M86 Security Knowledge Base

SendSecure email retention period

Charles — Tue, 07 Feb 2012 01:49:11 GMT

This article applies to:

MailMarshal SendSecure

Question:

SendSecure allows the recipient of the message 14 days to retrieve it before the message is deleted.

Can I increase the retention period for messages?

Response:

It is possible to increase the retention period. The change would apply to all users and messages within a customer account.

To change this setting, please contact M86 Security Technical Support.

Email messages sent between SPE customers are rejected

Charles — Mon, 06 Feb 2012 22:04:29 GMT

This article applies to:

MailMarshal SPE 3.1.6

Question:

Email messages sent between SPE customers are rejected
SMTP response: 421 SMTP service is temporarily unavailable

Information:

MailMarshal SPE 3.1.6 uses a new method to route messages from one customer to another in the same installation (same MailMarshal SMTP array).

In earlier versions, the message would be handled once within the same processing server. In versions 3.1.6 and above, the message is processed for the customer outbound and then delivered to the recipient customer over SMTP using the MX record for the recipient domain. This method ensures correct application of rules and also has the effect of ensuring each customer sees the message processing normally outbound and inbound within the logs and message history.

However, in some cases MailMarshal SMTP can reject the "inbound" message, depending on the the receiver policies used and the number of messages deliered between the customers.

In the example below, DoS (Denial of Service) prevention has been enabled.

Sender log

Attempting delivery of B4f143a760000.000000000001.0002.mml via route yourdomain.com (MX) - *, SPE Cust ID: 1, Dir: out
Delivering via MX(yourdomain.com) A(smtp.yourdomain.com) IP(x.x.x.x):25
RX: <421 SMTP service is temporarily unavailable>

Receiver log

Accepted x.x.x.x:38741 on interface x.x.x.x:25 (1 of 50 active), Total active 1. Assigning thread x
<x.x.x.x> [DOS] exceeded DOS threshold. Current connection attempts: 150. Blocking.
TX: <421 SMTP service is temporarily unavailable>
Thread exiting for x.x.x.x after 0 millisecs

Resolution

Add the IP address to the exclusions for DoS Prevention

Open the MailMarshal SPE Web Admin console
Select the Array that the affected customer is assigned to
Click Edit and select the DoS tab
Click New
Add the external IP address or addresses for each MailMarshal SMTP processing node

Library failing to update

Alfred Alva — Thu, 02 Feb 2012 16:26:13 GMT

This article applies to:

R300, WFR, WF

Question:

Library failing to update

Reply

Below are some reasons why your library updates may be failing. If you are unable to determine the problem from this list, please contact our technical support staff for further assistance.

If you are installing a new filter, you will need to activate your hardware. The activation code is normally sent via email to the main account contact. Please notify us if you did not receive your activation code. Below is the link to register the unit.

Look at your Library>updates>view log file and look for username, it should be your hostname without any dots in the name, if you do not see the username set your configuration to log level 2 in Library>updates>configuration, then try a manual weekly download.
To find your host name go to system>network>lan settings. If you see the log file username does not match? then click on apply in lan settings without a reboot, and try another manual download. if exception errors are gone and username matches? it's fixed!

Have you changed the hostname recently? The hostname specified in your filters LAN Settings must match the hostname you registered when you activated your subscription.

Please verify that your firewall is allowing the filter to establish a https connection (on TCP port 443 or 1443), to our servers: patch.8e6.net and secureupdate.8e6.com (do an ‘nslookup’ to get all the IP addresses associated with these hosts (if) you manage your firewall in that manner).

Be sure that your system is running the most recent patch version. Go to the “software updates>local software update” to find the current patch version.

If the Library Update Log says “Cannot start another Traveler,” then that means its running

An expired subscription would also prevent your system from downloading updates. Please contact
support@8e6.com if you need further assistance.

We will need your serial number or hostname as a last resort to verify it has not been disabled.

Please verify your primary dns server is pingable and can resolve a domain.

This article was previously published as:: 8e6 KB 276589

Create override account on filter

Alfred Alva — Wed, 01 Feb 2012 22:22:11 GMT

This article applies to:

All Filters

Question:

How do I create an override account?

Reply

Go through the following troubleshooting steps:

If the user exists in an IP Group, make sure that you create the Override Account in the correct IP Group. For users that do not exist in an IPGroup, you can create an Override Account at the Global Group Profile level. A user cannot have an Override Account at both the Global Group and IPGroup levels—the IP Group takes priority.
Once you have created an Override Account, select the account and click “Rule” to define a filtering profile for that account. When finished, go back to the Account Details page and click “Apply.” If you fail to define a specific filtering profile for the Override Account, the user will default to the Minimum Filtering Level.
Also check Group -> Global Group -> Minimum Filtering Level to see if the “Allow an Override Account to bypass the Minimum Filtering Level” option is set appropriately.

This article was previously published as:: 8e6 KB 276583

How do I troubleshoot pattern over-blocking issues?

Alfred Alva — Wed, 01 Feb 2012 15:58:10 GMT

This article applies to:

R3000/WF/WFR

Question:

How do I troubleshoot pattern over-blocking?

Reply

Due to the nature of pattern based filtering, some overblocking or false-positives can occur. Pattern filtering takes precedence over normal library filtering rules, so adding the site/IP to an Allow category will not stop pattern detection from blocking the request.

However, if you know the IP address that is triggering the block, there are two ways this can be handled:

1.Admincontrol of pattern filtering Whitelist for R3000 Software Version3.0.00.9 or Higher:The new Pattern Detection Whitelist window (Library > PatternDetection Whitelist) lets you create a list of IP addresses that willalways bypass pattern detection filtering.

Only the IP is needed not any ports or http://

This article was previously published as:: 8e6 KB 300025

Why is facebook.com or twitter.com accessible when using HTTPS?

Giovanni Romualdi — Tue, 31 Jan 2012 16:30:23 GMT

This article applies to:

Web Filter (WF/WFR)

Question:

Web Filter is set up correctly so why are end users able to access sites like facebook.com and twitter.com using https?

Information:

If the HTTPS Filtering Level is set to Medium but end users are still experiencing slippage for sites like facebook.com and twitter.com when using https, then the problem may be caused by the presence of unwanted ip addresses belonging to facebook and/or twitter in the custom categories.

In the GUI go to Library > Category Groups > Custom Categories > Category Name > URLs > Upload Master. When uploading Master URL Lists for custom categories the WF will first validate the URL list and then it will ask if you would like to upload the file with IP lookup or without IP lookup.

The recommended choice is to upload the file without IP lookup. If you instead select to upload the file with IP lookup enabled, IP addresses that correspond to URLs in the uploaded file will be added to the custom library. If those IP addresses belong to facebook or twitter and the category is not set to block then the WF will not block connections to the sites in question when using https.

The solution is to re-upload your Custom Categories Master URL Lists but this time without iplookup. If you cannot do that, M86 Staff will be available to fix this issue through the backend, please contact M86 Technical Support and mention KB article # 14478.

Detection of password-protected 7-zip archives

Charles — Fri, 27 Jan 2012 01:06:40 GMT

This article applies to:

MailMarshal SMTP 6.4 and above
MailMarshal Exchange 7.X
WebMarshal 6.X

Symptoms:

Attempting to process a password protected archive file in 7-zip (.7z) encrypted format
The file is not detected as encrypted
The unpacker returns a generic error: exit code (2)
- In MailMarshal by default the message is quarantined in a dead letter folder
- In WebMarshal by default the file is blocked by a rule

Information:

Correct handling of password protected archives depends on the ability to distinguish the file type. However, the specification for 7-zip password protected (encrypted) files is such that there is no practical way of distinguishing these files from unencrypted 7-zip files. This fact is confirmed by the developers of 7-zip.

As a result, M86 products identify all 7-zip format archives as generic 7-zip archives.

When the unpacking process attempts to open these files, it returns a "fatal" error (exit code 2), the same error returned when the archive is corrupt.

Workarounds:

In MailMarshal SMTP 6.9 and above, you can choose to release or redirect deadlettered messages automatically using a dead letter rule.
- You should limit this automated activity as narrowly as possible, by the specific sender, recipient, or other criteria.
In WebMarshal, you can choose to permit download or upload of files that cannot be unpacked, with or without a warning.

Warning: The content of these files cannot be scanned and the files could include malicious or inappropriate content. M86 Security recommends that you do not implement a catch-all rule to pass these files through. Review the affected files carefully before releasing them to end users.

The same warning applies to all password protected files.

Notes:

This issue applies only to archives encrypted in the 7-zip encryption format. It does not apply to archives in other formats such as RAR encrypted and ZIP encrypted files.
It is not possible to create a custom file type (filetype.cfg entry) for these files.
M86 Security continues to monitor the technical situation. If a reliable detection method for these files becomes available it may be included in future releases.

What is the Quota Feature?

Alfred Alva — Tue, 24 Jan 2012 21:22:49 GMT

This article applies to:

R3000/WF/WFR

Question:

What is the Quota Feature in the profiles?

Reply

This is NOT a bandwidth feature.

What is the Quota Feature used for?
Quota feature lets users visit specified sites for a defined time period – This filtering profile component (accessible via the Category Profile page) lets the administrator specify a set number of minutes/hits in which an end user can access a library category or category group before receiving a warning message or quota block page. If a specified number of minutes is defined for the Overall Quota, the end user can only spend that maximum amount of time at all quota-marked libraries/categories before being blocked from accessing URLs in any quota-marked library/category. If the end user is blocked from Internet access via the quota feature, he/she will need to wait until the quota is reset before accessing any Internet content.

This feature affects the following areas of the interface:

The Quota Settings window (System > Quota Settings) lets a global administrator specify the number of seconds that constitute a hit. This setting, along with the minutes specified in the quota, determine when the quota time has maxed-out and the user will be blocked from further access to URLs in that category, until the quota is reset. This window also lets the global administrator reset all quotas on demand, or set up a schedule for automatically resetting all quotas.

Please note, the quota time defined will relate to the actual time browsing on a site in a given category. The quote time is not based on clock time, but on the number of hits (as defined in seconds).

For example:

Let's assume that you have a quota of 60 minutes set up for the Sports library category and you have defined each hit to be equal to 10 seconds (default setting).

When a user goes to a site categorized under Sports, their initial landing of the site will equal its first hit and 10 seconds will be applied towards the quota. As the user proceeds to click links on this sports site, each click will remove 10 more seconds from the quota.

If the user walks away from the browser, and leaves the page open without any activity for 60 mins, no additional hits will apply to his quota due to the inactivity.

Of course, there are some sites that force client browsers to request updates regularly -- each of these requests would register as another hit. A hit will basically be triggered anytime there is a request from the client browser -- whether it's user initiated or browser initiated. If a user is browsing to a site that 'updates' its content on a regular basis (every minute, for example), the scripting on this site initiates additional requests to the web server -- and this behavior would qualify as a hit.

However, it is important to note that it is not possible to generate more than one minutes worth of traffic in any given minute. For example, if a user’s visits a sports site 25 times in one minute, even though they would accrue 10 seconds per hit the R3000 will only accumulate a total of 60 seconds total per minute to ensure that the user truly gets the 60 minutes their quota offers.

Overall Quota

Example: internet radio= 10 min shopping=25 min
But you set 10 min overall quota, 10 min will take precedence, it's imposible to control which categories the user will use the most.
Each LDAP, IPgroup or individual profile is setup separately.

This article was previously published as:: 8e6 KB 292279

Does the Google Chrome browser work with 8e6 Technologies products?

Alfred Alva — Tue, 24 Jan 2012 17:47:20 GMT

This article applies to:

Enterprise Reporter
WF/WFR
Threat Analysis Reporter

Question:

Does the Google Chrome browser work with 8e6 Technologies products?

Reply

8e6 has performed a thorough test of Google Chrome for it’s compatibility with the 8e6 product line. The findings of these tests are as follows:

End-user web surfing activity is completely supported with no errors detected:

Authenticator – Pass

AD Agent – Pass

e-Directory Agent - Pass

Tier 2 Authentication - Pass

Tier 3 Authentication – Pass (May require a reinstallation of Java)

Override Account - Pass

Pattern test - Pass

HTTPS traffic (all configurations) - Pass

X-strikes - Pass

Real Time Probes - Pass

Google Safe Search - Pass

Yahoo Safe Search - Pass

AOL Safe Search - Pass

ASK Safe Search - Pass

Search Engine Keyword Filtering - Pass

URL Keyword Filtering - Pass

Extended URL Keyword Filtering - Pass

Quota Filtering - Pass

Warn Filtering - Pass

Block Page – Pass

All Web Usage Activity Logged and Reported Correctly - Pass

For Administrators accessing the R3000 GUI via Google Chrome, most features are supported. There are a small number of features within the R3000 that will not work. For the time being Google Chrome is not officially supported for access to the R3000, Enterprise Reporter, and Threat Analysis Reporter management consoles. Customers should use the supported web browsers of Internet Explorer, Firefox, or Safari to access the R3000, Enterprise Reporter and Threat Analysis Reporter management consoles. Once Google Chrome is no longer considered beta by Google, 8e6 will move to support Google Chrome for use with all management interfaces.

These are the versions that are in the PDF on our website.

Google Chrome 13.0
Internet Explorer 8.0
Mozilla Firefox 6.0
Safari 5.1

This article was previously published as:

: 8e6 KB 295442

Can I create sub-admins for LDAP groups?

Alfred Alva — Fri, 20 Jan 2012 23:15:41 GMT

This article applies to:

WF WFR

Question:

Can I create sub-admins for LDAP groups? yes

Reply

To add a LDAP group administrator account, please follow the instructions below:

WFR/WF software version (any)

A. Create a sub admin account

1. Select Administrator under System Tab.

2. In the Account Details frame, enter the username in the Username field.

3. In the Password field, enter eight to 20 characters including at least one alpha character, one numeric character, and one special character. The password is case sensitive.

4. Make the same entry again in the Confirm Password field.

5. Select “Admin” or “Sub Admin” from the Type pull-down menu. (“Admin” for global administrator or “Sub Admin” for LDAP group administrator only).

6. Click Add to include the username and account type in the Current User list box.

Note: Sub admin can manage domain, group(s), member(s), and/or LDAP containers.

B. Assign Sub Admin to LDAP Entity

1. Click Assign to at any level of the LDAP Group tree (domain, group, member, LDAP container) under Group Tab.

2. From the Assign to user field, choose from the list of available Sub Admins.

3. Click Apply to assign the Sub Admin to that node and to enter that Sub Admin’s username in the Assigned User column in the list box.

This article was previously published as:

: 8e6 KB 276460

The CMC Management status is empty.

Giovanni Romualdi — Fri, 20 Jan 2012 18:54:31 GMT

This article applies to:

WF 4.x
WFR 4.x

Question:

Why is the ‘Filter Status’ column empty under the CMC Management of the Source Web Filter? GUI > CMC Management > Status

Reply:

The Filtering Status information will only display if the “Upstream Failover Detect” option is enabled in the Synchronization Setup window.

Supported Operating Systems and Prerequisite Versions

Charles Creegan — Fri, 20 Jan 2012 00:35:24 GMT

This article applies to:

MailMarshal SMTP 6.9
- MailMarshal Web Components (SQM and Web Console)
WebMarshal 6.9
MailMarshal Secure Email Server 5.6
MailMarshal Reporting Console 2.5 (for MailMarshal and WebMarshal)

(For MailMarshal Exchange, see Q14131. For MailMarshal Service Provider Edition [SPE], see Q11588.)

Question:

What are the supported operating systems for MailMarshal and WebMarshal?
What version of SQL Server can be used with MailMarshal and WebMarshal?
What versions of IIS and ASP.NET are supported by MailMarshal Web components?
What versions of SQL, IIS and ASP.NET are supported by Marshal Reporting Console?
What versions of ASP.NET are supported by WebMarshal?
What versions of Internet Explorer are supported for MailMarshal Web components?
What versions of ISA Server can be used with WebMarshal as a plugin?

Information:

This article shows supported versions of operating systems and supporting software.

Notes:

The information reflects the latest versions of Marshal products. For details of previous versions, see the documentation for each version.

The information reflects server requirements. For details of requirements for all user interfaces, see the documentation for each product version.

All 64 bit operating system support is by 32 bit application deployment.

VMWare deployments of the supported operating systems are also supported. See M86 Knowledge Base article Q11828.

Key:

Symbol	Meaning
RTM SPn	Mimimum required, tested and supported service pack (RTM=Release to Manufacturing, no service pack).
Qxxxxxx	Tested, Supported. See the KB article listed for known issues and workarounds.
	Not currently supported, obsolete, or known issues.
	Not specifically tested. Not yet supported. M86 plans to test and provide support in a later product release. For details of the policy on new OS and SP versions, see Q13687.
(blank)	Not applicable to this product.

Operating Systems and Prerequisites

The table below lists minimum compatible operating system versions and service packs. The products have been tested with the minimum compatible service pack (and in some cases with later service packs).

Note on Service Packs and Operating System updates: If product functionality is affected by Service Packs or Microsoft updates, M86 Security will work with customers to restore functionality. If a full resolution requires product development, it may not be available immediately.
Historically, core functionality of the products listed has rarely, if ever, been affected by such updates. However, M86 Security cannot guarantee future performance.

Server Operating Systems

	MailMarshal SMTP 6.9	MailMarshal SMTP Web Components 6.9	Marshal Reporting Console 2.5	MailMarshal SES 5.6	WebMarshal 6.9
Windows Server 2008 R2	RTM	RTM	RTM		RTM
Windows Server 2008 (32 bit)	RTM	RTM	RTM		RTM
Windows Server 2008 (64 bit)	RTM	RTM Q12671	RTM Q12671		RTM
Windows Server 2008 (Core Edition)
Windows 2003 R2	SP1	SP1		SP1	SP1
Windows 2003 (32 bit)	SP2	SP2	SP2	SP1	SP1
Windows 2003 (64 bit)
Windows 2000
Microsoft Small Business Server 2011
Microsoft Small Business Server 2008	RTM (Same server installation)	RTM Q12671	RTM Q12671		SP2
Microsoft Small Business Server 2003 Release 2	RTM (Same server installation)
Microsoft Small Business Server 2003	(Same server installation)
Microsoft Small Business Server 2000	(Same server installation)

Workstation Operating Systems
(for server installation)

<><

	MailMarshal SMTP 6.9	MailMarshal SMTP Web Components 6.9	Marshal Reporting Console 2.5	MailMarshal SES 5.6	WebMarshal 6.9
Windows 7 (32 and 64 bit)	RTM	RTM	RTM		RTM
Windows Vista Business or Ultimate edition (32 bit)	SP1	SP1	SP2		SP1
Windows Vista Business or Ultimate edition (64 bit)			SP2
Windows XP	SP3 (as a domain member)	SP3	SP3	SP2	SP2

Prerequisites

	MailMarshal SMTP 6.9	MailMarshal SMTP Web Components 6.9	Marshal Reporting Console 2.5	MailMarshal SES 5.6	WebMarshal 6.9
Internet Explorer (for Configurator and Consoles)	6.0	6.0	7.0	6.0	6.0
IIS		6.0	5.1 (XP)
.NET Framework		4.0	3.5 SP1		2.0

SQL Server Versions

	MailMarshal SMTP 6.9	Marshal Reporting Console 2.5	MailMarshal SES 5.6	WebMarshal 6.9
SQL 7 MSDE 1.0 SQL 2000 MSDE2000	(6.7 is the last version that supports SQL 2000)
SQL 2005 SQL Express 2005	SP3 Q11018	SP3	RTM	RTM
SQL 2008 SQL Express 2008	RTM	SP1		RTM
SQL 2008 R2 SQL Express 2008 R2	RTM	RTM		RTM

ISA Server Versions (WebMarshal)

WebMarshal 6.9 ISA Server plugin is compatible with the following versions and minimum service packs of ISA Server:

ISA 2004: SP2
ISA 2006: RTM
Forefront TMG: RTM

WebMarshal 6.9 ISA Server plugin is not compatible with ISA 2000.

Note: WebMarshal can be installed chained to any proxy server, including any version of ISA Server.

What are the Release Notes for MailMarshal SPE 3.1?

Charles — Wed, 18 Jan 2012 06:50:40 GMT

This article applies to:

MailMarshal SPE 3.1

Question:

What are the Release Notes for MailMarshal SPE 3.1?

Information:

The Release Notes included with MailMarshal SPE 3.1 are accurate as of the date of publication.

Build 3.1.6.13801 was released on September 20, 2011.
This article provides any additional information generated after that date.
Full release notes are provided with the installation package.

MailMarshal SMTP Version

The latest version of MailMarshal SMTP that works with MailMarshal SPE 3.1.6 is 6.9.9. (Note this is a change. 6.9.9 was released January 17, 2012. For details see the MailMarshal SMTP Release Notes.)
- Important: Due to a minor issue with detection of prerequisites, for clean installations you must install MailMarshal SMTP 6.9.8 before configuring arrays with SPE, and later upgrade to 6.9.9.
Note that the Connector Agent version provided is still 6.9.5.

Sending Delay Notifications to External Addresses

Charles — Mon, 16 Jan 2012 23:28:54 GMT

This article applies to:

MailMarshal SMTP (SEG) 6.9.9 and above

Question:

Notifications of delayed delivery are only sent to local recipients
How do I send delay notifications for incoming messages to the original sender?

Procedure:

By default MailMarshal sends notifications of delayed delivery only to local users (email addresses matching the Local Domains table). In practice this means that delay messages are sent only for outgoing messages.

If you want to send delay notifications to external users (where the delayed message originated in a non-local domain), you can configure this behavior using a Registry entry.

On the MailMarshal Array Manager server, open Regedit.
- The below information is correct for version 6.9.9 (32 bit). For full details of the registry locations to edit for each version, see article Q10832.
Navigate to the key: HKEY_LOCAL_MACHINE\Software\Marshal\MailMarshal\Default\Sender
Create a DWORD value SuppressExternalNotifications
Set the value to 0
Reload MailMarshal configuration.

Notes:

As always, take due care when editing the Registry.

What versions of Marshal Security products are currently supported by M86 Technical Support?

Charles Creegan — Mon, 16 Jan 2012 23:27:58 GMT

This article applies to:

MailMarshal SMTP
MailMarshal Exchange
MailMarshal SPE
MailMarshal SES
Marshal Reporting Console
MailMarshal Appliance e10000
WebMarshal
Marshal EndPoint Security
Kaspersky for Marshal
McAfee for Marshal
Sophos for Marshal
Counterspy for Marshal
PestPatrol for Marshal
MailMarshal Management Pack for MOM
MailMarshal Management Pack for SCOM
Security Reporting Center
Firewall Suite
imMarshal for MSN

Question:

What versions of Marshal products are currently supported by M86 Technical Support?

Information:

The following tables show the currently supported versions, planned dates of termination of support, and support end dates for discontinued versions.

Note: In this article "supported" refers to full product support as defined in M86 Security support policy.

For "discontinued" versions, M86 Security can often provide advice to help customers resolve issues. However, M86 Security may recommend upgrade to a later version of the software.

If a reported problem requires remedial development work, M86 Security will usually provide a fix only for the latest product version.

Upgrades to the current versions of these products are always free of charge to customers with a current maintenance contract.

Prerequisites and Supported Operating Systems

For detailed information about these requirements, see the release notes for your specific version. For a quick summary see:

Q11358 (MailMarshal SMTP/SEG, WebMarshal)
Q14131 (MailMarshal Exchange)
Q11588 (MailMarshal Service Provider Edition)

MailMarshal SMTP (including MailMarshal Secure)

Note: SpamCensor updates are currently provided for the following versions:

Version 6.2.2 and above

Version 5.5.7

Software Version	Release Date	Discontinued Date
6.9.9.4075	January 17, 2012	Active
6.9.8.3800	November 3, 2011	Active
6.9.7.3719	October 18, 2011	Active
6.9.6.3437	September 6, 2011	Active
6.8.4.9558	November 16, 2010	Active
6.8.3.9481	June 3, 2010	July 1, 2011
6.8.2.9371	April 27, 2010	July 1, 2011
6.7.2.8378	November 10, 2009	October 10, 2011
6.5.4.7535	May 27, 2009	May 30, 2010
6.5.3.7407	May 18, 2009	January 31, 2010
6.5.1.7247	April 21, 2009	January 31, 2010
6.4.6.5922	August 6, 2008	January 31, 2010
6.4.5.5695	June 26, 2008	May 30, 2009
6.4.1.5038	March 13, 2008	May 30, 2009
6.4.0.4772	January 31, 2008	May 30, 2009
6.4.0.4743	January 25, 2008	May 30, 2009
6.4.0.4737	January 25, 2008	May 30, 2009
6.4.0.4714	January 22, 2008	May 30, 2009
6.4.0.4659	January 15, 2008	May 30, 2009
6.2.2.3503	October 11, 2007	May 30, 2009
6.2.1.3252	July 12, 2007	March 1, 2009
6.2.0.2977	May 2, 2007	March 1, 2009
6.1.8.2172	November 23, 2006	March 1, 2009
6.1.8.2137	November 15, 2006	March 1, 2009
6.1.8.2074	November 7, 2006	March 1, 2009
6.1.6.1172	July 12, 2006	March 1, 2009
6.1.5.586	May 24, 2006	March 1, 2009
6.1.4.441	April 10, 2006	March 1, 2009
6.1.3.81	February 16, 2006	March 1, 2009
6.0.3.33	September 21, 2005	March 1, 2009
6.0.3.8	December 16, 2004	March 1, 2009
5.5.7.1596	September 6, 2006	November 1, 2009
5.5.6	May 1, 2003	March 1, 2009
5.0	July 2002	Withdrawn
4.X	November 2000	Withdrawn
3.X	February 2000	Withdrawn
2.X	November 1998	Withdrawn

MailMarshal Exchange

Software Version	Release Date	Discontinued Date
7.0.2.2288	July 14, 2011	Active
7.0.1.2277	March 22, 2011	Active
7.0.0.2246	(Limited Availability November 18, 2010)	March 22, 2011
5.3.2.9252	April 20, 2010	Active
5.3.1.6476	November 19, 2008	July 1, 2011
5.3.0.6238	October 29, 2008	July 1, 2011
5.2.1.8496	November 24, 2009	Active
5.2.0.5813	August 1, 2008	July 1, 2011
5.1.1.2826	March 20, 2007	March 1, 2009
Hotfix 47575 (5.1.0.5)	February 7, 2005	March 1, 2009
Hotfix 45349 (5.1.0.5)	January 15, 2005	March 1, 2009
Hotfix 43152 (5.1.0.5)	November 20, 2004	March 1, 2009
5.1.0.5	September 15, 2004	March 1, 2009
5.1.0.4	July 5, 2004	March 1, 2009

MailMarshal SPE

Software Version	Release Date	Discontinued Date
SPE Version 3.1.6.13801 SMTP Version 6.9.9.4075 (Note updated SMTP version)	September 20, 2011	Active
SPE Version 3.1.5.13612 SMTP Version 6.9.6.3437	(Limited Availability August 23, 2011)	September 20, 2011
SPE Version 3.0.1.6427 SMTP Version 6.8.4.9558 (Note: 6.8.3 is no longer supported with SPE. Customers should upgrade the MailMarshal SMTP software as soon as possible)	August 31, 2010	Active
SPE Version 2.3.7.5528 SMTP Version 6.4.7.6160	April 8, 2010	July 1, 2011
SPE Version 2.3.6.5169 SMTP Version 6.4.7.6160	December 8, 2009	October 1, 2010
SPE Version 2.3.5.5033 SMTP Version 6.4.7.6160	May 26, 2009	May 1, 2011
SPE Version 2.3.3.4992 SMTP Version 6.4.7.6160	March 24, 2009	October 1, 2010
SPE Version 2.3.2.4984 SMTP Version 6.4.7.6160	January 20, 2009	October 1, 2010
SPE Version 2.3.1.4958 SMTP Version 6.4.7.6160	November 11, 2008	March 1, 2010
SPE Version 2.3.0.4947 SMTP Version 6.4.7.6160	October 20, 2008	March 1, 2010
SPE Version 2.2.0.4305 SMTP Version 6.4.1.5038	March 19, 2008	March 1, 2010
SPE Version 2.1.1.3646 SMTP Version 6.1.10.3664	November 27, 2007	March 1, 2009
SPE Version 2.1.0.3311 SMTP Version 6.1.10.3664	June 25, 2007	March 1, 2009
SPE Version 2.1.0.3286 SMTP Version 6.1.9.3058	June 7, 2007	March 1, 2009
SPE Version 2.0.3.2823 SMTP Version 6.1.9.2859	March 29, 2007	March 1, 2009

MailMarshal Secure Email Server (SES)

Software Version	Release Date	Discontinued Date
5.6.0.5716	June 23, 2008	Active

e10000 (MailMarshal Node Appliance)

Software Version	Release Date	Discontinued Date
6.3.0.3361	September 25, 2008	Active

Marshal Reporting Console

(previously known as MailMarshal Reporting Console)

Software Version	Release Date	Discontinued Date
2.5.2.1214	November 22, 2011	Active
2.5.1.1208	April 26, 2011	Active
2.5.0.1189	March 30, 2011	Active
2.1.0.843	April 28, 2009	Active
2.0.1.438	September 1, 2008	Active

WebMarshal

Software Version	Release Date	Discontinued Date
6.9.2.7268	August 17, 2011	Active
6.9.1.7256	July 19, 2011	Active
6.8.1.7774	October 19, 2010	Active
6.5.6.7349	April 28, 2010	July 19, 2011
6.5.5.6975	March 9, 2010	July 19, 2011
6.5.3.6489	October 22, 2009	July 19, 2011
6.5.2.6232	September 9, 2009	July 19, 2011
6.1.7.4636	February 10, 2009	November 30, 2010
6.1.5.4286	November 4, 2008	March 1, 2010
6.1.3.4007	July 29, 2008	March 1, 2010
6.1.2.3890	June 5, 2008	March 1, 2010
6.1.1.3875	May 29, 2008	March 1, 2010
6.0.3.3522	March 19, 2008	March 1, 2010
6.0.3.3155	December 19, 2007	March 1, 2010
6.0.2.2867	October 24, 2007	March 1, 2010
3.7.5.2637	March 6, 2007	March 1, 2010
3.7.4.2375	October 31, 2006	March 1, 2009
3.7.4.2031	October 19, 2006	March 1, 2009
3.7.3.1040	June 29, 2006	March 1, 2009
3.5.4.51		March 1, 2009
3.0.3.25	June 20, 2003	March 1, 2009
2.5.3.20	August 6, 2002	March 1, 2009
2.2.0.20	December 5, 2001	March 1, 2009
2.0.16.1	April 23, 2001	March 1, 2009

EndPoint Security

Software Version	Release Date	Discontinued Date
5.0	March 20, 2009	Active
4.6.B23	June 2, 2007	Active

Kaspersky for Marshal

Software Version	Release Date	Discontinued Date
1.0.0.9484	June 22, 2010	Active

McAfee for Marshal

Software Version	Release Date	Discontinued Date
6.0.4.8606	December 15, 2009	Active
6.0.3.8294	October 22, 2009	Active
6.0.2.7263	April 28, 2009	Active
6.0.1.6519	December 4, 2008	Active
5.200.0.4629	December 19, 2007	January 31, 2009
5.100.0.2735	March 8, 2007	January 31, 2008
5.100.0.2454	January 17, 2007	January 31, 2008
5.100.0.2371	December 19, 2006	January 31, 2008
4.4.0.0	June 9, 2004	January 31, 2007

Sophos for Marshal

Software Version	Release Date	Discontinued Date
1.0.4.9547	November 11, 2010	Active
1.0.3.8975	March 23, 2010	Active
1.0.2.8084	August 26, 2009	Active
1.0.1.5823	July 17, 2008	Active
1.0.0.4359	November 28, 2007	Active

Counterspy for Marshal

Software Version	Release Date	Discontinued Date
1.0.1.1049	November 28, 2007	Active

PestPatrol for Marshal

Software Version	Release Date	Discontinued Date
1.0.1.1049	November 28, 2007	Active

MailMarshal Management Pack for MOM

Software Version	Release Date	Discontinued Date
1.2	January 11, 2007	End of Support: May 1, 2013

MailMarshal Management Pack for SCOM

Software Version	Release Date	Discontinued Date
1.3.0.1	September 19, 2008	End of Support: May 1, 2013

Security Reporting Center (Windows Version)

Software Version	Release Date	Discontinued Date
2.1b (3232)	August 7, 2006	End of Support: December 31, 2009
2.1a (3190)	March 10, 2004	August 7, 2006
2.0 (2563)	November 14, 2003	March 10, 2004

Security Reporting Center (Solaris Version)

Version	Current Status	Release Date	Replaced By
2.x	Withdrawn		-

Firewall Suite

Version	Current Status	Release Date	Replaced By
4.1c	Withdrawn	July 2003	-

imMarshal for MSN

Version	Current Status	Release Date	Replaced By
1.X	Withdrawn	March 2003	N/A


This article was previously published as:: NETIQKB33882

Additions to Release Notes for MailMarshal SMTP 6.9

Charles — Mon, 16 Jan 2012 23:26:14 GMT

This article applies to:

MailMarshal SMTP 6.9

Question:

What are the Release Notes for MailMarshal SMTP 6.9?

Information:

The Release Notes included with MailMarshal SMTP 6.9 are accurate as of the date of publication. This article provides any additional information generated after that date.

The current release of MailMarshal SMTP is 6.9.9, released on January 17, 2012 (build 6.9.9.4075).

Release 6.9.9 provides fixes for a number of specific issues identified in the previous 6.9 releases. For details see the Release Notes.

SQL 2005 prerequisite

The Release Notes and other documentation state that the Service Pack requirement for SQL 2005 and SQL 2005 Express is SP2 or above.

However the actual requirement is SP3 or above.

This requirement applies to all MailMarshal 6.9 releases. It is checked and enforced by the Configuration Wizard and Server Tool.

Is there a way to block all Youtube videos that contain adult content or pornography?

Alfred Alva — Mon, 16 Jan 2012 15:50:25 GMT

This article applies to:

R3000

Question:

Is there a way to block all Youtube videos that contain adult content or pornography?

Reply

Please use our safe search enforcement feature in the profile>filter options.

This article was previously published as:: 8e6 KB 291135

Quick Start with Vusafe and 4.1 version

Charles Creegan — Mon, 16 Jan 2012 15:37:22 GMT

This article applies to:

Any filter that has a serial number starting with 5k270 and above or purchased on or after 2008 and has the version 4.1 or 3.0 installed can use Vusafe.
WF or WFR

Question:

How do I setup my Vusafe feature?

Procedure:

NOTE: please verify you don't have SWG product (Finjan or Secure Web Gateway) blocking youtube.com.
Since mostly schools will use this businesses can also use it as well, in fact the public can use it but only see a student view or community videos.

Lets begin: This is a quick start basic configuration.

The more information is located on our website under http://www.m86security.com/support/r3000/upgrade.asp

Open an account at http://www.m86vusafe.com and register (you will receive password and username assigned in 1-2 business days).

1. Customer will Login to http://www.m86vusafe.com/index.php using assigned admin user/password

2. Click on left side Settings>M86 Filter integration, this will take you to management section to add your passkey. The pass key is created by you.

2. Next step is to create your passkey for integration and follow rules listed. And copy the passkey for next step on the filter side.

3. Open the UI for the filter and go to Policy>Global group>Approved Content as shown.

4. Go to Policy menu and click on Global Group> Approved Content as shown.

Then check the box and paste the passkey in the field below and add.

This area will be your global passkey that can be inherited to all the Ipgroups or LDAP. unless you specify to disable in the group.

Next step is to decide what Profile Groups will be using the Vusafe feature, some groups or all the groups Global, LDAP, IPGROUP. If you just use Global group the whole tree will have access to the Vusafe site but they do need a user/student login that only the administrator can assign in settings.

lets use an IPgroup for this example.

Once you 'Enable Approved Content' the passkey for all groups and subgroups will allow access with a login.

Open the IPGroup profile like shown below and block RRated, Generic Streaming media, and Video Sharing, this will block all youtube.com pages for all except Vusafe users, note: If you have Generic Streaming Media or Video Sharing on 'ALLOW', then the allow will take precedence over the Block for all users. Use 'Pass' instead of allow. Leave Flash Video on 'pass' As shown below.

To test if approved content is working. login to Vusafe website http://www.m86vusafe.com/index.php And see if your videos play, if you get a blank screen (see beow) after clicking on a video then check your steps again, something is mis-configured. Check screen shot 4 and 5 for the passkeys enabled or disabled. Maybe your custom categories are blocking something, run a real-time probe and see what is blocking. Tech support will ask for a real-time probe unless you figure it out.

FAQ, with this first release:

Do I need to create thousands of users or student accounts?
- no assign the teacher or class instructor a user account for all to use for that class or demonstration.
Since Google and youtube use the same ip subnet, how can I block videos from playing?
- add the url *.ytimg to a block all category. the vusafe will still work, you may also block Intranet>edge content servers to achieve the same results.
Can I upload my own videos?
- No not to vusafe portal, you can upload to youtube and pull in.
Can I block R Rated, Generic Streaming Media and Video Sharing?
- Yes this will allow the vusafe to stream correctly.
Can teachers or sub-admins see inappropriate videos?
- yes.

Note:

The customer must use our current vusafe categories and cannot create their own. (TRSTSFR) is a vusafe category to 'pass'
Emails from students and teachers may be turned off in the admin UI of Vusafe portal.
Do I need to invite teachers or sub-admins view community videos?
- Yes they need a login created.
I lost my password, Does the portal have a ‘forgot my password’ feature,
- yes, you must know the ‘secret answer’ when you signed up.
How do I resolve admin login issues,
- please contact Vusafeadmin@m86security.com
What do I do if the vusafe website is down?
- Contact support at 713-682-1400

Google Safe Search Enforcement

Alfred Alva — Mon, 16 Jan 2012 14:56:32 GMT

This article applies to:

All Filters

Question:

What is Google Safe Search Enforcement in the filter

Reply

Google.com

When I make the selection as indicated in Fig.1 below does it enforce the “Strict Filtering” or “Moderate Filtering” under the google safe search?

The filter enforces the “Strict Filtering” option that these search engines deem as explicit text or inappropriate images.The filter just locks down the ability to change the filter options.

With the Google/Bing/Yahoo!/Youtube/Ask/AOL SafeSearch Enforcement option enabled, Google, Bing.com,Yahoo!, YouTube, Ask.com, and AOL’s “strict” SafeSearch Filtering option will be used whenever end users perform a Google, Bing.com, Yahoo!, YouTube, Ask.com, or AOL Web search or Image search.
WARNINGS: This feature is not compatible with the proxy environment as it will cause overblocking.

An inappropriate image will only be blocked if that image is included in M86’s library or is blocked by Google, Bing.com, Yahoo!, YouTube, Ask.com, or AOL.
If this option is used in conjunction with the X Strikes Blocking feature and a user is performing an inappropriate Google, Bing.com, Yahoo!, YouTube, Ask.com, or AOL Image search, the number of strikes that user will receive is based upon the amount of time it will take for unacceptable Google, Bing.com, Yahoo!, YouTube, Ask.com, or AOL images returned by the query to load on the page. The user receives only one strike if all inappropriate
images load within the tolerance time range of a given strike.

Fig.1

WARNING: If this option is used in conjunction with the X Strikes Blocking feature and a user is performing an inappropriate Google, Bing.com, Yahoo!, YouTube, Ask.com, or AOL Image search, the number of strikes that user will receive is based upon the amount of time it will take for unacceptable Google, Bing.com,
Yahoo!, YouTube, Ask.com, or AOL images returned by the query to load on the page. The user will receive only one strike if all inappropriate images load within the tolerance time range of a given strike.

This article was previously published as:: 8e6 KB 297461

Standard Rule file size conditions do not trigger correctly

Charles — Sun, 15 Jan 2012 23:00:57 GMT

This article applies to:

WebMarshal 6.X

Symptoms:

Created a Standard rule that includes a file size condition
The condition returns false, regardless of file size
This issue happens with only a few servers or when WebMarshal is forwarding requests through another proxy
The affected sites or other proxy support HTTP compression

Causes:

Standard rule file size conditions depend on size information provided by the remote server in response headers.
When a site or proxy uses HTTP compression, the file size might not be sent in headers because the headers are sent before compression is complete.
In this case WebMarshal returns "false" for all file size conditions.

Resolution:

To resolve this issue simply, use file size conditions only in Content Analysis rules. These rules are run after content is downloaded, and the size of the data is known.

However, this simple resolution does not allow early blocking of files by size, if the size is actually reported in the headers.

You can create a set of Standard rules to use file size information if it is available, as follows:

In Standard rules, create a rule that uses the file size condition (and any other conditions required).
Immediately below this rule, create a new rule container. The conditions for the container should include all of the rule's conditions except for the file size condition.
Create a rule inside the container. This rule should have the converse of the file size condition only (if the original condition is "less than" then this rule should have a condition "greater than"), and an action of "Skip any remaining rules in this container".
Create a second rule inside the container. This should match any request, and should have the same actions as the problematic rule (allowing, or blocking, the download).
Create a Content Analysis Rule that matches the rule in step 1.

The key to this method is the rule in step 3. When the file size is not reported, it will never match either "greater than" or "less than" a particular size.

If the file size is reported and matches the condition, the rule from step 4 is skipped and rule processing carries on as before. If the size is not reported, or is reported and does not match, the rule from step 4 is executed.

Example rules:

The following rules demonstrate the resolution described above:

Standard Rules:

Rule: Permit downloads from Trusted Download sites
When a web request is received for download
For any users
    And where the URL is a member of Trusted Download Sites
    And where the transferred data size is Less than 10240 KB
Permit access
And do not process any further standard rules
[Trusted Download Sites Size Container]
When a web request is received for download
For any users
    And where the URL is a member of Trusted Download Sites
Process rules in this container
Rule: File Size check - was any size reported?
When a web request is received
For any users
    And where addressed to any URL
    And where the transferred data size is Greater than 10240 KB
Skip any remaining rules in this container
Rule: Do not block if file size not reported
When a web request is received
For any users
    And where addressed to any URL
Permit access
And do not process any further standard rules

Content Analysis Rule:

Rule: Permit downloads from Trusted Download sites
When a web request is received for download
For any users
And where the URL is a member of Trusted Download Sites
And where the transferred data size is Less than 10240 KB
Permit access
And do not process any further content analysis rules

Best practices for custom categories

Alfred Alva — Fri, 13 Jan 2012 15:55:16 GMT

This article applies to:

R3000 Enterprise Filter, WFR,WF

Question:

Best practices for custom categories using a flat file.

Reply

Best practices for custom categories and library reloads.

Backups are mandatory
If your hard drive fails with no backup file, saved to a safe location, you will lose all your custom categories that you have added which can amount to hundreds of url's.

Some simple steps can save you hours of work.

On WF or WFR machines FTP backup's are automated for a server somewhere.
For older models go to the R3000 Gui and click on System>backup/restore>check both boxes library and configuration then click backup and after a few seconds click refresh to see file. Then save to a PC so you will have access to it in the future.

Saving CPU time on library reloads:
If you have many url's to upload to a custom category, and do not want to add one at a time?
Put together a list of url's on notepad, the format used are url's in a vertical fashion, not coma delimited.

Note:you cannot mix wild cards and regular urls on one list.

Warning: Do not leave the slash! at the end of the url that you upload, otherwise the filter will add another one making the upload useless.

You can use notepad to remove all backslashes by putting a / with the Edit>replace menu, on notepad the just leave the replace with blank and replace all.

1.Select the right custom category for the uploads

There are two buttons, in Library>Category Groups>Custom Category>your category >URLS

Look for buttons at the bottom: "upload wildcard Master" or "upload master", use nslookup only on domain names if you need ip addresses added for block lists.
Warning: This will overwrite your current list every time you upload.So keep this flat file safe somewhere.

Sample of a good format:

http://domain.com
http://anotherdomain.com
http://members.domain.com
etc................

Wildcards look like this:

*.yahoo.com

*.myspace.com

2. For single urls, Do not add a url and reload every time, just apply action for each url and reload when all have been finished.

3. If your a consortium or ISP or give subadmin rights to your customers, please send them a best practice tip not to reload
multiple times during peak hours, this process takes cpu from the filter and can cause slippage in filtering.

4.Use wild cards to cover subdomains in a domain and cover all parts of a domain.
example wild card *.yahoo.com

This article was previously published as:: 8e6 KB 300259

How do I manually force a purge of a SQL or MSDE database?

Charles — Thu, 12 Jan 2012 20:06:32 GMT

This article applies to:

MailMarshal SMTP 6.X
MailMarshal Exchange 7.X
WebMarshal
MSDE 2000
SQL Express

Question:

How do I manually force a purge of a SQL or MSDE database?
What should I do when the SQL or MSDE database has reached its maximum size limit (has grown too large)?

Symptoms:

You may notice that new messages are not displayed in the MailMarshal Console.
WebMarshal reports may not show recent data.

Causes:

The MSDE database has reached the 2GB size limit, or SQL Express has reached the 4GB size limit.

Note: You can roughly determine the size of the database by adding the sizes of the .mdf and .ldf files for the database. By default MSDE and SQL databases are found in a "Data" subfolder of C:\Program Files\Microsoft SQL Server\

Resolution:

The simplest method to resolve database size issues is to reduce the logging retention period (and for MailMarshal, if necessary, the archive retention period). You can change these settings from the MailMarshal Configurator or WebMarshal Console.

For MailMarshal, to purge records related to items in archive or quarantine folders, you MUST change the retention period for each folder.

Currently supported versions of MailMarshal and WebMarshal will efficiently purge database records that are no longer required. You should not need to purge data manually.

You may need to run a SQL "shrinkfiles" command to reduce the file sizes. See the notes at the end of this article.

If this issue continues to occur you should consider purchasing the appropriate licensed version of SQL Server. Licensed versions do not have a database size limitation.

Manual Purging:

Warning: The SQL queries directly access your database and update or delete data. If a query is performed incorrectly, it can cause irreparable harm to the database and may result in loss of data. If you are unfamiliar with SQL or how to run a SQL query, please contact M86 Technical Support directly.
Warning: Changing the records in any database table is NOT supported unless instructed to do so by M86 Technical Support.

MailMarshal SMTP 6.X, MailMarshal Exchange 7.X

Note: Purging does not remove records for archived or quarantined messages that are "younger" than the folder retention date. If you want to remove these records you MUST change the folder retention dates first. Purging does remove all message history records prior to the date you specify.

To purge a MailMarshal database from the command line in Microsoft SQL Server or MSDE, follow these steps:

Back up your database. If needed, refer to Q10221: "How do I back up my MailMarshal or WebMarshal database?"
- You can determine the database name (as well as the server name and instance name, if required) in the Configurator, Server Properties, General tab
On the database server computer, open a command prompt.

Issue the osql statement below to purge information prior to the date specified:

osql -U sa -S servername\instancename -d databasename -P password 1> exec dbo.PurgeMessages @PurgeDate = 'YYYYMMDD', @MaxRecords = 1000 2> go

Command Parameters

servername	Specifies the name of the server.
instancename	Specifies the SQL instance name. Note: The server and instance names allow you to connect to the correct SQL instance if you have more than one. For example: `Myserver\SQLEXPRESS`
databasename	Specifies the database name.
password	Specifies the sa account password.
'YYYYMMDD'	Specifies the date you want to use as a threshold. (Include the single quotes in the command syntax.) The procedure will delete records prior to this date. Note that this date format is guaranteed to be interpreted correctly regardless of locale settings.

In the command prompt window, you will receive confirmation of the number of items deleted. Using the example command above, the number of items deleted will be at most 1000 due to the @MaxRecords limit setting. You can enter a larger number, or 0 to delete all the applicable records that predate the purge date.
Warning: Setting the @MaxRecords limit to a high number (such as 1 million) or to 0, is NOT recommended where the system is live. The purge process creates delay or timeouts for other processes because it requires a lock on the data. To delete many records, run the process many times with a lower limit.
Repeat the exec dbo.PurgeMessages and go statements until you have recovered the desired space in the database, or until the process has no records remaining to purge.

WebMarshal 6.X

To purge a WebMarshal 6.X database from the command line in Microsoft SQL Server or MSDE, follow these steps:

Back up your database. If needed, refer to Q10221: "How do I back up my MailMarshal or WebMarshal database?"
- You can determine the database name (as well as the server name and instance name, if required) in the Console, Server Properties, Reporting or Database tab
On the database server computer, open a command prompt.

Issue the osql statement below to purge information prior to the date specified:

osql -U sa -S servername\instancename -d databasename -P password 1> exec dbo.PurgeLogData @PurgeDate = 'YYYYMMDD', @MaxRecords = 1000 2> go

Command Parameters

servername	Specifies the name of the server.
instancename	Specifies the SQL instance name. Note: The server and instance names allow you to connect to the correct SQL instance if you have more than one. For example: `Myserver\SQLEXPRESS`
databasename	Specifies the database name.
password	Specifies the sa account password.
'YYYYMMDD'	Specifies the date you want to use as a threshold. (Include the single quotes in the command syntax.) The procedure will delete records prior to this date. Note that this date format is guaranteed to be interpreted correctly regardless of locale settings.

In the command prompt window, you will receive confirmation of the number of items deleted. Using the example command above, the number of items deleted will be at most 1000 due to the @MaxRecords limit setting. You can enter a larger number.

Note: Setting the @MaxRecords limit to 0 will delete all the records that predate the purge date. Be aware that the query could consume significant resources and run for a long time.
Repeat the exec dbo.PurgeMessages and go statements until you have recovered the desired space in the database, or until the process has no records remaining to purge.

WebMarshal 3.X

To purge a database for WebMarshal (versions 3.5 through 3.7.5) from the command line in Microsoft SQL Server or MSDE:

Back up your database. If needed, refer to Q10221: "How do I back up my MailMarshal or WebMarshal database?"
- You can determine the database name (as well as the server name and instance name, if required) in the Console, Server Properties, Logging tab
On the database server computer, open a command prompt.

Issue the osql statement below to purge information, retaining the number of days' data specified:

osql -U sa -S servername\instancename -d databasename -P password 1> exec dbo.PurgeLogData @NumDays = 'n' 2> go

Command Parameters

servername	Specifies the name of the server.
instancename	Specifies the SQL instance name. Note: The server and instance names allow you to connect to the correct SQL instance if you have more than one. For example: `Myserver\SQLEXPRESS`
database name	Specifies the database name.
password	Specifies the sa account password.
'n'	Specifies the number of days of data you wish to keep in your database. (Include the single quotes in the command syntax.)

In the command prompt window, you will receive confirmation of the number of items deleted.

Notes:

Purging records will not generally reduce the size of data files. You may need to run a SQL "shrinkfiles" command to reduce the file size.

If a user cannot log into the database because they have forgotten their password, they may be able to purge it by logging in as an administrator onto the machine where the SQL database is located. If the SQL database has been configured to accept mixed mode authentication they may have access to purge the database by using their windows credentials.
The command is: osql -E -S servername\instancename -d databasename

Initialization error: 1740 - The endpoint is a duplicate

Charles — Wed, 11 Jan 2012 19:30:39 GMT

This article applies to:

MailMarshal SMTP
MailMarshal Exchange

Symptoms:

Restarting MailMarshal services
Starting MailMarshal services in debug mode
Error message: Initialization error. Unable to initialize RPC server
Make sure you are not already running MailMarshal Engine
1740 - The endpoint is a duplicate
This error can be raised by any MailMarshal service. The service is named in the error text

Causes:

The service you are starting or re-starting is already running.
MailMarshal services under load can take considerable time to stop, because they must complete existing transactions first.

Resolution:

Ensure that the relevant service is stopped and then try again.
The preferred action is to wait for the service to stop. You can end the service forcibly, but M86 Security does not recommend doing so as data might be lost.

How do I setup my Citrix Server in AD environment to Authenticate Users?

Alfred Alva — Wed, 11 Jan 2012 16:00:50 GMT

This article applies to:

Filters

Question:

How do I setup my Citrix Server in AD environment to Authenticate Users?

This document assumes you are using the Citrix Presentation Server 4.0 version, includes a feature known as Virtual IP addressing other wise the filter will only see one ip for all users and give the wrong profile.

Reply

Note: Please use these instructions as a general guideline where you may not need to go through each step depending on your setup and environment.

Install windows 2000/2003 server (must be installed as an application mode)
Configure the network settings, add this server to the domain (member of "XXXX workgroup" è member of "XXX domain")
Apply latest patches
Install Citrix server: MetaFrame Presentation Server 4.0
Add Citrix applications and assign server(s) and users(s). In this case, the IE browser or other browsers that you use should be added.
Enable Virtual IP on the farm's Properties page
Set ranges for virtual IP addresses for the farm
Add authenticat.exe and authenticat.cfg in c:\winnt\system32 directory. Note: An admin can use command line parameters instead of a configuration file.
Make sure authenticat.cfg has the Citrix Option NP[1=enable, 0=disable] enabled
If using new 2.x authenticat the NP[1] parameter is not needed.

======authenticat.cfg======

RA[192.168.11.109]

NP[1]

===== Command Line ======

start ""authenticat.exe RA[R3000_Virtual_IP]NP[1]

Add Virtual IP process: at minimum, iexplore.exe; authenticator.exe
Manually modify uselogon.cmd in c:\winnt\system32 directory, which to start up the authenticator for each Citrix session. Note: the sample below is using the command line parameters and assuming that the virtual IP is 192.168.11.109.

======uselogon.cmd======

If "%SESSIONNAME%" == "Console" GOTO CONSOLE

start authenticat.exe RA[192.168.11.109]NP[1]

:CONSOLE

This article was previously published as:: 8e6 KB 280290

Mobile Client blocks Java applications

Giovanni Romualdi — Fri, 06 Jan 2012 22:03:31 GMT

This article applies to:

Mobile Client 3.x

Question:

Why is my mobile client blocking all Java applications?

Information:

The mobile client currently has a feature that will block all Java applications if the user's profile is set to block the Instant Messaging category or the Peer-to-peer category. This was implemented in order to help block various Java-based utilities that facilitate IM and P2P-type traffic. If this is undesired, one can either Pass/Allow these categories, or set up a bypass for the Java executable in the Application Options portion of the mobile client configuration. Further information on creating application bypasses can be found in article 14127.

M86 Security Knowledge Base

SendSecure email retention period

This article applies to:

Question:

Response:

Email messages sent between SPE customers are rejected

This article applies to:

Question:

Information:

Resolution

Library failing to update

This article applies to:

Question:

Reply

Create override account on filter

This article applies to:

Question:

Reply

How do I troubleshoot pattern over-blocking issues?

This article applies to:

Question:

Reply

Why is facebook.com or twitter.com accessible when using HTTPS?

This article applies to:

Question:

Information:

Detection of password-protected 7-zip archives

This article applies to:

Symptoms:

Information:

Workarounds:

Notes:

What is the Quota Feature?

This article applies to:

Question:

Reply

Does the Google Chrome browser work with 8e6 Technologies products?

This article applies to:

Question:

Reply

Can I create sub-admins for LDAP groups?

This article applies to:

Question:

Reply

The CMC Management status is empty.

This article applies to:

Question:

Reply:

Supported Operating Systems and Prerequisite Versions

This article applies to:

Question:

Information:

Key:

Operating Systems and Prerequisites

Server Operating Systems

Workstation Operating Systems(for server installation)

Prerequisites

SQL Server Versions

ISA Server Versions (WebMarshal)

What are the Release Notes for MailMarshal SPE 3.1?

This article applies to:

Question:

Information:

MailMarshal SMTP Version

Sending Delay Notifications to External Addresses

This article applies to:

Question:

Procedure:

Notes:

What versions of Marshal Security products are currently supported by M86 Technical Support?

This article applies to:

Question:

Information:

Prerequisites and Supported Operating Systems

MailMarshal SMTP (including MailMarshal Secure)

MailMarshal Exchange

MailMarshal SPE

MailMarshal Secure Email Server (SES)

e10000 (MailMarshal Node Appliance)

Marshal Reporting Console

Workstation Operating Systems
(for server installation)