MailMarshal Exchange 5.3

Version: 5.3.2, Last Revision: March 26, 2010

These notes are additional to the MailMarshal Exchange User Guide and supersede information supplied in that Guide.

The information in this document is current as of the date of publication. To check for any later information, please see M86 Security Knowledge Base article Q12133.

What's New
Upgrading MailMarshal Exchange
Uninstalling
Hardware and Software Prerequisites
Usage Notes
Change History

What's New

See the Change History for additional minor features and bug fixes.

Features New in 5.3.2

Additional Operating System Support: MailMarshal Exchange 5.3.2 is validated with Windows 2008 SP2 (but not Windows 2008 R2). See the Hardware and Software Prerequisites section.

Features New in 5.3.1

Additional Operating System Support: MailMarshal Exchange 5.3.1 has been tested on supported Exchange 2007 install environments. See the Hardware and Software Prerequisites section.

Features New in 5.3

Exchange 2007 Support: MailMarshal Exchange 5.3 is designed to support installation with Exchange 2007.
Note: To install with Exchange 2003, use MailMarshal Exchange 5.2.

Features New in 5.2

SpamCensor integration: MailMarshal Exchange can now update SpamCensor automatically over the web. SpamCensor is now integrated in the rule framework and does not require an external command.
Category Scripts: MailMarshal Exchange can now use XML Category Scripts to apply complex Regular Expression and TextCensor conditions to messages.
Sophos for Marshal: MailMarshal Exchange can now use Sophos for Marshal DLL based scanning. A separate installation is required for the configuration console. MailMarshal Exchange trial licenses include support for this scanner. Full licensing is available through M86 Security.
Spyware scanner integration: MailMarshal Exchange now supports PestPatrol and CounterSpy malicious content scanning as DLL based scanners (available through Virus Scanning rule conditions). Separate installations are required for the configuration consoles. MailMarshal Exchange trial licenses include support for these scanners. Full licensing is available through M86 Security.
Image Analyzer: MailMarshal Exchange now supports scanning and classifying of images as potentially pornographic content. Image analysis is implemented as a new rule condition. The Image Analyzer software is included in the MailMarshal installation and trial license. Full licensing is available through M86 Security.
Updated file recognition and unpacking: MailMarshal Exchange identifies and unpacks Office 2003 and 2007 documents, 7Zip archives, and more.
Bypass addresses: You can now configure MailMarshal Exchange to bypass processing completely for a list of problem email addresses.

Upgrading MailMarshal Exchange

You can upgrade MailMarshal Exchange from previous 5.3 releases.

You cannot upgrade from 5.2 or earlier versions, but you can import configuration from version 5.2.

Upgrading Steps and Notes

As best practice, back up your existing MailMarshal Exchange configuration (from the MailMarshal Exchange Configurator, click the properties icon, select the 'Advanced' tab and click 'Export Configuration'). You should also back up the existing files in the MailMarshal Exchange directories.
Make sure that all sessions of the MailMarshal Exchange Configurator and Console are closed. This includes remote sessions.
Run the MailMarshal Exchange setup program to install the upgrade. All existing configuration will be preserved.

Importing Configuration

You can import a MailMarshal Exchange 5.2 configuration to MailMarshal Exchange 5.3, as follows:

Do not import a MailMarshal Exchange 5.2 configuration in the initial configuration wizard. Install a default configuration. After installing, import the 5.2 configuration using Tools > Server Properties, General tab.
After you import the configuration, you must manually update the paths to the MailMarshal Exchange Explode directory and the Exchange Replay directory. See Tools > Server Properties, Advanced tab, Change folders option. Set these folder locations as full paths. Note that you must stop the MailMarshal Exchange Engine service before changing these paths.
The default locations for these directories are:
Explode: C:\Program Files (x86)\Marshal\MailMarshal Exchange\MMEExp
Replay: C:\Program Files\Microsoft\Exchange Server\TransportRoles\Replay

Uninstalling

You can cleanly uninstall the program by following these procedures:

Close any Console or Configurator instances.
Make sure that all the services have been stopped including the MailMarshal Exchange Engine and Controller.
Open the Windows Programs and Features (or Add/Remove Programs) control panel, locate MailMarshal Exchange and select Change.
In the wizard, select Remove. Complete the wizard to uninstall the software.
You may need to delete additional files from the installation location, such as quarantined message files.
If you have installed the Console or Configurator on other computers, repeat the uninstall on each computer.
If you have installed MailMarshal Exchange Reports and wish to remove it as well, follow the similar Uninstalling instructions in the Reports Release Notes file.
You can also drop the MailMarshal Exchange reporting database from SQL Server or SQL Express.
If you have installed SQL Express specifically to support MailMarshal Exchange reporting and you wish to remove it, you can do so from the Windows Programs and Features control panel.

Hardware and Software Prerequisites

Software

MailMarshal Exchange is supported in the following environments:

Windows Server 2008, Windows Server 2008 SP2, Windows Server 2003 SP2, Windows Server 2003R2 SP2
Exchange 2007
Active Directory
Hub Transport Role

Notes:

8.3 file name creation must be enabled.

SP2 for Windows Server 2003 is an Exchange 2007 prerequisite.

The MailMarshal Exchange Console and Configurator are supported in the following environments:

Windows Server 2008 (32 or 64 bits) including SP2 but not R2.
Windows Server 2003 SP1 or above (32 or 64 bits)
Windows XP Professional SP2 and above (32 bits only)
Windows Vista SP1 (32 or 64 bits)

Hardware

Hardware required is dependent on Microsoft Exchange Server. Follow Microsoft recommendations. Be aware that MailMarshal Exchange processing has a noticeable impact on email throughput.

You may require additional hard disk space depending on your archiving and quarantine retention policies. For default policies on a typical 1000 user server, M86 Security recommends you allow an additional 50 GB of free disk space for text logs, quarantine and archiving folders.

Installation recommendations

To help ensure smooth functioning of MailMarshal Exchange, M86 Security recommends the following:

Install MailMarshal Exchange on all Hub Transport servers to ensure that all messages are scanned.
For performance reasons, select a DLL integrated virus scanner. Do not use a command line scanner.
For performance reasons, do not install other roles on the servers (particularly, do not install the Unified Messaging role)
Although it is possible to add some Microsoft Edge Transport components to a Hub Transport server, M86 Security recommends you do not add these components.
Do not change the user for the Exchange Transport Service.
Do not manually adjust settings in the Exchange agents.config file, the transport agent priorities, or the default settings for the Replay directory.

Usage Notes

To view the MailMarshal Exchange performance counters in Windows Server 2008 (64 bits), you must run the MMC in 32 bit mode. Use the following command line to start Performance Monitor:
MMC /32 perfmon.msc

Change History

The following additional items have been changed or updated in the specific build versions of MailMarshal Exchange listed.

Note: The information in this document is current as of the date of publication. To check for any later information, please see M86 Security Knowledge Base article Q12133.

5.3.2 (March 26, 2010)

MEX-362	Messages details and text could not be viewed on a remotely installed Console. Fixed.
MEX-381	Agent installation fails if the Exchange Transport service is running under Local System account. The Console now raises a warning if this account is in use.
MEX-382	The registry setting to enable full logging by the Controller service was ignored. Fixed.
MEX-383	Selecting "default" on the Server Properties > Advanced >Additional options window did not set the engine restart flag as required. Fixed.
MEX-387	Some messages could not be opened in the Console due to a problem with shortcut target names. Fixed.
MEX-391	FROM field information was not fully resolved for messages between Exchange domains. Fixed.
MEX-393	The Message Release function could fail with Unicode messages. Fixed.
MEX-394	Messages can be lost when Journaling is enabled on Microsoft Exchange. A registry setting allows this issue to be worked around. For more information, see M86 Knowledge Base article Q13719.
MEX-400	Header rewriting could cause badly formatted email due to a missing CRLF. Fixed.
MEX-401	The version of MSSavi.DLL included in the install has been updated to 1.3.3.1. This DLL resolves issues with Sophos engine updates while under load.
MEX-403	With large distribution lists some users might not receive the message due to an issue with duplicate messages. This behavior can be adjusted with a Registry setting. For more information, see M86 Knowledge Base article Q13730.
MEX-408	Base64 encoded Cyrillic messages could be deadlettered due to an unpacking problem. Fixed.
MEX-410	Visual C++ redistributable versions included in the installer have been updated.
MEX-473	Certain PDF documents caused the engine to stop due to a problem with the file type identifier. Fixed.

5.3.1.6476 (November 19, 2008)

MEX-361	When viewing messages from a console installed remotely, incomplete or incorrect details were shown. Fixed.
MEX-370	If Active Directory becomes unavailable, some messages could remain in the Exchange Replay directory after Active Directory access is restored. Fixed: The MailMarshal Exchange Agent checks for any old messages when starting up, and re-queues them.

5.3.0.6328 (October 20, 2008)

MEX-88	Parking folders could not be created on the fly while creating rules. Fixed.
MEX-99	Obsolete variables have been removed from the menu selection lists.
MEX-104	The { for selection of a variable in templates did not work when editing HTML templates. Fixed.
MEX-235	Plaintext message stamps were not correctly processed to escape lines with single . characters. Fixed.
MEX-260	Configuration could be corrupted if an invalid file was imported. Fixed: invalid files are rejected.

5.2.0.5813 (July 17, 2008)

MEX-16	Message stamps were not applied to messages created in Outlook Web Access or Outlook 2003. Fixed.
MEX-17	Limits have been placed on unpacking of massively redundant archive files.
MEX-32	Improvements in PDF unpacking have been applied as in MailMarshal SMTP 6.2.
MEX-34	Images and text can now be extracted from Office 2003 Excel and PowerPoint documents.
MEX-49	Office 2007 documents are now recognized and can be unpacked.
MEX-80	The Message Release external commands now supports the "leave on server" and "release for specific recipient" options.
MEX-108	The message viewer in the Console has been upgraded to display many mail parts and attachments.
MEX-116	Logging from the Exchange Connector Stub has been reduced outside debug mode.
MEX-121	The console Mail History or Search Results could generate an unhandled exception in certain cases. Fixed.
MEX-130	Encrypted Word documents could be deadlettered due to a problem with file type recognition. Fixed.
MEX-131	Messages sent to distribution lists could fail to reach some internal recipients where a message was delivered to both a forwarding address and a mailbox. Fixed.
MEX-132	Messages synched with Treo 750 phones could lose the message body. Fixed.
MEX-133	Some Word 2003 encrypted documents were deadlettered due to unpacking problems. Fixed.
MEX-134	Messages sent to distribution lists could fail to reach some internal recipients. Fixed.
MEX-137	TextCensor can now act on text in Excel files.
MEX-139	Public Folder replication could fail. Fixed: these items now correctly bypass MailMarshal Exchange processing.
MEX-140	Corrupt Active Directory entries could cause problems starting the MMEngine service. Fixed: these exceptions are now handled so the engine can start.
MEX-143	Message stamps were not applied to TNEF/HTML messages created in Outlook 2003 or 2007. Fixed.
MEX-164	Processing can now be bypassed for specific addresses entered in the Configurator.
MEX-185	Archive unpacking now uses a new third party archive unpacker. Additional types can be unpacked and known unpacking exploits are addressed.
MEX-263	Variables marked with % % are no longer supported. Variables now are marked with { }. Existing instances are upgraded automatically.

5.1.1.2826 (March 16, 2007)

MEX-3	Issue involving forwarded messages duplicating in Exchange queue, fixed.
MEX-4	Mail to alternate recipient stays in queue. Fixed.
MEX-5	When the ExchangeStub is active, the public folder replication agent hangs at "Messages Queued for Local Delivery". Fixed.
MEX-6	MME stripping delivery receipt request for outbound emails. Fixed.
MEX-10	MME appears to be cutting bodies out of messages generated by ActiveSync. Fixed.
MEX-20	ARJ unpacking vulnerability. Fixed. (CVE-2006-5487).
MEX-26	File type detection has been improved, including detection of Office 2003 docs.
MEX-33	MME can now detect word documents saved in office 2003 format, by Office 2007 applications. (NOTE: At this point MME does not fully support office 2007 docs.)
MEX-75	F-Secure Anti-virus is no longer supported.
MEX-76	CA Anti-virus can now be added as a valid AV scanner for MEX.
MEX-77	Panda Anti-virus is no longer supported.
MEX-78	Support for outdated version of PestPatrol for Marshal has been removed.
MEX-83	Product has been re-branded and updated license agreement.
MEX-105	A stand-alone viewer for MML files, MMLViewer.exe, is now included in the installation. (Used for viewing TNEF file types, found in, C:\Program Files\Marshal\MailMarshal)