version 6.4.5.0, faulting module cartridge.dll, version 3048.0.4.13, fault address 0x0003bed0.
The exact version reported may differ.
Workaround:
To revert to the previous version of the SpamProfiler cartridge, complete the following steps.
Note: If you have more than one MailMarshal processing node server, you must complete these steps on each server.
Save the file SpamProfiler-3046.zip from the Article Attachments section below.
Extract the file cartridge.dll from the zip archive.
On the MailMarshal processing server, stop the MMReceiver service (using Windows Services control panel or the MailMarshal Configurator).
Navigate to the MailMarshal installation directory. By default for new installations this is C:\Program Files\Marshal\MailMarshal
Copy the subfolder SpamProfiler to SpamProfilerBak
Delete the contents of the SpamProfiler folder.
Copy the file cartridge.dll that you saved from this article into the SpamProfiler folder.
Start the MMReceiver service.
Resolution:
Marshal is actively researching a full resolutio

How do I improve performance with McAfee command line scanner?

Oliver Stanley — Fri, 08 Aug 2008 05:42:00 GMT
Abstract:
This article applies to:
MailMarshal SMTP
Question:
How do I improve performance with McAfee command line scanner?
Procedure:
This article is for MailMarshal users who are running the McAfee command line scanner and are wanting to increase performance and throughput of mail. The virus scanner can be the most limiting factor in terms of how fast MailMarshal can process messages. By default, the MailMarshal Engine is single threaded, i.e. it works on one message at a time, invoking the scanner across each message. A general rule of thumb is that it is possible to run two engine threads with a single processor, and then one thread for each extra processor on the same machine.

Command line scanners, because they are invoked for each new message, are slower than DLL integrated scanners like McAfee for Marshal, Sophos, and Norman which reside in memory between scans and as a result are much faster.
Marshal recommends DLL integration for all but smaller sites.
If you want to improve the performance of McAfee command line and the MailMarshal engine, you can do the following:

Run multiple copies of McAfee command line under MailMarshal at once

It is possible to run multiple copies of McAfee command line scanner, although this is somewhat complex to set up. You need to:
Create multiple McAfee command line scanner directories, and name them Scan1, Scan2, Scan3 etc, depending on how many threads you intend running. Copy the contents of the original McAfee directory into these folders. Note: Ensure the files are not in use while you are copying.
Edit the registry to make the Engine run multiple threads. To change the MMEngine threads you need to add a registry DWORD entry under HKEY_LOCAL_MACHINE\SOFTWARE\NetIQ\MailMarshal\Default\Engine called MaxThreads and set it to the

How do I configure outbound email retries and other email sending timeouts?

Oliver Stanley — Fri, 08 Aug 2008 05:40:00 GMT
Abstract:
This article applies to:
MailMarshal SMTP
Question:
How do I configure outbound email retries and other email sending timeouts?
How long does MailMarshal wait before timing out?
Procedure:
This article answers the following questions and describes some of the things you can do to alter the way MailMarshal delivers email. The MailMarshal Sender (MMSender) service is responsible for sending email.
Where and how are the following MailMarshal settings configured?
How long before the initial "Waiting for HELO" times out?
How often does MailMarshal retry?
How many times before MailMarshal quits trying?
What does MailMarshal do with timed out messages?
Important Note: Changing these settings could affect the delivery of your email. MailMarshal follows accepted SMTP standards for delivering email, and you do not usually need to change anything. Only alter these settings if you are familiar with SMTP delivery.

MailMarshal SMTP 6.X :
MailMarshal SMTP 6.X incorporates these settings in the GUI interface:
Click Tools | Server and Array Properties.
Click Advanced tab.
Click Additional Options.
Click Times

Microsoft IRM Protected Documents not recognized as encrypted

Oliver Stanley — Thu, 07 Aug 2008 22:39:00 GMT
Abstract:
This article applies to:
MailMarshal SMTP 6.4
Question:
Microsoft IRM Protected Documents not recognized as encrypted
Procedure:
The following signatures can be used to identify IRM protected documents.
-Microsoft Word 1997-2003
T: IRMDOC
D: Microsoft IRM Documents
X: 2202=44 00 52 00 4d 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 74
-Microsoft Office 2007 IRM Docs
T: IRM2K7
D: Microsoft Office 2007 IRM Docs
X: 2236=44 00 52 00 4d 00 45 00 6e 00 63 00 72 00 79 00 70 00 74 00 65 00 64
NOTE: Files that are identified as a custom file type will not be unpacked for analysis by the MailMarshal Engine.
Notes:
See the following Marshal knowledge base article for more information:
Q10199 : How do I add custom file type definitions to MailMarshal SMTP?
This issue will be addressed in a future release of MailMarshal SMTP.

Sophos update causing all mail to be stopped as virus infected. (MailMarshal SMTP 6.0)

Oliver Stanley — Thu, 07 Aug 2008 06:06:00 GMT
Abstract:
This article applies to:
MailMarshal SMTP 6.0
Symptoms:
Sophos update causing all mail to be stopped as virus infected. (MailMarshal SMTP 6.0)
Sophos Hotfix 45967 for MailMarshal SMTP 6.0
Hotfix 45967 allows you to use MailMarshal SMTP version 6.0 when you are updating to the latest version of Sophos Anti-Virus.
Hotfix 45967
Causes:
Sophos .ide updates cause MailMarshal to think the Sophos install is corrupt and flagging all mail as having a virus accordingly.
Information:
It is adviseable to upgrade to the latest version of MailMarshal SMTP. The hotfix detailed below is a workaround.
The Marshal Hotfix 45967 corrects an issue with MailMarshal version 6.0 not properly managing the Sophos Anti-Virus updates.
To install this hotfix, download the hotfix MMAS60000_Hotfix45967.exe from http://www.marshal.com/Support/MailMarshal_SMTP/hotfix.asp and run it in the installation folder on each MailMarshal SMTP version 6.0 server computer. By default, the installation folder is C:\Program Files\NetIQ\MailMarshal.
Installing this hotfix replaces the following file:
MSSavi.dll
For more information, contact Technical Support at http://www.marshal.com/Support/.
This article was previously published as:
NETIQKB45967

Prompted for user credentials when accessing the Spam Quarantine Management Console

Charles Creegan — Thu, 07 Aug 2008 03:25:00 GMT
Abstract:
This article applies to:
MailMarshal SMTP
Spam Quarantine Management Website
Internet Explorer
Symptoms:
User is prompted for their credentials and domain information when accessing the Spam Quarantine Management Website.
Causes:
Internet Explorer recognizes IP addresses or fully qualified domain names entered into the address bar as external sites. IE does not use NTLM authentication to access sites outside of a LAN for security reasons.
The Spam Quarantine Management website uses NTLM authentication and it may be configured with a fully qualified name.
Resolution:
The Spam Quarantine Management website can be added to the list of Intranet sites within Internet Explorer. Follow the steps below to add the Spam Quarantine Management Website to this list:
In Internet Explorer, select Tools > Internet Options and select the Security tab.
Click on the Local Intranet icon and click the Sites button.
Click the Advanced button and add the URL of your Spam Quarantine Management Website to this zone.
Click Close and OK and OK or Apply.
Notes:
If you are using Wiondows authentication for the SQM website and yoru do not add the address to the Intranet zone, you must enter your credentials before being allowed access to the SQM website.

What are the hardware and software requirements for MailMarshal 6.X?

Oliver Stanley — Thu, 07 Aug 2008 03:18:00 GMT
Abstract:
This article applies to:
MailMarshal SMTP 6.X
Question:
What are the hardware and software requirements for MailMarshal 6.X?
Information:
Hardware Required for MailMarshal SMTP Server
The hardware required for a MailMarshal server naturally varies depending on the number of email users and the amount of email traffic. The following specifications are a suggested minimum for a single-server installation of MailMarshal:
1,000 users: Pentium 4 2GHz, 20GB HD free, 768MB RAM
10,000 users: Dual Pentium 4 2GHz, 100GB HD free, 2GB RAM
Sites with more than 10,000 users can use a single server with a higher specification, or multiple processing servers.
Hardware planning considerations for MailMarshal Array installations:
In an Array installation MailMarshal will typically include an Array Manager computer, multiple email processing servers, and a SQL Server computer.
Array Manager: Array Manager is not resource intensive. For a standalone Array Manager computer the most important component is the processor.
The Array Manager software can be installed on the SQL Server, in which case see the SQL Server hardware requirements.
SQL Server: SQL Server is memory and disk intensive. 25% of the MailMarshal database is indices. Performance is improved when more of the indices fit into physical RAM. The SQL databases also use a lot of disk I/O, so careful planning with regard to the SQL data file location(s) is required. Please consult the chart below to understand potential MailMarshal database size. Consult Microsoft documentation for specifics on optimizing a SQL server installation.

How to join a Node to an Array

Charles Creegan — Thu, 07 Aug 2008 03:17:00 GMT
Abstract:
This article applies to:
MailMarshal SMTP 6.x
Question:
How to join a Node to an Array
Email processing server is not visible in the Configurator Servers view.
Procedure:
Click Start on the machine where MailMarshal is installed and browse to the MailMarshal Server Tool.
Select the Array/Node Communication tab and click Change.
Click Join Array and enter the Username, Password and Domain details to login to the Array Manager. Click OK and OK again. (Note: This will need to be done for all the servers in the array.)
Commit the configuration.
Notes:
If you recreate the MailMarshal database, you will have to rejoin all nodes to the array (even for a single server installation).
If you install a new node the installer includes steps to join the node to an existing array.

How do I adjust the retention period for MailMarshal SMTP and WebMarshal database logging?

Charles Creegan — Thu, 07 Aug 2008 02:15:00 GMT
Abstract:
This article applies to:
MailMarshal 6.X
WebMarshal
MSDE
SQL Express
Question:
How do I adjust the retention period for MailMarshal SMTP and WebMarshal database logging?
Information:
MailMarshal SMTP and WebMarshal can log information to a SQL database for reporting purposes. MSDE and SQL Express have a hard coded maximum database size of 2048MB and 4096MB respectively.
If they reach these limits the products will be affected as follows:
MailMarshal 6.X
Mail history as shown in the Console will not be up to date. Database log files will be stored on the node and not written to the database until existing information is deleted (for instance, the retention period for earlier messages or records expires).
Mail processing will continue as per the configured policy. Users will be unaffected. However, you may be unable to save changes to configuration. If the disk on the procesing server(s) is full due to the database log files, processing will stop.
WebMarshal 3.X
Users will no longer be able to browse through WebMarshal. You may be unable to save changes to configuration.
WebMarshal 6.X
WebMarshal history will not be up to date, and the database log files logs will be stored on the nodes.
WebMarshal users can continue to browse through WebMarshal as per the configured policy. However, if the disk on the procesing server(s) is full due to the database log files, processing will stop.
By default Marshal products are configured to retain logging information in the SQL database for 100 days.

Engine stops responding with Norman Virus Control

Charles Creegan — Thu, 07 Aug 2008 01:41:00 GMT
Abstract:
This article applies to:
MailMarshal SMTP 6.X
MailMarshal Exchange 5.X
WebMarshal 3.7.X
WebMarshal 6.X
Symptoms:
Norman Virus Control used as integrated DLL scanner
MailMarshal or WebMarshal engine stops responding (service is still running)
No email flowing through MailMarshal
Web browsing through WebMarshal is not available
Last item in Engine log shows scanning by MSNorman.dll
Causes:
The Norman virus scanner integration has stopped responding due to a deadlock condition.
Resolution:
For WebMarshal and MailMarshal Exchange, this issue can be resolved by upgrading to the latest version. This issue was first fixed in:
WebMarshal release 6.1.1.3875
MailMarshal Exchange release 5.2.0.5813
Workaround:
To restore function temporarily, restart the MailMarshal or WebMarshal Engine service on the affected servers.
To install a more permanent solution, you can replace the Norman integration DLL on processing servers.
Save the archive file MSNorman.zip that is attached to this article.
Unzip the archive to a temporary location. The archive contains a single file, MSNorman.dll.
MailMarshal SMTP
On each MailMarshal 6.X processing server (node):
Stop the MailMarshal Engine service.
In the MailMarshal install directory, rename the file MSNorman.dll to MSNorman.dll.old.
Copy the new file MSNorman.dll <

"Authorization failed for ''company\admin''. A problem occured during authentication: Could not resolve Active Directory path - 0x80070005 - access is denied"

Charles Creegan — Thu, 07 Aug 2008 01:08:00 GMT
Abstract:
This article applies to:
MailMarshal SMTP 2006
MailMarshal SMTP 6.X
Spam Quarantine Management website
Symptoms:
Spam Quarantine Management website not functioning.
When attempting to log on to the console: "Authorization failed for 'company\admin'. A problem occured during authentication: Could not resolve Active Directory path - 0x80070005 - access is denied"
Causes:
The Array Manager service is configured to use an account other than the Local System account. The account used by Array Manager does not have permission to access Active Directory.
Resolution:
To resolve this particular issue, you can configure the MailMarshal Array Manager service to use the local system account.
However, be aware that the Array Manager may need to use a domain account in order to obtain updates through a web proxy server. In this case you should grant the account appropriate permissions to browse Active Directory.
To configure the MailMarshal Array Manager service to use the local system account, follow the steps below:
Start Services.msc (Click Start > Run, and enter Services.msc).
Browse to the MailMarshal Array Manager Service, right click and select Properties.
Select the Log On tab and select Local System account.
Apply the changes and restart the MailMarshal Array Manager service.

''Authorization failed for domain\User. A problem occured during authentication: Check NTLM user failed. Error 1717 - The interface is unknown"

Charles Creegan — Thu, 07 Aug 2008 01:01:00 GMT
Abstract:
This article applies to:
MailMarshal SMTP
Spam Quarantine Management Website
Symptoms:
Accessing the the Spam Quarantine Management Website
Error message: 'Authorization failed for domain\User. A problem occured during authentication: Check NTLM user failed. Error 1717 - The interface is unknown.
Causes:
The version of the MailMarshal SMTP Array Manager and the Spam Quarantine Management Website are not the same.
Resolution:
Upgrade the Web Components to the same version as the installed version of MailMarshal Array Manager.

Why does the MailMarshal engine fail when using the 'Where number of attachments is' condition?

Charles Creegan — Thu, 07 Aug 2008 00:48:00 GMT
Abstract:
This article applies to:
MailMarshal SMTP 6.2 upwards
Question:
Why does the MailMarshal engine fail when using the 'Where number of attachments is' condition?
Information:
When using the Where number of attachments is condition in a rule and entering 0 for the 'Match messages where the number of attachments is' clause, the MailMarshal engine will not start
Error message: Num Attachments parameters are invalid
Resolution:
To resolve the issue, change the rule condition, commit configuration, and restart the engine. To check for messages with no attachments, you can set the condition to "number of attachments is less than 1."
Notes:
This issue will be resolved in a future release of MailMarshal.

Display Name:	Test Sender
Email Address:	test@outsidedomain.com
My incoming mail server is	Pop3
Incoming Mail Server:	127.0.0.1
Outgoing Mail Server:	127.0.0.1
Account name:	test
Password:	test

Display Name:	Test Receiver
Email Address:	test@localdomain.com
My incoming mail server is	Pop3
Incoming Mail Server:	127.0.0.1
Outgoing Mail Server:	127.0.0.1
Account name:	test
Password:	test