Hi guys, i need to understand better what's happen when one mail is sent from internal user to other one in the same site and same mailboxserver. Scenario: -2 CCR mailbox server(active\passive) -2 CAS\HUB servers (roles are in the same server) I read this post: http://social.technet.microsoft.com/Forums/en/exchangesvrgeneral/thread/e55b154c-319e-416f-8f67-fcf3215205a6 but i want understand if: 1-one user send mail from outlook with attachment to other one(in the same site and same mailboxserver). 2-one user send mail from owa with attachment to other one(in the same site and same mailboxserver). The file is filtered by forefront installed on hub transport? Thx to all. By Maw

Hi All mail will go through the hub transport even if it is between mailboxes on the same server/database. FPE attachment filtering does not run on Hub Transport servers, this is only available on Edge servers: http://technet.microsoft.com/en-us/library/bb201691(v=exchg.80).aspx Steve

Hi Steve, i don't have the edge servers and the forefront are installed on cas\hub servers. Thx

Forefront can be installed on either HT or Mailbox. However to answer your question. 1. User sends email goes to outbox, HT picks up the email will scan it for AV and deliver to back to the store 2. User connects directly to store goes to outbox and HT picks up exact same. Now the AV scanning is different depending on whether you have Forefront installed on a mailbox role vs. HT. If installed on a MB role it is canned during access. An access is either opening a message, viewing a message in the preview pane and some Exchange indexing functions. These actions will trigger an On-Access VSAPI scan, in which Exchange hands the message to Forefront. It will not get scanned when it is sent since it expects the HT will typically scan (if AV is installed)James Chong MCITP | EA | EMA; MCSE | M+, S+ Security+, Project+, ITIL msexchangetips.blogspot.com

Hi Jame, forefront are installed on either CAS\HUB servers, on mailbox servers Forefront is not installed. It's no very clear for me, in my case the local mail, form outlook or from owa(internat, external published from ISA) the mail are not scanned? Thx

hi, >>>The file is filtered by forefront installed on hub transport? Just a simple test, disable the forefront and test again. If it can work, it seems that your FPE filtering filter the attachment. hope can help you thanks,CastinLu TechNet Community Support

Yes ALL local email will get scanned by your Hub Transport server doesnt matter same server using outlook or OWA. Are you experiencing a particular issue or you're just wondering?James Chong MCITP | EA | EMA; MCSE | M+, S+ Security+, Project+, ITIL msexchangetips.blogspot.com