Symantec Premium AntiSpam does not detect spam on a non-English Exchange 2007 / 2010 server

Products

• Mail Security for Microsoft Exchange

Issue/Introduction

Symantec Mail Security for Microsoft Exchange is installed and Premium AntiSpam (PAS) is licensed. However, no action is taken against spam email. Even test messages that contain URLs which guarantee a positive spam verdict are not detected as spam.

Symptoms
 

The SMSMSE console shows that the PAS license is valid, that PAS is enabled, and that the PAS actions are correctly configured.

• Spam messages, even test messages which contain the URLs which guarantee a positive spam verdict from PAS, do not contain any X-Brightmail-Tracker code in their headers.
• The logs folder (C:\Program Files (x86)\Symantec\SMSMSE\6.0\Server\logs) contains a conduit.log file, but no bmserver.log.
• The ruleupdates.xml file (C:\Program Files (x86)\Symantec\SMSMSE\6.0\Server\stats\ ruleupdates.xml) shows that the PAS rules are being properly updated.
• There are no Brightmail errors in the Application Event log.
• Queries about Transport Agents in Exchange 2007 show that both SMSMSE Transport Agents are installed, enabled, and in their correct priority.
• A DebugView capture (using the CMDDebugEnabled and TransportAgentDebugOutput keys) of the Transport Agents in action shows no PremiumAntiSpamData, PremiumAntiSpamSettings or PremiumAntiSpamProcessing entries. An "SMSMSESMTPAgent: Error during SPA processing" is listed for every mail that is analyzed.

This problem has been seen on localized implementations of Exchange 2007/2010 (French, German, Italian, and Spanish).

Resolution

The solution to this issue is included in SMSMSE version 6.0.6 and above. To take advantage of all available enhancements and improvements, Symantec encourages all customers to update to the latest available version.

It is possible to manually change DCOM permissions on builds previous to SMSMSE 6.0.6 and thus enable PAS to process mail correctly.

Workaround steps

1. On the Exchange 2007 server, click on Start > Run and then type dcomcnfg in the Run window. Press Enter. This will open the Component Service management console.
2. Expand by clicking on Component Services > Computers > My Computer > DCOM Config.
3. Scroll down to the entry for the SAVFMSESpamStatsManager application. Right-click on SAVFMSESpamStatsManager, select Properties and choose the Security tab.
4. Edit "Launch and Activate permission." Add the Operating System's localized name for the INTERACTIVE and NETWORK_SERVICE accounts and grant them all permissions.
5. Edit "Access permission." Add the Operating System's localized name for the INTERACTIVE account and grant it all permissions.
6. Restart the Exchange Transport service and both SMSMSE services.

The server will process spam mail correctly with SMSMSE version 6.0.5.