Attachment Filtering - Quarantined instead of dropped RSS Back to forum
@paul.appleby2:
Hello Paul,
When you allow ORF to save the attachments of an email blacklisted by the Attachment Filtering test, it will quarantine all of the attachments that came with the blacklisted email and perform the configured action afterwards. In other words, it does not matter which action setting you choose (i.e. replace attachment with removal notice or drop the entire email), ORF will quarantine the attachment(s) if quarantining is enabled. See the relevant excerpt from the Attachment Filtering help page below:
"ORF quarantines attachments that are replaced by a replacement notice. ORF also quarantines all attachments when the email is dropped by Attachment Filtering (this includes even those attachments which did not match any filter rules)." - http://vamsoft.com/support/docs/orf-help/5.4/adm-oa-attachmentfltr
Tip: If you do not want to keep certain file types, I suggest that you create a batch file and a scheduled task on the server to periodically delete the unwanted files (e.g. *.docm) from the quarantine folder. I hope this helps.
I have Attachment Filtering configured and have been using it for several years. I drop all the attachments in the lsit except .zip which I quarantine since we do occasionally get legitimate ones. The problem is we have been receiving a rash of infected .docm attachments and even though they are configured to be dropped they are being quarantined instead.