Items are quarantined again after being released from the Mail Security for Microsoft Exchange quarantine by mail

Products

• Mail Security for Microsoft Exchange

Issue/Introduction

After attempting to release an item from quarnatine by email, the item is quarantined again after being released from quarantine by Mail Security for Microsoft Exchange (SMSMSE).

The item has a different quarantine ID after being re-quarantined, and there is a notification generated and event log entry generated indicating that the item violated a policy. 

It takes more than 1 minute for the item to re-appear in quarantine.

Cause

When releasing an item from quarantine by email, SMSMSE creates a unique ID for the message called a reinsertion string, and inserts that string into the subject of the message. This reinsertion string is only honored for up to 1 minute. If it takes more than 1 minute for the message to be received and processed by Exchange, the item will be re-scanned, and any policies configured in SMSMSE will take effect on the message.

Resolution

SMSMSE can be configured to honor the reinsertion string for up to 5 minutes to allow a longer time between when the item is released and when it is delivered by Exchange while still not rescanning the item.

To change the timeout for the reinsertion string:

1. Open the registry editor (Start -> Run -> Regedit).
2. Navigate to one of the following locations:
   7.5.6 and earlier: HKLM\Software\Wow6432node\Symantec\SMSMSE\<version>\Server\Components\Quarantine
   7.9 and later: HKLM\Software\Symantec\SMSMSE\<version>\Server\Components\Quarantine
3. Create a new DWORD value called "ReleaseMailScanTimeDelayInMinutes" (case sensitive).
4. Set the value to 5.
5. Restart the Symantec Mail Security for Microsoft Exchange service.

SMSMSE will now honor the reinsertion string for up to 5 minutes, instead of the default value of 1. This should provide ample time for Exchange to process the released message and prevent it from being re-quarantined.