Attachment Filtering - Quarantined instead of dropped RSS

1

I have Attachment Filtering configured and have been using it for several years. I drop all the attachments in the lsit except .zip which I quarantine since we do occasionally get legitimate ones. The problem is we have been receiving a rash of infected .docm attachments and even though they are configured to be dropped they are being quarantined instead.

by paul.appleby2 2 years ago
2

@paul.appleby2: Hello Paul,

When you allow ORF to save the attachments of an email blacklisted by the Attachment Filtering test, it will quarantine all of the attachments that came with the blacklisted email and perform the configured action afterwards. In other words, it does not matter which action setting you choose (i.e. replace attachment with removal notice or drop the entire email), ORF will quarantine the attachment(s) if quarantining is enabled. See the relevant excerpt from the Attachment Filtering help page below:

"ORF quarantines attachments that are replaced by a replacement notice. ORF also quarantines all attachments when the email is dropped by Attachment Filtering (this includes even those attachments which did not match any filter rules)." - http://vamsoft.com/support/docs/orf-help/5.4/adm-oa-attachmentfltr

Tip: If you do not want to keep certain file types, I suggest that you create a batch file and a scheduled task on the server to periodically delete the unwanted files (e.g. *.docm) from the quarantine folder. I hope this helps.

by Daniel Novak (Vamsoft) 2 years ago
(in reply to this post)

New comment

Fill in the form below to add a new comment. All fields are required. If you are a registered user on our site, please sign in first.

Nickname:
Email address (will not be published):
Your comment:

ORF Technical Support

Configuring, installing and troubleshooting ORF.

News & Announcements

Your dose of ORF-related news and announcements.

Everything but ORF

Discuss Exchange and system administration with fellow admins.

Feature Test Program

Feature Test Program discussion. Membership is required to visit this forum.

ORF Beta

Join the great bug hunt of the latest test release.

Customer Service

Stay Informed