LevelBlue Knowledge Base » Knowledgebase » Email Content Manager

Latest versions of Unpacker and Filetype for MailMarshal (SEG) and ECM

Charles — Tue, 24 Feb 2026 21:13:18 GMT

This article applies to:

MailMarshal (SEG) 7.X and above
MailMarshal ECM/MailMarshal Exchange 7.X

Question:

What is the version of the Unpacker and File Type DLLs for my version of SEG or ECM?
Is the Unpacker and File Type on my installation up to date?

Information:

LevelBlue provides updates to File Type identification and the Unpacker functionality with each product release.

LevelBlue can also provide updates through the automatic update function (SpamCensor updater) for File Type, Unpacker, and additional unpacking executables such as 7zip.

This article lists the most recent version of the Unpacker and File Type. The date listed (if any) is the date of the current update released through the automatic updater.

You can determine the version present in your installation by viewing the Properties > Details tab for each file. Files that can be automatically updated are found on the Array Manager, in the Config subfolder of the SEG installation.

Latest File Versions

Notes:

From May 2024, Unpacker and File Type releases are combined.
Available Release Notes for each release are linked in the tables below.
Updates are no longer published for SEG versions 8.2.6 and below, or for MailMarshal 10.0.0 through 10.0.6 Product support for these releases has ended.

MailMarshal (SEG) Supported Versions

Product Version File Type and Unpacker Version

10.0.7 through 11.3.0

2025.04.03
(Filetype DLL version 2025.04.02)
February 24, 2026

Product Version	File Type and Unpacker Version
10.0.7 through 11.3.0	2025.04.03 (Filetype DLL version 2025.04.02) February 24, 2026

MailMarshal (SEG) Older Versions

Product Version File Type and Unpacker Version

8.3.2

2025.02.01
July 7, 2025

8.2.6
10.0.4 through 10.0.6

2024.04.01
December 5, 2024

10.0.3

2024.02.01
May 7, 2024

Product Version	File Type and Unpacker Version
8.3.2	2025.02.01 July 7, 2025
8.2.6 10.0.4 through 10.0.6	2024.04.01 December 5, 2024
10.0.3	2024.02.01 May 7, 2024

Product Version Unpacker Version File Type Version

8.2.0 through 8.2.4
10.0.0 through 10.0.2

2023.03.01
September 26, 2023 2023.03.01
September 26, 2023

8.1.0 through 8.1.3 8.1.11
October 4, 2021 8.1.6
October 4, 2021

8.0.1 through 8.0.7 8.0.10.556
October 20, 2020 8.0.6
October 6, 2020

8.0.0
8.0.0
July 18, 2017 8.0.0
July 18, 2017

7.5.8
7.5.7
7.5.6
7.5.5 2.5.5
February 26, 2019 7.14.6
January 24, 2019

7.5.1 2.5.2
December 5, 2017 7.14.4
March 6, 2018

7.5.0 2.3.3
December 1, 2015 7.13.2

7.3.6 2.5.2
December 5, 2017 7.14.4
March 6, 2018

7.3.5 2.5.1
October 4, 2017 7.14.0.317
July 20, 2017

7.3.0 2.1.5
May 3, 2015

7.2.3 2.0.8
February 17, 2015

7.2.2 2.0.3
May 16, 2015

7.2.1
7.2.0 2.0.3
January 8, 2014

7.1.2 1.0.0
December 8, 2014

Product Version	Unpacker Version	File Type Version
8.2.0 through 8.2.4 10.0.0 through 10.0.2	2023.03.01 September 26, 2023	2023.03.01 September 26, 2023
8.1.0 through 8.1.3	8.1.11 October 4, 2021	8.1.6 October 4, 2021
8.0.1 through 8.0.7	8.0.10.556 October 20, 2020	8.0.6 October 6, 2020
8.0.0	8.0.0 July 18, 2017	8.0.0 July 18, 2017
7.5.8 7.5.7 7.5.6 7.5.5	2.5.5 February 26, 2019	7.14.6 January 24, 2019
7.5.1	2.5.2 December 5, 2017	7.14.4 March 6, 2018
7.5.0	2.3.3 December 1, 2015	7.13.2
7.3.6	2.5.2 December 5, 2017	7.14.4 March 6, 2018
7.3.5	2.5.1 October 4, 2017	7.14.0.317 July 20, 2017
7.3.0	2.1.5 May 3, 2015
7.2.3	2.0.8 February 17, 2015
7.2.2	2.0.3 May 16, 2015
7.2.1 7.2.0	2.0.3 January 8, 2014
7.1.2	1.0.0 December 8, 2014

ECM

Product Version Unpacker Version

7.2.0
7.1.7
7.1.6
7.1.5 1.0.5
February 28, 2019

Product Version	Unpacker Version
7.2.0 7.1.7 7.1.6 7.1.5	1.0.5 February 28, 2019

What versions of MailMarshal (SEG), ECM, and SES are currently supported by LevelBlue Technical Support?

Charles Creegan — Tue, 02 Dec 2025 00:47:16 GMT

This article applies to:

MailMarshal (SEG)
MailMarshal ECM/MailMarshal Exchange
MailMarshal Secure Email Server/MailMarshal SES

Question:

What versions of MailMarshal (SEG) are currently supported by LevelBlue Technical Support?
What versions of MailMarshal ECM/MailMarshal Exchange are currently supported by LevelBlue Technical Support?
What versions of MailMarshal Secure Email Server are currently supported by LevelBlue Technical Support?

Information:

Important: End of Support and End of Threat Protection dates for many earlier versions have now passed.

The following tables show the currently supported versions, planned dates of termination of support, and support end dates for discontinued versions.

Note: In this article "supported" refers to full product support as defined in LevelBlue support policy for the Marshal Product Line.

For versions that have passed the end of support, LevelBlue can often provide advice to help customers resolve issues. However, LevelBlue may recommend upgrade to a later version of the software.

Versions out of support do not receive component updates such as file type and unpacking updates.

If a reported problem requires remedial development work, LevelBlue will usually provide a fix only for the latest product version.

Upgrades to the current versions of these products are always free of charge to customers with a current maintenance contract.

Automatic updates to LevelBlue threat protection technologies for SEG (such as SpamCensor, Known Threats, YAE scripts) may be provided to some versions that are out of support. The table below lists this date separately.

All versions earlier than those listed are out of support and do not receive threat protection updates.

This includes MailMarshal 8.0.X and 8.1.X.

MailMarshal (SEG)

Software Version

Release Date
Support Status
End of Support

End of Threat
Protection Updates

11.3.0.7659 December 2, 2025 Active

11.2.0.7413 September 4, 2025 Active

11.1.0.6958 May 29, 2025 Active

10.2.5.7024 June 5, 2025 Active

10.2.5.6043 September 10. 2024 Active

10.2.0.5718 July 2, 2024 Active   June 1, 2026   June 1, 2026

10.1.0.5102 April 3, 2024 Active   June 1, 2026   June 1, 2026

10.1.0.5089 March 28, 2024 Withdrawn April 3, 2024

10.0.7.3979 September 29, 2023 Active June 1, 2026   June 1, 2026

10.0.7.3969

September 12, 2023

Withdrawn

September 29, 2023

10.0.6.3739

February 28, 2023
Discontinued February 1, 2025 June 1, 2025

10.0.5.3470

August 31, 2022
Discontinued February 1, 2025 June 1, 2025

10.0.4.3361

May 16, 2022
Discontinued February 1, 2025 June 1, 2025

10.0.3.2387

July 6, 2021
Discontinued
February 1, 2024
December 31, 2024

10.0.2.2230

April 28, 2021

Deprecated

July 6, 2021
December 31, 2024

10.0.1.2030

November 3, 2020
Discontinued
September 1, 2022
December 31, 2024

10.0.0.1428

April 14, 2020

Deprecated

November 3, 2020
December 31, 2024

8.3.2.11492 September 29, 2023 Active August 1, 2025 December 31, 2025

8.2.6.11305

December 22, 2020
Discontinued February 1, 2025 June 1, 2025

8.2.4.11170

October 31, 2019
Discontinued
March 31, 2022
December 31, 2024

8.2.3.11111

July 2, 2019
Discontinued
March 31, 2021
December 31, 2024

8.2.2.11949

February 14, 2019
Discontinued
March 31, 2021
December 31, 2024

8.2.1.11863

December 14, 2018
Discontinued
March 31, 2021
December 31, 2024

8.2.0.11849

December 6, 2018

Withdrawn

December 14, 2018
December 31, 2024

MailMarshal ECM (formerly MailMarshal Exchange)

Software Version

Release Date
Support Status
Discontinued Date

7.2.0.9773

March 7, 2017

Active

7.1.7.7380

January 12, 2015
Discontinued
February 1, 2019

MailMarshal Secure Email Server (SES)

Software Version

Release Date
Support Status
Discontinued Date

5.8.1.398

July 24, 2017
By special arrangement only

5.8.0.361

May 30, 2016
By special arrangement only

5.7.2.9723

May 1, 2013

December 31, 2012

Notes:

For information about virus scanner plug-ins and reporting, see the Related Articles below.

What file types are recognized by MailMarshal (SEG) and ECM?

Charles — Wed, 15 Oct 2025 21:35:34 GMT

This article applies to:

MailMarshal (SEG) current versions
MailMarshal ECM/MailMarshal Exchange 5.2 and above

Question:

What file types are recognized by MailMarshal (SEG)?
What file types are recognized by MailMarshal ECM 5.2 and above?

Information:

The following formats are recognized by current MailMarshal (SEG) and ECM versions.

Notes:

Some types are recognized only with current product versions, as noted. Items marked "Current SEG" were added before 2023. These items are not recognized by ECM.
Additional types are recognized with specific updates to the File Type DLL. For information about the File Type update for each MailMarshal version, see article Q20446.
- File Type updates are distributed through the MailMarshal Automatic Updates to installations with current maintenance.
Items recognized with a specific MailMarshal/SEG or FileType update are not recognized in MailMarshal Exchange/ECM.

In the tables below, Type Name refers to the name seen in the Engine log and rule listings. Description is the name as seen when selecting types in the email policy editor.

The Type Name is often the same as the usual file extension. However, file type detection is based on file structure and NOT on the file extension. If you rename a zip archive as ".TXT", it is still recognized as a zip archive by MailMarshal.

Type Name	Description
7Z	7Zip Archive
7Zcrypt	7Zip encrypted archive (Current SEG)
7Zsfx	7Zip self extracting archive
ACE	ACE archive
ACEsfx	ACE self extracting archive
IWA	Apple iWork Archive .IWA (Current SEG)
ARC	ARC archive
ARJ	ARJ archive
ARJcrypt	ARJ encrypted archive
ARJsfxcrypt	ARJ encrypted self extracting archive
ARJsfx	ARJ self extracting archive
B64	Base64 (MIME) Encoding
B2A	BtoA Encoding
BZ2	bZIP2 archive
CABI	InstallShield CAB Archive
CPIO	CPIO archive
DEB	Debian Binary Package file (Current SEG)
GZ	GZIP archive
HQX	HQX (BinHex) archive
CABI	InstallShield CAB Archive
CDISO	ISO 9660 CD Filesystem
LYMESFX	LYME self extracting archive (Current SEG)
LZH	LZH archive
MacBIN	MacBinary I, II, or III archive
MDXMedia	MDX Extended Media Descriptor File (Current SEG)
CABM	Microsoft CAB/Expand Archive
SZDD	Microsoft SZDD archive
MAR	Mozilla Archive
MSI	MSI Windows Installer package
MSIX	MSIX Windows Installer Package (Current SEG)
PBIX	Power BI Report (FileType 2024-02-01 and above)
RAR	RAR archive
RARcrypt	RAR encrypted archive
RARsfxcrypt	RAR encrypted self extracting archive
RARsfx	RAR self extracting archive
RARSpan	RAR spanned archive
RPM	Redhat Package Manager file (Current SEG)
SEAEncrypt	SEA encrypted self extracting archive
SEA	SEA self extracting archive
SIT	SIT archive
SITEncrypt	SIT encrypted archive
TAR	TAR archive
UDF	Universal Disk Format (UDF) (Current SEG)
UUE	UUencoded Encoding
XZ	XZ archive (Current SEG)
Z	Z (compress) archive
ZIP	ZIP archive
ZIPcrypt	ZIP encrypted archive
ZIPsfxcrypt	ZIP encrypted self extracting archive
ZIPsfx	ZIP self extracting archive
ZOO	ZOO archive
ZST	Zstd archive (FileType 2025-03-01 and above)

Azure IRM Protected Documents

New category and new items in MailMarshal/SEG 8.2.

Type Name	Description
RPMSGPLAIN	Decrypted restricted-permission message
XLSXIRM	Excel 2007+ document with IRM
XLSIRM	Excel document with IRM
PFILE	File protected with IRM
OREIRM	OLE compound document with IRM
XLSIRMcrypt	Password protected Excel with IRM
PPSIRMcrypt	Password protected Powerpoint show with IRM
PPTIRMcrypt	Password protected Powerpoint with IRM
WordIRMcrypt	Password protected Word with IRM
PPTXIRM	Powerpoint 2007+ document with IRM
PPTIRM	Powerpoint document with IRM
PPSIRM	Powerpoint show with IRM
RPMSG	Restricted-permission message
DOCIRM	Word 2007+ doc with IRM in Word 2003 mode
DOCXIRM	Word 2007+ document with IRM

Document

Type Name	Description
MDB	Access database
MDW	Access system database
INDD	Adobe InDesign Document (Current SEG)
MSO	Document data
DVI	DVI TeX document
XLScrypt	Encrypted Excel document (Current SEG)
PPTcrypt	Encrypted PowerPoint Document (Current SEG)
PPScrypt	Encrypted PowerPoint Show (Current SEG)
DOCcrypt	Encrypted Word document
XLSB	Excel 2007+ Binary Document Includes later versions; see note below.
XLSX	Excel 2007+ document
XLSXIRM	Excel 2007+ document with IRM (Current SEG)
XLS	Excel document
XLSIRM	Excel document with IRM (Current SEG)
NFO	Folio Infobase
FM3	Lotus 123 FM3 sheet form
WK1	Lotus 123 WK1 sheet
WK3	Lotus 123 WK3 sheet
WK4	Lotus 123 WK4
SAM	Lotus AmiPro document
LWP	Lotus WordPro document
MCW	Mac Word document
ACCDB	Microsoft Access Database .ACCDB (Current SEG)
ONE	Microsoft OneNote (Current SEG)
VSDX	Microsoft Visio 2013 Drawing
DOCXML	Microsoft Word 2003 XML Document
OfficeMacroScript	Office Macro Script
Office2007Macro	Office 2007+ Macro Includes later versions; see note below.
OLE	OLE compound document
OREIRM	OLE compound document with IRM
ODC	Open Office chart file
OTC	Open Office chart template
ODB	Open Office database file
ODT	Open Office document file
OTT	Open Office document template
ODF	Open Office formulae file
OOoOTF	Open Office formulae template
ODM	Open Office global text document
OTH	Open Office global text template
ODG	Open Office graphics file
OTG	Open Office graphics template
ODI	Open Office image file
OTI	Open Office image template
ODP	Open Office presentation file
OTP	Open Office presentation template
ODS	Open Office spreadsheet file
OTS	Open Office spreadsheet template
OpenXML	OpenXML Document (Current SEG)
PM6	PageMaker document
XLSIRMcrypt	Password protected Excel with IRM (Current SEG)
PPSIRMcrypt	Password protected Powerpoint Show with IRM (Current SEG)
PPTIRMcrypt	Password protected Powerpoint with IRM (Current SEG)
WordIRMcrypt	Password protected Word with IRM (Current SEG)
PDF	PDF document
PDFXFAForm	PDF document - Dynamic XFA form (Current SEG)
PDFcrypt	PDF document - Encrypted
PDFInvalid	PDF document - Invalid header record (Current SEG; see Q16666)
PDFprotect	PDF document - Protected
PDFInvalidFormat	PDF Un-recognized file format
PS	PostScript document
PPTX	PowerPoint 2007+ document Includes later versions; see note below.
PPTXIRM	PowerPoint 2007+ document with IRM (Current SEG)
PPTIRM	PowerPoint document with IRM (Current SEG)
PPSX	PowerPoint 2007+ show
PPT	PowerPoint document
PPS	PowerPoint show
PPSIRM	PowerPoint show with IRM (Current SEG)
PRJ	Project document
PUB	Publisher document
QXD	Quark Express document
RTF	Rich Text document
Word2	Word 2 Document
DOCIRM	Word 2007+ doc with IRM in Word 2003 mode
DOCX	Word 2007+ Document Includes later versions; see note below.
DOCXIRM	Word 2007+ document with IRM (Current SEG)
DOC6	Word 6 Document
DOC	Word document
WPD	WordPerfect document
WPS	Works for Windows document
WRI	Write document
XPS	XPS Document (Current SEG)

Drawing

Type Name	Description
AI	Adobe Illustrator drawing
DWG	AutoCAD Drawing
DWF	AutoCAD Format
CTB	AutoCAD Plotting Support .CTB (Current SEG)
CMX	Corel Binary Meta file
CDR	Corel Draw Drawing
DXF	Drawing Interchange File DXF
FP3	FloorPlan Plus 3D
FH	Freehand drawing
VSDX	Microsoft Visio 2013 Drawing .VSDX (Current SEG - see note)
VXD	Microsoft Visio Drawing
NWD	Navisworks Document .NWD (Current SEG)
Solidworks	Solidworks CAD files (.SPDPRT, .SLDASM, .SLDDRW, .SLDDRT) (Current SEG)
STL	StereoLithography Drawing (Current SEG)

Encrypted

Type Name	Description
7Zcrypt	7Zip encrypted archive (Current SEG)
ARJcrypt	ARJ encrypted archive
ARJsfxcrypt	ARJ encrypted self extracting archive
AXCRYPT	AXCrypt Encrypted Data (Current SEG)
Switch	Egress Switch Encrypted Mail (Current SEG)
XLScrypt	Encrypted Excel document (Current SEG)
PPTcrypt	Encrypted PowerPoint Document (Current SEG)
PPScrypt	Encrypted PowerPoint Show (Current SEG)
DOCcrypt	Encrypted Word Document
XLSXIRM	Excel 2007+ document with IRM (Current SEG)
XLSIRM	Excel document with IRM (Current SEG)
PFILE	File protected with IRM
GPG	Gnu Privacy Guard file .GPG (Current SEG)
OREIRM	OLE compound document with IRM
XLSIRMcrypt	Password protected Excel with IRM (Current SEG)
PPSIRMcrypt	Password protected Powerpoint show with IRM (Current SEG)
PPTIRMcrypt	Password protected Powerpoint with IRM (Current SEG)
WordIRMcrypt	Password protected Word with IRM (Current SEG1)
PDFcrypt	PDF document - encrypted
PENC	Perl Encoded file .ENC (Current SEG)
PGP	PGP Encrypted Data
PPTXIRM	Powerpoint 2007+ document with IRM (Current SEG)
PPTIRM	Powerpoint document with IRM (Current SEG)
RARcrypt	RAR encrypted archive
RARsfxcrypt	RAR encrypted self extracting archive
RPMSG	Restricted-permission message
SEAEncrypt	SEA encrypted self extracting archive
SITEncrypt	SIT encrypted archive
P7M	SMime Encrypted Data
DOCIRM	Word 2007+ document with IRM in Word 2003 mode
DOCXIRM	Word 2007+ document with IRM (Current SEG)
ZIPcrypt	ZIP encrypted archive
ZIPsfxcrypt	ZIP encrypted self extracting archive
ZIX	ZixCorp encrypted mail (Current SEG)

Executable

Type Name	Description
7Zsfx	7Zip self extracting archive
ACEsfx	ACE self extracting archive
ARJsfxcrypt	ARJ encrypted self extracting archive
ARJsfx	ARJ self extracting archive
CLASS	Java class file
APPL	Macintosh M68k executable
PEF	Macintosh PPC executable
CABM	Microsoft CAB/Expand Archive
COM	MSDOS Com executable
EXE	MS-DOS Executable
MSI	MSI Windows Installer Package
MSIX	MSIX Windows Installer Package (Current SEG)
NLM	NetWare Loadable Module
EXEO16	OS/2 16bit executable
DLLO32	OS/2 32bit DLL
EXEO32	OS/2 32bit Executable
PYC	Python bytecode file (Current SEG)
RARsfxcrypt	RAR encrypted self extracting archive
RARsfx	RAR self extracting archive
SEAEncrypt	SEA encrypted self extracting archive
SEA	SEA self extracting archive
CIF	UNIX CIF Executable
COFF	UNIX COFF Executable
ELF	UNIX ELF Executable
DLLW16	Win16 DLL
EXEW16	Win16 executable
DLLO16	Win16 VXD or OS/2 DLL
DLLW32	Win32 DLL
EXE32W	Win32 executable
ZIPsfxcrypt	ZIP encrypted self extracting archive
ZIPsfx	ZIP self extracting archive

Font

Type Name	Description
EOT	Embedded OpenType Font (Current SEG)
OTF	OpenType Font
TTF	True Type Font
AFM	Type 1 Adobe Font Metric
PFB	Type 1 Printer Font Binary
PFM	Type 1 Printer Font Metric
WOFF	Web Open Font Format (Current SEG)
FON	Windows Bitmap font
ODTTF	XPS Embedded font (ODTTF) (Current SEG)

Image

Type Name	Description
PSD	Adobe Photoshop Image
BMP	Bitmap image
CPT	Corel Photo-Draw Image
EPS	Encapsulated PostScript
EMF	Enhanced MetaFile Image
GIF	Gif image
HEIC	HEIF image (Current SEG)
ICO	Icon
JPG	Jpeg image
JBIG2	JBIG2 image (Current SEG)
JPEG2000	Jpeg2000 image
CIL	Microsoft ClipArt Gallery
MDI	Microsoft Document Image
MIX	Microsoft PhotoDraw Image
PSP	Paint Shop Pro image
PNG	Portable Network Graphics (PNG)
SVG	Scalable Vector Graphics (Current SEG)
TIF	Tiff image
WEBP	WebP Image File (Current SEG)
HDPHOTO	Windows HD Photo (Current SEG)
WMF	Windows MetaFile Image
PCX	Zsoft PCX Image

Mail Components

Type Name	Description
MBODY	Mail Body
MHDR	Mail Headers
MAIL	Mail message
TNEF	TNEF Exchange Mail Message
HTMLBody	TNEF Exchange Mail Message extracted HTML Mail Body
RTFBody	TNEF Exchange Mail Message extracted RTF Mail Body

Other

Type Name	Description
BPlist	Apple Binary Plist
AppleDouble	AppleDouble header
AppleSingle	AppleSingle formatted file
BIN	Binary Unknown (indicates a file of unrecognized type)
TORRENT	Bittorent .torrent metainfo file
ICS	Calendar Meeting Invitation (iCalendar) (Current SEG)
ICSDescription	Calendar Meeting Invitation Description (Current SEG)
ICSSummary	Calendar Meeting Invitation Summary (Current SEG)
TPS	Clarion TopSpeed File .TPS (Current SEG)
CHM	Compiled HTML Help file
DBF	dBase/xbase Data File .DBF (Current SEG)
DBT	dBase Memo Field File (Current SEG)
MDXdbase	dBase Multiple Index File (Current SEG)
SYS	DOS device driver (Current SEG)
VCF	Electronic Business Card .VCF (Current SEG)
ICM	Independent Color Matching .ICM (Current SEG)
InfoSlip	Infoslips document (Current SEG)
JOS	Java Object Serialized Data (Current SEG)
DSStore	Mac OSX Finder Info (Current SEG)
MAPIBlock	MAPI Encoded data
OST	MAPI Off-line Store
PAB	MAPI Personal Address Book
PST	MAPI Personal Store
MAT	MATLAB Data File (Current SEG)
PDB	Microsoft Debugging Symbols (Current SEG)
LIB	Microsoft Program Library (Current SEG)
MSBLDCACHE	MS Build Cache File (Current SEG)
RCM	MTXWIN95 Registry Command File
OracleRDF	Oracle Report Definition File (Current SEG)
Appointment	Outlook Appointment
Contact	Outlook Contact
MSG	Outlook message
Note	Outlook Note
Task	Outlook Task
P12	PKCS#12 Certificate Archive (FileType 2023-03-01 and above)
PCAP	Packet Capture (Current SEG)
PCAPNG	Packet Capture NG (Current SEG)
PEMCert	PEM encoded certificate .PEM (Current SEG - see note)
PFX	PFX Certificate Archive (Current SEG)
PGPPublicKey	PGP Public Key (Current SEG)
PGPSigned	PGP Signed Data
PBIXMashup	Power BI Data Mashup Archive (Current SEG)
PBIXMetadata	Power BI Data Metadata (Current SEG)
PBIXModel	Power BI Data Model (Current SEG)
PBIXBindings	Power BI Security Bindings (Current SEG)
PBIXSettings	Power BI Settings (FileType 2024-02-01 and above)
QBB	QuickBooks Backup .QBB (Current SEG)
QBW	QuickBooks Company file .QBW (Current SEG)
RTF Object	RTF Object
SHP	Shape file (.SHP) (Current SEG)
SHX	Shape Index file (.SHX) (Current SEG)
P7S	SMime Signed Data
SQLiteDB	SQLite Database (Current SEG)
EMC	Striata Encrypted Mail Communication (Current SEG)
TEXT	Text
VHD	Virtual Hard Disk Image .VHD (Current SEG)
VSSSCC	Visual Source Safe Source Code Control (Current SEG)
HLP	Windows Help file
MST	Windows Installer Setup Transform .MST (Current SEG)
URL	Windows Internet shortcut
EVT	Windows NT event log
REG	Windows Registry Data
WSF	Windows Script File .WSF (Current SEG)
LNK	Windows shortcut
EVTX	Windows Vista event log .EVTX (Current SEG)
XML	XML Document (Current SEG)

Sound

Type Name	Description
AAC	AAC audio
FLSA	Adobe Flash Audio (Current SEG)
AU	AU sound file
ENC	Encore Music Notation .ENC (Current SEG)
ASX	Microsoft Active Streaming link
MID	MIDI sound file
MP3	MP3 sound file
OGA	OGG stream for audio
RAM	Real Audio Link
RA	Real Audio sound file
RMP	Real Jukebox Metadata Package
Real	RealPlayer audio/video
WAV	WAV sound file
ASF	Windows Active Streaming Format

Video

Type Name	Description
3GPP	3GPP Video (Current SEG)
FLSV	Adobe Flash Video (Current SEG)
FLC	Animator Pro FLC file
FLI	Animator Pro FLI file
AVI	AVI video
DVM	DVM video
ASX	Microsoft Active Streaming link
MOV	Mov video
MPG	Mpeg video
OGV	OGG stream for video
Real	RealPlayer audio/video
SWF	Shockwave Flash
FLV	Shockwave Flash video
WEBM	WebM Video File (Current SEG)
ASF	Windows Active Streaming Format

Web Browsing

Type Name	Description
CSS	Cascading style sheet
CRL	Certificate Revocation List (CRL)
GIF	GIF Image
Goog	Google Safe Browsing Update
HTML	HTML Document
ICO	Icon
CLASS	Java class file
JS	JavaScript file
JPG	JPEG image
OCSPResponse	OCSP Response File
PNG	PNG image
SWF	Shockwave Flash
VBS	VBScript file (Current SEG)
FORMBIN	Web Page binary form data
FORMTEXT	Web page text form data
WEBM	WebM Video File (Current SEG)
WEBP	WebP Image File (Current SEG)

Non-Selectable Types

The following types cannot be selected in rules. They are used internally by MailMarshal and will be shown in logs as appropriate.

Type Name	Description
BIFF12	Binary File Format for Office 12
CHMBINOBJ	CHM Binary Object
ODTCache	Open Document Text Layout-cache
OLEStream	OLE Raw Stream
PDFStream	PDF Raw Stream
ZIPBig	Zip with massively redundant data

Notes:

Word, Excel, and PowerPoint "2007" or "2007+" file type is the default format used by all later versions (including Office 2010, 2013, and 2016). All documents saved in this format are recognized, regardless of the Office software version.
LevelBlue Knowledgebase articles for information about earlier versions have been withdrawn.

This article was previously published as:: NETIQKB40962

Excluding some users from digest notifications

Charles — Tue, 14 Oct 2025 00:42:20 GMT

This article applies to:

MailMarshal (SEG)
MailMarshal ECM/MailMarshal Exchange 7.X

Question:

How do you exclude addresses or users from digest notifications?

Procedure:

You can stop digest notifications for some users or email addresses, for each folder that is included in a MailMarshal digest.

In the Configurator or Management Console, expand Policy Elements.
In User Groups, create a new MailMarshal User Group with a descriptive name such as Exclude from Digest.
- Add to this group any email addresses that you don’t want to get the digest notification.
In Message Digests, view the properties of a specific digest.
1. Select the folders tab.
2. Select a particular folder and click Edit User Groups.
3. In the list of available groups, select the User Group created in the previous step and add it to the Excluded user groups list.
  - Note: If the Included user groups list is blank, the digest is sent to all users except the users in excluded groups.
4. Save the digest properties.
Commit configuration.

Any email address added to the group will not receive notifications. You can manage exclusions separately for each folder in each digest.

Note:

The advanced properties of a digest, such as the group functions, are not configurable when the digest is first created. These features are available when editing an existing digest.

SQM or Customer Console "Remember Me" not working

Charles — Tue, 14 Oct 2025 00:32:28 GMT

This article applies to:

MailMarshal (SEG)
MailMarshal ECM/MailMarshal Exchange 7.X

Spam/Quarantine Management website

MailMarshal SPE Customer Console and SQM (4.2 and below)
Forms authentication
This article does not apply to the MailMarshal Management Console (10.X and above) or SPE 4.3.5 and above

Symptoms:

Remember Me is selected on the site login page
User credentials are only remembered for a short time of inactivity. Users are asked to enter credentials after about 20 minutes.
With SPE, the "Default Session Timeout" setting in the Admin Console cannot be used to extend the Customer Console timeout to more than 20 minutes.

Causes:

The Remember Me function uses ASP.NET authentication cookies. By default the cookies time out after 20 or 30 minutes, depending on the version of ASP.NET originally installed.
LevelBlue recommends you maintain the default timeout for security reasons.

Resolution:

To extend the timeout, change the forms authentication configuration settings for the affected web sites or virtual directories.

Notes:

If you have more than one SQM web server or SPE Customer Console server, you must perform these steps on each web server.
For SPE, you must configure the SQM virtual directory as well as the Customer Console site. The site setting is not inherited by the SQM directory/application.

On the web server, open IIS Manager.
Navigate to the properties of the virtual directory or website you want to configure.
- For SEG SQM, by default, this is Default Web Site/SpamConsole
- For ECM quarantine management, by default, this is MailMarshal Exchange Web Components/QuarantineConsole
- For SPE Customer Console, by default, this is the website Customer Console
- For SPE SQM, by default, this is Customer Console/SQM
In the IIS section, double-click Authentication.
On the Authentication page, select Forms Authentication and then click Edit (from the right pane Actions list).
On the Forms Authentication Settings window, set the authentication cookie time-out to a longer value (in minutes). Ensure that Extend cookie expiration is checked.
Click OK.
When you have changed all required settings, exit IIS manager.
For SPE, remember to change the "Default Session Timeout" setting in the Admin Console.

Notes:

This problem does not affect Windows authentication.

Why are message digests incorrectly being delivered to external addresses?

Charles — Tue, 14 Oct 2025 00:22:13 GMT

This article applies to:

MailMarshal (SEG)
MailMarshal ECM/MailMarshal Exchange 7.X

Question:

Why are message digests for spam being delivered to external addresses?

Information:

This problem can occurs when MailMarshal or ECM folders and rules are not correctly configured.

By default, digests are sent to the message recipient (unless you specify "send all digests to a single recipient"). If a folder contains both "inbound" and "outbound" messages (both messages with internal recipients, and messages with external recipients), then some digests could be sent to external addresses.

Curent versions of MailMarshal allow you to configure digests of outgoing mail, sent to the internal sender.

Procedure:

To ensure that message digests are only sent to internal email addresses, ensure that any folders that will be digested for the recipients contain only incoming messages. Rules that quarantine outbound messages should use other folders.

If you want to notify internal senders about blocked outgoing email, use a "notification message" rule action.

Self-Management option:

You can include folders with outbound messages in the folders visible through the Spam Quarantine Management website. For each folder that you want to include, edit the folder properties and choose "Enable end-user management for this folder."

For rules that apply to incoming messages, always use a folder that has the setting Folder is used to manage messages addressed to a user (or inbound messages).
For rules that apply to outgoing messages, always use a folder that has the setting Folder is used to manage messages addressed from a user (or outbound messages).

If you want to apply the same criteria to both inbound and outbound messages, use two rules and two folders.

Notes:

MailMarshal and ECM default rules are correctly configured and do not send message digests to external addresses. To send external digests in current versions of MailMarshal, you must create a new digest that applies to the appropriate folders.
Current versions of SEG/MailMarshal, and ECM/MailMarshal Exchange 7.X, allow you to select user groups when digesting, which provides additional flexibility.

How do I delete an entire folder from the MailMarshal Console?

Charles — Mon, 13 Oct 2025 23:43:58 GMT

This article applies to:

MailMarshal (SEG)
MailMarshal ECM/MailMarshal Exchange

Question:

How do I delete an entire folder from the MailMarshal Console or quarantine?

Procedure:

Sometimes there is a desire to purge an entire folder from the MailMarshal quarantine. Only mail messages can be deleted in Message History. Folders cannot be deleted in this way.

To remove a top level quarantine or archive folder from MailMarshal:

In version 10.0 and above, in the Management Console navigate to Policy Elements > Folders (note, NOT Management > Folders).
In version 8.X, use the Configurator navigate to Policy Elements > Folders.
To remove a folder select the folder from the list and delete it.

Note: If a folder is used in any Rules or Reporting Groups you cannot delete it. You might see a message like the following:

If you are sure you want to remove the folder, remove it from any rules that use it (see the Email Policy section of the Configurator or Management Console). Also remove it from any Reporting Groups (Classification Groups), found in advance system properties:

10.0 and above: System Configuration > Advanced System Properties > Reporting Groups

8.X: MailMarshal SEG Properties > Advanced System Properties > Reporting Groups

Note:

MailMarshal mail folders and message files correspond to actual Windows folders and files, and it is possible to manipulate the folders directly with Windows Explorer. The folder structure is stored, by default, in the Quarantine subfolder.
However, using the file system to remove quarantined e-mails or folders is HIGHLY DISCOURAGED. Data about messages and folders is synchronized in the database. Manually altering files will falsify the data shown in the Console. Therefore all e-mail and folder deletions should be done through the user interfaces only.
In version 10.0 and above, information about deleted folders is retained in the database to preserve auditability, and basic information about the deleted folders can be viewed in the Console.

This article was previously published as:: NETIQKB33822

How to use the Support Tool for SEG, ECM, WebMarshal or MRC

Charles Creegan — Mon, 13 Oct 2025 01:44:36 GMT

This article applies to:

MailMarshal (SEG)
MailMarshal ECM (MailMarshal Exchange)
WebMarshal
Marshal Reporting Console

Question:

How do I use the Support Tool?

Information:

The Marshal support tool has been developed to help the LevelBlue Technical Support team gather information about installed software and configuration. The tool produces a single .zip file that contains essential information to help the support team debug specific issues.

The tool can gather information about supported versions of the following products:

MailMarshal SEG (MailMarshal SMTP)
MailMarshal ECM (MailMarshal Exchange)
WebMarshal
Marshal Reporting Console
Marshal virus scanners (Bitdefender for Marshal, McAfee for Marshal, and Sophos for Marshal)
Web Components
IIS

Note: For the MailMarshal SPE (Service Provider Edition) Support Tool, see Q15019.

Installation

In most cases you will find a copy of the tool in the install folder of the base product (MailMarshal,ECM, or WebMarshal).

Otherwise, download the support tool from https://www.marshal.com/supporttool/download (right click, save as. You may see a security warning). The tool will also attempt to update itself automatically, as noted below.

The current version of the tool (1.14 and above) is packaged with .NET runtimes and does not have any software prerequisites.

Using the tool

Repeat the following steps on each server of interest, as directed by Technical Support.

If necessary, downloaad or copy the tool to the server.
Double click to run the tool.
- Note: On startup, the tool checks for updates to functionality. This feature requires access to the URL http://www.marshal.com/supporttool/download
- If the tool cannot connect, it raises a warning.
- If necessary, retrieve the latest version manually as described above.
The main window of the tool appears as shown below. The fields and selections differ depending on the installed software.
Select the items to include, as directed. Clear the selections for items you do not want to include. See below for explanations of each selection.
Choose an output directory.
Enter a support case number.
, Click GO to run the tool. The tool gathers data into a folder, and then creates a single compressed file.
- NOTE: This tool can require significant disk space, particularly if you include multiple dump files. In rare cases it could consume all available space. If not enough space is present, the tool raises a warning: Not enough free space available to package into zip file.
The status bar at the bottom of the window shows the progress. You can cancel the process if necessary.
When the tool is finished, click Close to exit.
Upload the file to LevelBlue as directed by Technical Support.
- Note: Wait for the tool to create the zip file. (The tool creates a temporary folder and then zips the content. Do not zip the folder manually - it will not contain all required items.)

The fields on the window are defined as follows:

Installed Components

Shows the related software that is installed on this computer. Select the components for which you want to include detailed information such as logs and configuration details.

Installation logs (if any) are gathered for all selected components regardless of other selections.

Items to gather

System Information

Includes a listing of the system hardware and operating system information.

Current process details

Includes a listing of processes running on the server.

Configuration details

Includes the XML or text files that define configuration of the selected software.

Marshal Registry

Includes a copy of the registry hive for all components that are present on the server.

Marshal install directory listings

Includes file and version information for files in the installation directories of all selected components.

For MailMarshal, optionally select Include Quarantine directory listing to list all messages in quarantine and archive (only if required, as the file will be much larger and take longer to generate)

Event logs

Includes Windows Event Log information. If you include the event logs, choose to include Application and/or System logs by checking the boxes.

Gather specific message

Attempts to include one or more mail message or Sent History files. Enter the first few characters of the message name (for example B89f00). This option is only available when running the tool on a MailMarshal processing node.

Log files

Includes the text log files generated by the selected components. By default the last 5 days of logs are included. Use the menus to select the range of dates to include.

Marshal Crash Dumps

Includes one or more types of diagnostic information. Shows the number of each type that are available.
Select the number of each type to include. The default is 1 of each available type. The most recent available are included.

Most recent Marshal crash dumps: Includes .mdmp files created by the selected components when recovering from an error.
Most recent WER crash dumps: Includes the Windows Error Reporting data from the recent issues.
Most recent potentially fatal messages: Includes email message files that are marked as suspect because they were being processed at the time of a crash.

Output

Output Directory: Enter the location where the compressed file should be created. The default location is the desktop. Click [...] to browse the local computer.
Support case number: Enter the case number as provided by Technical Support.

Version: The installed version of the Support tool.

Notes:

This tool simply gathers existing information from the system and logs.
- There is no need to restart any services before or after running the tool (unless specifically requested by Technical Support).
- The tool does not affect any running services and it does not require any downtime.
The tool runs as Administrator to ensure full access on servers where UAC is enabled.
Although this tool is able to gather information from MailMarshal SMTP/SEG and WebMarshal versions from version 6.0, many older versions are no longer supported. Technical Support may ask you to upgrade to a supported version as a first step to resolve any issues. For a list of supported versions of products, see LevelBlue Knowledgebase article Q10920.
The current version of the tool does not offer automatic upload. Support will provide instructions to upload to the LevelBlue Portal.

How do I automatically save a file or attachment from a mail message?

Charles — Sun, 21 Sep 2025 22:31:43 GMT

This article applies to:

MailMarshal (SEG)
MailMarshal ECM/MailMarshal Exchange

Question:

How do I automatically save a file or attachment from a mail message?

Procedure:

MailMarshal can easily be configured to save email attachments to a local or network share, and optionally remove them from the email. These rules can be applied to specific attachment types or attachments greater than a certain size.

Create a windows batch file called "SaveAttachments.bat" that contains the following text. To ensure the file will be present on all processing nodes, you can save it in the Config subfolder of the MailMarshal installation directory and it will be copied to the NodeConfig folder on all processing servers each time configuration is committed.

mkdir "c:\SavedAttachments\%2\%3_%4"

xcopy %1 "c:\SavedAttachments\%2\%3_%4\"

The %n variables are as follows:
%1 = Full path of the attachment
%2 = Message recipient
%3 = Date/Time in this format: 04-26-2004_11.38AM
%4 = Message sender
The folder name c:\SavedAttachments\ should be changed to an appropriate location for each environment. The location must exist on all processing servers.
The MailMarshal Engine service must have write permissions to the location specified.
- By default the Engine runs as the Local System and will have access to any local folder.
- The location can also be a network share. In this case for the Engine to have reliable access it should be run as a real account with local administrator permissions. In a domain environment you may be able to grant access to the computer accounts of the processing servers.

Open the Management Interface (or ECM Configurator) and browse to External Commands. Add an External Command as below.
(Click to enlarge.The ECM Configurator has different appearance but the same fields)

The command line field should contain the full path to the file "SaveAttachments.bat." In the example the variable {install} expands to the location of the MailMarshal installation folder.
The parameters field contains this text:
"{CmdFileName}" {Recipient} {Date=%%m-%%d-%%Y_%%I.%%M%%p} {Sender}

Next create a new Content Analysis rule as below. This rule will call the External Command and save the email attachments to the location specified in the batch file.

Content Analysis Rule: Move Attachments to network Share
When a message arrives
Where the message is addressed to or from any user
Where message attachment is of type 'EXECUTABLE' or 'IMAGE' or 'VIDEO' or 'SOUND' or 'DOCUMENT' or 'ARCHIVE' or 'ENCRYPTED' or 'DRAWING' or 'FONTS' or 'OTHER'
And where attachment parent is not of type: 'DOCUMENT' or 'ARCHIVE'
Run the external command 'Save Attachments'
And continue processing.

When creating the rule, choose all attachment types you want to save. In most cases you should not include Mail Components.

To remove the attachments, create a second rule. This rule must come after the previous rule because it will actually remove the attachments from the email.

Content Analysis Rule: Strip Attachments from email
When a message arrives
Where the message is addressed to or from any user
Where message attachment is of type 'EXECUTABLE' or 'IMAGE' or 'VIDEO' or 'SOUND' or 'DOCUMENT' or 'ARCHIVE' or 'ENCRYPTED' or 'DRAWING' or 'FONTS' or 'OTHER' or 'USER'
And where attachment parent is not of type: 'DOCUMENT' or 'ARCHIVE'
Strip attachment
And continue processing.

The criteria of this rule should be the same as the first.

This article was previously published as:: NETIQKB29361; Marshal KB194

How do I notify LevelBlue of new Spam so MailMarshal files can be updated?

Charles — Thu, 26 Jun 2025 06:11:01 GMT

This article applies to:

MailMarshal (SEG)
MailMarshal Exchange 5.1 through 5.3

Question:

How do I notify LevelBlue of new spam so MailMarshal files can be updated?
How do I upload spam messages for identification?
How do I report spam?
How do I report false positive spam identifications?
Is there an email address where people can send samples of spam emails that are getting past SpamCensor scripts?

Before you start:

Please verify that your spam blocking configuration meets best practices.

In particular see the notes on excessive use of exceptions (Allow Lists) and other recommendations in article Q10810.
Check that SpamCensor and SpamProfiler are enabled and updating correctly. See article Q12992.

Procedures

Spam that was not identified:

Microsoft Report Button

You can deliver reports to LevelBlue using custom settings for the Microsoft Report button that is available in supported versions of Outlook.
For more information about this solution, see LevelBlue Knowledgebase article Q21235, Reporting Spam and Phishing to LevelBlue with the Microsoft Report Button.

Console Buttons/Forward

You can send samples of spam for analysis by providing the email message in its entirety to Spam@Marshal.com
- The preferred method is to forward the message file from the MailMarshal Console using the Spam button on the message history list. This option is only available for messages that have been archived or quarantined in MailMarshal.
- If you do not have access to the MailMarshal Console (or the message was not archived), you can forward messages from an email client. However, when forwarding from a client some additional steps are required to provide useful information.

Note: Advanced information can be found in the header of the original email. However, this header information is overwritten with your header information once you click "forward". If you are able, copy the original header information into your forwarded email Spam when sending to LevelBlue.

Manual Forward

Follow these steps for Microsoft Outlook to collect (then copy / paste) the original header information to forward with the emailed Spam to the email address above:

Open the spam email.

Within the email message, go to View | Options.

Look for the box labeled "Internet Headers".

Select all of the text within this box.

Go to Edit | Copy (or use Ctrl+C).

Click Forward to send the email to Spam@Marshal.com.

Paste the header information within the email body (Ctrl+P or Edit | Paste).

NOTE: The Spam@Marshal.com email address is ONLY a collection point for Spam. It is monitored by the labs team; however, this team does not respond to queries at that address. If you need help with a Spam related issue please contact your Technical Support representative.

False positives:

Before submitting a false positive ("not spam" that was classified as spam), check which rule or function blocked the message.

Be sure you are submitting the report to the correct location.

For SpamCensor, Marshal IP Reputation Service, and SpamProfiler:
You can submit false positives by providing the email message in its entirety to NotSpam@Marshal.com
- The preferred method is to forward the message file from the MailMarshal Console using the Not Spam button on the message history list. This is possible only for messages that are currently in quarantine or archive folders.
For third party reputation services such as Spamhaus and SURBL (used in URL Censor), contact the reputation service provider directly.
- LevelBlue does not maintain the listings of these services, and LevelBlue does not have access to change the listings.

This article was previously published as:: NETIQKB39848

Updates fail due to SSL certificate issues

Charles — Tue, 20 Aug 2024 22:30:01 GMT

This article applies to:

MailMarshal (SEG)
MailMarshal ECM/MailMarshal Exchange 7.X
HTTPS Certificates for Internet Access
Blended Threats licensing
Maintenance Check
McAfee for Marshal
Sophos for Marshal
Bitdefender for Marshal

Symptoms:

Installations cannot download updates for Automatic Updates (SpamCensor), or cannot validate Blended Threats or Maintenance
Logs show error Unable to get Local Issuer Certificate
Virus scanner updaters cannot perform updates or licensing checks
Error messages indicate SSL certificate validation errors
New installations may display a warning on installation
- Warning text similar to: The MailMarshal Update service and the Blended Threats Module require SSL certificates currently not installed on this system

Cause:

The most common cause of these symptoms is that required CA root certificates are not installed, so the SSL certificates used by LevelBlue websites cannot be validated.

LevelBlue uses certificates issued by several authorities, including Microsoft, DigiCert, and Let's Encrypt. All of the root certificates for these authorities are included by default in the Windows certificate store.

As of late 2024, Let's Encrypt certificates may be in use.

Currently supported Windows Servers that have the default set of root certificates already have the required certificates (ISRG Root X1). Windows 2012 servers may not have the required certificate.

As of mid 2023, DigiCert is issuing certificates from a new root certificate.

This change is required because some browsers will stop trusting older DigiCert roots in 2025. For more details see information from DigiCert.
For new certificates to be trusted, you must have the DigiCert Global Root G2 installed as a trusted root certificate in the Windows certificate store.
Windows Servers that have automatically installed required updates should already have installed the required certificate.
All certificates currently in use are issued from the new root certificate.

Also, you must allow access to Certificate Revocation List servers (such as http://crl3.digicert.com/ and http://c.lencr.org) to allow SSL connections to be validated.

Resolution:

To resolve this issue in most cases, you can take one of the following actions:

You may be able to install the certificates automatically by browsing to the affected site (such as https://mcafee.marshal.com) using Internet Explorer or Edge from an administrator account. Once you have successfully browsed to the site, try the updater functionality again.
You can manually retrieve the DigiCert Global Root G2 certificate from: https://www.digicert.com/kb/digicert-root-certificates.htm
- Install this certificate to the Trusted Root Certificates store on Array Manager and Processing Node servers. See manual installation instructions at the end of this article.
- Previous generation certificates (validity starting before March 2023) are issued from the DigiCert Global Root CA certificate.
You can manually retrieve the ISRG Root X1 certificate from https://letsencrypt.org/certificates/.
- Install this certificate to the Trusted Root Certificates store on Array Manager and Processing Node servers. See manual installation instructions at the end of this article.

Once the root certificate is installed, all functions requiring web access should work.

Other possible causes:

Cause 2: Access through WebMarshal

If Web access for SEG/MailMarshal or a virus scanner updater is through a WebMarshal installation that is configured for HTTPS content inspection, it is possible that the root certificates are not installed for the account(s) used by the Engine service, Array Manager service, and/or virus updater services.

Note: This cause only applies when Web access is through a WebMarshal installation that has HTTPS content inspection enabled for the specific update sites. Inspection is disabled by default.

WebMarshal HTTPS Content Inspection uses a special locally generated root certificate. This certificate is installed into the user's certificate store by default. It is not available for service accounts by default.
WebMarshal makes an exception for the SpamCensor update site, but current versions do not make an exception for the Blended threats site.

Resolution - WebMarshal certificate:

To resolve this issue, on each SEG/MailMarshal server, manually install the WebMarshal root certificate using the Windows Certificate Management console:

Download the certificate from the WebMarshal.Home page of the WebMarshal installation.
Run Microsoft Management Console (MMC.exe)
Choose to add a snapin and select the Certificates snap in.
Choose to manage certificates for the Computer account.
Open Trusted Root Certification Authorities > Certificates.
Import the certificate.

Alternatively, you might choose to bypass the proxy completely, or disable HTTPS inspection, for the update URLs required by LevelBlue products

Cause 3: Access through a third party proxy

If Web access for MailMarshal/SEG or a virus scanner updater is through a third party proxy configured for HTTPS content inspection, you may need to complete further configuration.

Note: This cause only applies when Web access is through a third party proxy server that has HTTPS content inspection enabled.

The proxy server might not have the required CA certificates installed.
The certificate used for local re-encryption might not be installed on the MailMarshal servers.

Resolution - third party proxy:

To resolve this issue, consult the documentation for the third party proxy and ensure the following:

Verify that all CA certificates required are installed on the proxy server. See the list in resolution 1, above.
Verify that the certificate used for re-encryption (and any CA or intermediate certificates) are installed on the servers.
1. Obtain the certificate(s) required. See the list in the Manual Download section below.
2. On each server in the installation, run Microsoft Management Console (MMC.exe)
3. Choose to add a snapin and select the Certificates snap in.
4. Choose to manage certificates for the Computer account.
5. Import the certificate(s) to the appropriate locations. In most cases Windows will select the locations automatically.
Alternatively, you might choose to bypass the proxy completely for the update URLs required by LevelBlue products. See the documentation for the proxy server.

Additional technical details:

Some Windows releases install a very limited set of SSL CA certificates by default. Additional certificates are downloaded on demand.
- Windows Group Policy can be set to disable the on-demand downloads.

Manual download of certificates:

You can also manually download and install the required CA Certificates using the Windows Certificate Management console.

Install the certificates on Array Manager and Processing Node servers.

Download the root certificate
- DigiCert Global Root G2 (.pem) (right click, save as). See additional links and other formats at DigiCert Root Downloads.
- ISRG Root X1 (.pem) (right click, save as). See additional links and other formats at Let's Encrypt Chains of Trust.
- (Note: SecureTrust certificates that were previously used are no longer required.)
Run Microsoft Management Console (MMC.exe)
Choose to add a snapin and select the Certificates snap in.
Choose to manage certificates for the Computer account.
Open Trusted Root Certification Authorities > Certificates.
Import the root certificate.

Notes:

Verify your system clock is accurate. Certificates might be rejected if they are "out of date" according to the local system time.

If none of the above solutions resolve your issue, contact Technical Support for help in diagnosing and resolving the problem.

Updating Root Certificates for use by WebMarshal, SEG, and ECM

Charles Creegan — Mon, 12 Aug 2024 22:53:40 GMT

This article applies to:

WebMarshal
MailMarshal (SEG)
MailMarshal ECM/MailMarshal Exchange

Question:

How do I ensure that required SSL CA root certificates are installed on a Windows server?

Background:

WebMarshal uses HTTPS to retrieve and inspect HTTPS website content. To verify the status of HTTPS certificates, WebMarshal processing nodes require locally installed copies of any CA (root) certificates used to sign the website certificates.
All of the named products use HTTPS to access product update websites. To verify the security of the update sites, these products require locally installed copies of the CA (root) certificates for all hosting locations, including Microsoft, DigiCert, and Let's Encrypt.
- Updates can be requested by the Array Manager and processing nodes.
In some versions of Windows Server, only a small set of CA (root) certificates is installed by default. The certificates required by these products may not be included.

Procedure:

To ensure that the latest root certificates are installed on a Windows server, use the following procedures.

Note: These instructions assume that the servers have access to the Internet and/or Windows Update. For information about how to update certificates on disconnected servers, see the Microsoft article Configure Trusted Roots and Disallowed Certificates.

Create a folder location to hold downloaded files. This example uses C:\Certificates
Open an elevated (Administrator) command prompt.
Enter the following command to retrieve a listing of root certificates from Windows Update:

certutil -GenerateSSTfromWU c:\Certificates\Rootcerts.sst
Open an elevated (Administrator) Powershell prompt.
Enter the following commands to import or update all root certificates:

$file = ( Get-ChildItem -Path C:\Certificates\Rootcerts.sst )
$file | Import-Certificate -CertStoreLocation Cert:\LocalMachine\Root
The Powershell command result shows each certificate that is contained in the SST file. This list includes certificates that are already installed on the local machine.
- You can also view the list of certificates in the Trusted Root Certification Authorities store by running the Windows CertLM utility, or the MMC Certificates snap-in for the local machine.

Notes:

The CA certificates for SEG and ECM updates change very rarely.
- In mid-2023, DigiCert began using a new root certificate (DigiCert Global Root G2). For more details see information from DigiCert.
- In late 2024, LevelBlue began using certificates issued by Let's Encrypt from the ISRG Root X1.
To ensure that WebMarshal is up to date with the latest CA certificates, you can script the certificate update to run once a week, using Windows Scheduled Tasks.
Advanced users can choose which root certificates they wish to add. For basic information about this process, see the Microsoft article linked above.
Certutil also provides a method to import certificates. However, this method does not correctly import all certificates from the SST files. LevelBlue strongly recommends the use of Powershell to import certificates.

What file types are scanned by Image Analyzer?

Charles — Wed, 27 Mar 2024 21:14:31 GMT

This article applies to:

MailMarshal (SEG)
MailMarshal ECM/MailMarshal Exchange
Image Analyzer

Question:

What image types are scanned by Image Analyzer?
What are the Image Analyzer return values in message logs?

Information:

Image Analyzer is an optional module for current versions of SEG and ECM, that inspects image content.

In MailMarshal 10.1.0 and above, Image Analyzer can detect a number of types of images including pornography and other potentially inappropriate or time-wasting categories.
In earlier releases, Image Analyzer detects potentially inappropriate (pornographic) images.

When you configure an image analysis rule condition, MailMarshal invokes Image Analyzer to check all files of type IMAGE or Binary Unknown.

Image Analyzer actually checks files of the following types:

BMP, DIB, JPEG, JPG, JPE, J2K, JBG, JPC, PNG, PBM, PGM, PPM, SR, RAS, TIFF, TIF, GIF, TGA, WMF, PGX, PNM, RAS

If the file is not one of the supported types, the MailMarshal rule condition will return "false" (not triggered).
If the file is one of the supported types, the MailMarshal rule condition depends on the results returned by Image Analyzer.

Notes:

In the MailMarshal message logs, the detailed Image Analyzer result is listed.

Sample results (10.0 and below) are as follows:

ImageAnalysis: Good(0) 16ms - Coffee Bean.bmp
ImageAnalysis: Inappropriate(81) 500ms - porn.jpg
ImageAnalysis: Unsupported file(-2) 0ms - MailMarshal.ico

Sample results (10.1 and above) are as follows:

ImageAnalysis: Does not match category 7174 (0) 1735ms - DC10.jpg
ImageAnalysis: Matches category 5519 (99) 62ms - DC10.jpg
ImageAnalysis: Image is not valid [C:\Program Files\Trustwave\Secure Email Gateway\Unpacking\T3\U2\LevelBlue.ico]

Depending on the specific version of MailMarshal/Image Analyzer used, files of unsupported types may be logged as "good(0)", "Unsupported file(-2)", or "Image is not valid". In all such cases the MailMarshal rule condition will return "false."

Strategy for adding image compliance to MailMarshal

Charles — Wed, 27 Mar 2024 20:45:13 GMT

This article applies to:

MailMarshal (SEG)
MailMarshal ECM/MailMarshal Exchange

Introduction

Most organizations will attempt to protect their email users from offensive images that are distributed by email. Companies may also want to limit email images to avoid time wasting.

Furthermore, in some jurisdictions there is a legal requirement to block access to offensive images.

This article will provide some strategies for limiting exposure to offensive or unwanted images. For full details of the implementation, please refer to the User Guide and Help for your product version.

Strategy

There are three parts to the strategy:

Detecting Offensive Images
Quarantining Unknown Images
Always allowing Company or Trusted Images

Detecting Offensive Images

Image Analyzer is a third party deep image analysis product that has been fully integrated into the MailMarshal content scanning engine. Integration with Image Analyzer allows MailMarshal to assess the content of images that pass through the email gateway. LevelBlue also provides integrated licensing for this product.

In MailMarshal 10.1.0 and above, Image Analyzer can be configured to detect several types of inappropriate or time-wasting content, including pornography.
In earlier versions, the main target content that Image Analyzer attempts to detect is pornographic images.

Because MailMarshal unpacks the content of a message, extracting the attachments and the content inside archive files, Microsoft Word documents, and other packed formats, Image Analyzer can scan the image content from all components of the target message. Rules to use this technology are included with the default ruleset.

It is important to note that detection of this type of content is not an exact science, and the level of technology available today means that there will be some false-positive and false-negative detections. However, Image Analyzer allows your organization to utilize leading technology, and provides evidence of due diligence in protecting your employees from receiving material that may be offensive or in some cases illegal.

The default Image Analyzer rule included in MailMarshal 10.1 and above is as follows:

Content Analysis Rule: Block Suspected Pornographic Images
This rule utilizes MailMarshal's Image Analyzer to scan attached images for suspected pornographic content. Image Analyzer must be licensed for this rule to work correctly.
When a message arrives
Where message is incoming
Where the attached image matches the category 'pornography'
Send a 'Suspect Image In' notification message
And move the message to 'Suspect Images' with release action "continue processing"

Quarantining Unknown Images

If you have an obligation to block unknown images, you can easily create a rule in MailMarshal to do so. A properly constructed rule will block messages containing images even if the images are contained in archive files or documents.

Blocking all images could create a heavy administrative load to deal with user requests to release messages. Fortunately MailMarshal includes an optional web-based End User Management system (SQM or Spam Quarantine Management) that can allow you to grant users the ability to release their own messages. Using SQM, you can prevent images from being passed directly to users, while allowing them some control over the content and minimizing administrative load.

Two Block Image rules are included in the MailMarshal default ruleset. LevelBlue suggests that you use the rule that provides an exception for known images using the "fingerprinting" feature described below.

Note: When enabling user self management, the folder used by Image Analyzer (by default, 'Suspect Images') should NOT be enabled. Only the folder used by the Block IMAGES rule ('Attachment Type - Images') should be enabled for self-management. This will prevent offensive images from being displayed to users while allowing them to access the other unknown images. To prevent confusion, ensure that the folder 'Suspect Images' is not used by any other custom rules.

Allowing Company or Trusted Images

MailMarshal offers the ability to exclude from evaluation images used in Company documents, graphics or signatures as well as those from trusted sources. The feature in MailMarshal is known as Fingerprinting. A rule with Fingerprint image exclusion to the normal Block Image action is included with the default ruleset.

The default rule in MailMarshal SMTP is as follows:

Content Analysis Rule: Block IMAGES (unless fingerprint is known)
This rule blocks messages with IMAGE attachments, except where the fingerprint for that image is known to MailMarshal. This can be a useful way to allow company logos to be excluded from an image-blocking rule.
When a message arrives
Where message is incoming
Where message attachment is of type 'IMAGE'
And where attachment fingerprint is not known
Send a 'Multimedia in' notification message
And move the message to 'Attachment Type - Images' with release action "continue processing"
Note: For more information about fingerprinting and adding images to the known fingerprints, see the User Guide. The fingerprinting functionality should be used with discretion. Fingerprinting very large numbers of images can slow MailMarshal configuration reloads.

Summary

The strategy and MailMarshal capabilities described above should permit you to block most offensive images propagated by email, while allowing those from company or trusted sources, and with minimal ongoing administrative load.

To complete the picture, you should ensure that an Acceptable Use policy for email is established in the organization and known to users. Individuals who exchange inappropriate material tend to do so repeatedly. MailMarshal allows you to report on blocked material and can send a notification to the user when it detects inappropriate content. Even if MailMarshal does not detect every instance of the material, the individuals will be educated that the content of email is being analyzed and monitored. The risk of action being taken, or social embarrassment, rapidly increases. Most users will comply with the policy voluntarily.

What versions of Marshal Security products are currently supported by LevelBlue Technical Support?

Charles Creegan — Sun, 26 Nov 2023 18:02:27 GMT

This article applies to:

MailMarshal (SEG)
MailMarshal ECM/MailMarshal Exchange
MailMarshal SPE
MailMarshal SES
Marshal Reporting Console
WebMarshal
Bitdefender for Marshal
McAfee for Marshal
Sophos for Marshal
Other Products
- MailMarshal Appliance e10000
- MailMarshal Management Pack for MOM
- MailMarshal Management Pack for SCOM
- Marshal EndPoint Security
- Security Reporting Center
- Firewall Suite
- imMarshal for MSN
- Counterspy for Marshal
- Kaspersky for Marshal
- PestPatrol for Marshal

Question:

What versions of Content Security (Marshal) products are currently supported by LevelBlue Technical Support?

Information:

For full details about supported versions of current products, see the articles linked below:

Premises Email Security

Article Q20961 covers the following products:
- MailMarshal (SEG)
- MailMarshal ECM/MailMarshal Exchange
- Secure Email Server (SES)

Web Content Security

Article Q20962 covers WebMarshal.

Service Provider Email Security

Article Q20963 covers MailMarshal SPE.

Anti-Virus and Reporting

Article Q20964 covers the following products:
- Bitdefender for Marshal
- McAfee for Marshal
- Sophos for Marshal
- Marshal Reporting Console

Deprecated and Discontinued Products

e10000 (MailMarshal Node Appliance): End of support: March 31, 2011
EndPoint Security: End of support: May 1, 2013
MailMarshal Management Pack for MOM: End of support: May 1, 2013
MailMarshal Management Pack for SCOM: End of support: May 1, 2013
Security Reporting Center (Windows Version): End of support: December 31, 2009
Security Reporting Center (Solaris Version): Withdrawn
Firewall Suite: Withdrawn
imMarshal for MSN: Withdrawn
Counterspy for Marshal: End of support: January 1, 2014
Kaspersky for Marshal: End of support: November 22, 2023
PestPatrol for Marshal: End of support: January 1, 2014

This article was previously published as:: NETIQKB33882

Using Locale specific date and time settings with MailMarshal

Charles — Tue, 21 Nov 2023 18:10:47 GMT

This article applies to:

MailMarshal (SEG)
MailMarshal ECM/MailMarshal Exchange/ECM
Windows and SQL date or language localization

Question:

How do I use Windows locale specific date variables with MailMarshal?
Date format does not change as expected
Date format errors are returned or logged in the Array Manager text logs

Information:

To apply the Windows locale to date variables, you must ensure that the account used for MailMarshal services is configured with the appropriate locale. The locale of the server installation is the default for all accounts. Changes to the locale normally apply only for each individual account.

If you want to change the date locale for the MailMarshal services, see the information in LevelBlue Knowledge Base article Q15031.

Notes:

The SQL Server language MUST be set to English. This setting affects date/time transformations.
- If the server default is not English, you must create a login with the default language set to English and use this login as the MailMarshal Operational User.
For MailMarshal SPE, you must use the US English locale for ALL services including all MailMarshal SEG array and processing services that are managed by SPE.

How do I add custom file type definitions to MailMarshal?

Charles Creegan — Mon, 11 Sep 2023 19:27:52 GMT

This article applies to:

MailMarshal (SEG)
MailMarshal ECM/MailMarshal Exchange 7.X
- This feature is NOT present in MailMarshal Exchange 5.X
MailMarshal SPE

Note: The location used to enter and store custom types varies by product.
- In SEG and ECM, types are entered by editing a file.
- In SPE, types are entered in the Administration Console.

Question:

How do I add custom file type definitions to MailMarshal?
How do I configure MailMarshal to correctly recognize my file types?
How do I prevent my "Block Unknown Attachments" rule from triggering on legitimate attachments?
Why is MailMarshal blocking legitimate file types?
How do I stop MailMarshal from blocking legitimate file types?
See also Q12988, How do I remove or disable custom filetypes?

Causes:

MailMarshal and ECM recognize many, but not all, executable, image, document, movie, sound, archive, encrypted, and other file types. If the product does not recognize an attachment as a legitimate file type during mail processing, it tags the unrecognized file as Binary Unknown (BIN). By default, the product blocks the file with the Block Unknown Attachments rule. The workaround is to add a custom file type definition locally. Once the product recognizes the file as a custom file type, and not as BIN, the attachment will no longer trigger the Block Unknown Attachments rule.

This article explains how administrators can create custom file type definitions, enabling the products to recognize and pass files you do not want it to block.

Important notes:

Custom types override the built-in types. The product assigns only one file type to each file. If a file is recognized as a custom type, it may not be unpacked or scanned for malware as expected. This behavior can result in security breaches. Test any custom file types carefully.
You can only have ONE custom entry with each name such as T:MY-CUSTOM
You can have a custom entry that duplicates a default type name (such as T:XLS).
If you have more than one identical T: name entry, you will not be able to load the configuration. This behavior is enforced beginning with the File Type release of October 2020.
To recognize several signatures as MY-CUSTOM, include multiple A or X lines in the same signature. See details below.
To prevent conflict with built-in types, avoid re-using default typenames such as PDF. Using the default typenames for custom filetypes will not affect unpacking of files.

Procedure:

Note: This solution is intended for advanced users. Most sites will not need to use it.

To create and apply a custom file type definition, follow these steps:

Gather multiple samples of the file in question.

If the blocked file type comes from multiple sources, get several samples of the file type from each source. In this example we will use AutoCAD Shape files to demonstrate the steps involved. For example, use different versions of AutoCAD to create Shape files, and create them on different operating systems, etc. In essence, try to cover the various flavors you will encounter in the real world.

Try to obtain about 10 samples of the file type in question. You may need more samples if there are multiple versions of the file type. Fewer samples are sufficient if there is only one version of the file type.

If the file type in question is binary file, you will need to work with the hexadecimal values. In unusual cases you may wish to use text values instead of Hex. Text files are covered later in this article. For now we will continue with a binary example.
View each sample file in a Binhex reader. The following are freely available:
- Frhed: http://frhed.sourceforge.net/
- BinaryViewer: http://www.proxoft.com/BinaryViewer.aspx
Start up multiple sessions of your Binhex reader with a different file opened in each. We are looking for a pattern common to all these files. Typically the opening few bytes will be common to all your examples. We are looking for a happy medium. Use too many bytes, and you risk failing to recognize a different flavor with a slightly different signature. Use too few, and you risk false triggering on unrelated files. A good rule of thumb is to use the first 4 - 8 bytes. Note that each hexadecimal pair of digits you see in the Binhex reader equates to one byte (i.e. 4 - 8 bytes = 8 - 16 digits).
Create, or edit the existing, file type configuration.
- For SPE, see Policy Elements > Custom File Types in the Administration Console.
- For MailMarshal and ECM, on the Array Manager server, edit the filetype.cfg file in the installation folder (not in a subfolder).
  - For MailMarshal/SEG version 8.X and later versions on 64 bit systems, the default location is C:\Program Files\Trustwave\Secure Email Gateway
    - When you add or make changes in this file, you must restart the Array Manager service. For version 10.0 and above, you may also need to force refresh of the web console (ctrl-F5).
  - For MailMarshal Exchange 7.X (64 bit systems), the default location is C:\Program Files (x86)\Marshal\M86 MailMarshal Exchange
- For a list of default locations for earlier versions, see LevelBlue Knowledgebase article Q10832.
  Notes:
  - The file is named filetype.cfg and not insert-filetype-here.cfg Use the same filetype.cfg file to add all current and future file-type customizations.
  - The entry markers (T, D, X, A) MUST BE UPPERCASE.
If you are identifying a text or ASCII file, skip to Step 6. If you are identifying a binary file, each custom file type listed requires the first three of the following four entries. The comment line is optional.
- T: typename
- D: description
- X: offset=hexadecimal signature
- # Optional comment line
Notes: The offset is an integer (decimal).
Multiple X lines can be entered. The type triggers if ANY of the signatures is found (OR condition).
In SPE, you enter the data in separate fields without the leading identifiers T,D,X,#.

Example:

Binhex reader shows the following digits at the start of a file: 4175 746f 4341 442d

Because we are referring to the beginning of the file, use an offset of 0: X:0=4175 746f 4341 442d

Complete all the relevant entries for this file type as follows:

T:SHX D:AutoCAD Shapes file X:0=4175 746f 4341 442d # Recognizes AutoCAD shape files.

If you are identifying a text or ASCII file, each custom file type listed requires the first three of the following four entries. The comment line is optional.
- T: typename
- D: description
- A: offset,length=ascii signature
- # Optional comment line
Note: Multiple A lines can be entered. The type triggers if ANY of the signatures is found (OR condition).

Here is an example of a text file type definition. The AWK file will always have, in the first 14 characters, the string #!/usr/bin/AWK. This implies an offset of 0, and a length of 14:

T:AWK D:AWK File A:0,14=#!/usr/bin/AWK
In the above list, SHX and AWK are user-defined, shorthand names for the file type. Ensure the shorthand names you choose are not used in the default list of known file types. Once the customization is complete, SHX and AWK are visible in rule creation, in rules and logs, and wherever these file types are referenced. AutoCAD Shapes file and AWK File are the full names that will appear when choosing file types within a rule.
Save the filetype.cfg file, or (for SPE) click OK on the entry window.
For SEG and ECM, set the security permissions on filetype.cfg so that only the mail administrator and the service accounts have access to it. (By default, MailMarshal uses the Local System account.)
To apply the new custom file type:

SEG/MailMarshal SMTP, ECM/MailMarshal Exchange 7.X:
- Restart the Array Manager service.
- Select Commit Configuration Changes to push the update to all nodes.
- Restart the Engine service on all nodes.
- For MailMarshal 10.0 and above, to ensure you see new types in the Management Console website, restart the site in IIS.
SPE: Wait for configuration to update.

When you create a new rule, the new file types will appear in a User Defined group in the Select File Type dialog of the Rule Wizard.

Additional Example Entries for filetype.cfg

Following are some real-life samples we have encountered. Do not use these without using a Binhex reader to confirm the signatures of your files.

T:MY-MIDI D:MIDI Sound File - User Defined X:0=4d54 6864 0000 0006

T:CAMOUFLAGE D:Camouflaged File # 20 bytes from end of file always seem to have 74 a4 54 10 22 97 X:-20=74 a4 54 10 22 97

T:SCC D:Visual Source Safe # Example vssver.scc X:0=3412 0100 9060 adf1

T:DCX D:DCX Fax Image File X:0=B1 68 de 3a

T:SKC D:SKC Molecular Structure X:0=01 03 00 04 02

T:CDX D:CDX Molecular Structure X:0=56 6a 43 44 30 31 30 30

T:BLK D:Blackberry DAT file X:0=03 91 0a 00 X:0=03 a0 0a 00 X:0=03 9e 0a 00 X:0=03 9d 0a 00 X:0=03 4e 01 00 X:2=00 00 00 00 00 00 00 01

Note: Multiple X (hex signature) lines are present in this definition. The type triggers if ANY of the signatures is found (OR condition).

T:UNI D:Unicode Binary NDR information A:0,18=Reporting-MTA: dns

T:PCT D:Mac Word embedded PCT Files X:10=0011 02ff 0c00 fffe

T:MPR D:MRG Print File X:0=1b 45 1b 26 6c 4c 1b 2a 72 30 46 1b

T:XLSWorks D:Excel Spreadsheets by MS Works X:0=09 04 06 00 00 00 10 00

T:MRF D:MRF Data File X:0=50 4b 03 04 14 00 00 00

This article was previously published as:

NETIQKB29638

Marshal KB478

How do I obtain MailMarshal (SEG) or ECM license keys?

Charles Creegan — Tue, 22 Aug 2023 20:41:36 GMT

This article applies to:

MailMarshal (SEG)
MailMarshal ECM/MailMarshal Exchange
Functionality applies to all product versions although names have changed

Question:

How do I obtain MailMarshal license keys?
What are the types of license keys available for MailMarshal?
What are the MailMarshal licensing options?
How do I get a full MailMarshal license?

Procedure:

Trial Keys

Installing current versions of MailMarshal SMTP/SEG or MailMarshal ECM/Exchange automatically generates a trial key that enables all features.

Trial keys have a fixed duration of 30 days, which starts from the time of key generation. If the product was previously installed on the same server, a shorter duration key will be created. If you have a need to trial the product for longer than 30 days, please contact your LevelBlue Partner for a special extended trial key.

Other than the expiration date, trial keys provide access to all product features and are not limited.

Full Keys

The full license key for most versions of MailMarshal is based on your domain SID, the computer SID, or the list of local domains as specified in MailMarshal. For more information see LevelBlue Knowledge Base article Q10180.

Tip: To view and edit local domain information in MailMarshal SMTP current versions, or MailMarshal Exchange 7.X, see the Local Domains element in the Configurator menu tree. In other versions, see the Configurator > Server Properties, Local Domains tab.

How to get a Full Key
Once you have purchased MailMarshal, you need to obtain a full key. From the MailMarshal 10.0 and above Management Console (or 8.X Configurator), you can send LevelBlue an email containing your request. Use the following procedure:

I n the Management Console navigate to System Configuration > Array Properties > License. (8.X: in the Configurator Tools menu, select View License Details.)
Click Request Key.
Specify the appropriate values to request a key.
- In the Additional Information field, provide any special notes or requests for specific modules to be licensed.
- Also, it is helpful to include the customer account number or exact customer name from a previous purchase in the Additional Information. MailMarshal automatically sends the company name you entered at the time of installation, but company names often change.
- Make sure that the requesting email address used will be able to receive the response email (not restricted by MailMarshal policy.)
Click Send Request, and then click OK.
The email is sent to LevelBlue, and will include system details that LevelBlue requires to generate a key.
If you are having trouble sending email from SEG/MailMarshal:
- In MailMarshal (SEG) 10.0 and above, copy the information from the Seeds field on the License page, and send this with the other required information.
- In SEG 8.X and below, the above steps also place a copy of the system details on the Windows clipboard. Paste the information from the clipboard, and send it to LevelBlue by another method.

You can expect a reply from LevelBlue, normally within two business days.

What if I move my server, or change Local Domains?
Keys are validated on the Array Manager, so if you have multiple processing servers you can move them freely.

For most keys, you can move the Array Manager server so long as it remains in the same Windows domain. If you modify the information that was used to generate the full product key, you will need a new key. In these cases, MailMarshal automatically generates a 14 day temporary key to give you plenty of time. Simply request a key as above. Requesting a new full key costs you nothing and keys usually arrive within two business days of you submitting your request.
If you have a Local Domain linked key (this is unusual), you can freely change the IP addresses of the mail servers associated with these domains without needing a new key.

If your trial key has expired, or your full key is invalidated by changes, MailMarshal displays a message that notifies you whether key expiration is impending or whether the key has expired. Depending on your selection, an expired key could either stop mail throughput, or allow mail to pass through with no rule action (no virus or content scanning).

What about additional installation locations or Disaster Recovery setups?

If you want an additional array for disaster recovery, or for processing at another gateway, you can use the same Full Key IF the Array Manager is joined to the same domain (assuming the key was based on the Windows domain). If the key does not work in the new location, you can request another full key. Be sure to include comments about why the key is required. MailMarshal is licensed on the number of email users, not the number of servers.

Note: For additional capacity, even over multiple gateways, in most cases you should add processing nodes to a single array rather than creating new arrays.

Add-on Modules

How can I trial additional modules such as Antivirus products, Blended Threat analysis, and Image Analyzer?

All available add-on modules for MailMarshal are enabled by the standard trial keys.
If you are an existing customer with a full key, please contact LevelBlue or your LevelBlue partner for a special time-limited full key.

How can I get a full license for additional modules?

Bitdefender for Marshal, Sophos for Marshal, McAfee for Marshal, and Image Analyzer are licensed through the product key. If you have added a module to your license and received confirmation from LevelBlue, you can submit a key request to get an updated key.
Blended Threats is provisioned automatically by the Array Manager. Ensure the Array Manager service has web access. The provisioning process can take up to 24 hours.
For any other antivirus products that you purchase through other channels, no change to the MailMarshal key is required. Contact the reseller for license information.

Notes:

Technical support does not administer full keys but they can provide a time limited (temporary) key for customers still holding a current subscription or maintenance contract.

For Sales and Licensing questions contact your LevelBlue account manager or partner sales contact.

This article was previously published as:: NETIQKB29047; Marshal KB43

How are MailMarshal license keys generated?

Charles — Tue, 22 Aug 2023 20:40:40 GMT

This article applies to:

MailMarshal ECM/MailMarshal Exchange
MailMarshal (SEG)

Question:

How are MailMarshal license keys generated?

Procedure:

MailMarshal SMTP and MailMarshal Exchange licenses can be keyed to your environment by several methods:

For most customers, licenses are keyed to the Domain SID of the AD/Domain Controller: This option allows you to install or re-install the Array Manager on any server in the domain. However, if the Array Manager server is removed from the domain, the license will be invalidated and be replaced with a temporary 14 day key. You have the option of requesting a new full key from the MailMarshal Configurator (or MailMarshal (SEG) 10 Management Interface) or adding the machine back to the domain and replacing the temporary key with the original full license key. Since Domain SID are unique to every AD/Domain Controller, a rebuilt Domain Controller will have a new Domain SID and the license must be reissued.
Licenses can also be keyed to the Computer SID of the MailMarshal server: Licenses keyed to the Computer SID do not require domain membership, and cannot be invalidated by changes to the domain membership or Local Domains. However, the key can only be used on a single server (array manager). If you replace the Array Manager server, the license will be invalidated and be replaced with a temporary 14 day key.
Licenses can also be keyed to the email domains listed in the Local Domains. However this option is now deprecated. Licenses keyed to the Local Domains can be invalidated by any change to the domains in the Local Domains. As such, these license keys are suitable for use where the Local Domains list is reasonably static. If the local domain list changes, MailMarshal will automatically replace the full key with a temporary 14 day key. You have an option of requesting a new full key from the MailMarshal Configurator (or MailMarshal (SEG) 10 Management Interface) or removing the changes and replacing the temporary key with the original full license key.

Notes:

To obtain a full MailMarshal license key, please see the procedures in LevelBlue Knowledge Base article Q10418.

This article was previously published as:: NETIQKB34819

How do I install McAfee for Marshal with MailMarshal?

Charles — Tue, 22 Aug 2023 20:40:15 GMT

This article applies to:

MailMarshal (SEG)
MailMarshal ECM/MailMarshal Exchange

Question:

How do I install McAfee for Marshal with MailMarshal?

Procedure:

This article outlines instructions for downloading and installing McAfee for Marshal for MailMarshal.

As the McAfee for Marshal scanner module has a DLL interface, it has excellent performance and integrates seamlessly with MailMarshal. It also features integrated automatic updating of the latest virus signature files, making it easier for administrators to have up-to-the-minute protection.

Trial Customers
All MailMarshal trial keys are McAfee enabled and therefore no additional product key is required to trial McAfee for Marshal. Installation of McAfee for Marshal is the same for trial as existing customers.
Customers using a full (customer) Product Key
To trial the McAfee for Marshal module, contact LevelBlue or your LevelBlue Partner to obtain a special time-limited McAfee enabled key. Keep a record of your current full key for later use. After the trial period, you will need to enter a new McAfee enabled full key, or re-enter your previous full key.

Installation Steps

Obtain the separate McAfee for Marshal setup program from the LevelBlue website download page and install.
- Note: In SEG or ECM array installations, you must install McAfee for Marshal on all email processing nodes in the array.
After the software is installed, launch McAfee for Marshal configuration (this starts by default when you finish the installation wizard).
On the Signature Updates and Engine Updates tabs, choose the update method and if necessary enter proxy information or network credentials. See Help for more information.
- Note: If you have multiple servers using McAfee for Marshal, or another McAfee application that performs downloads, you can save bandwidth by performing the Internet download at a single location and pointing other servers to that location.
You can also change the update frequency for signature updates. The default is to check hourly.
You must download an initial set of definition files before the software can be used. If no proxy was required, the software will have started this update immediately. If you have made changes, to update, click the Start Update button from the Status tab.

MailMarshal Configuration

Once the software is installed, in the MailMarshal Configurator under Virus Scanners, add the McAfee for Marshal scanner. As part of this process, MailMarshal checks that the scanner is functioning.
Make sure you have a virus rule enabled (using the Rule condition "Where message contains a virus") The default rules provided with new installations of MailMarshal include virus rules you can simply enable.
Commit configuration.
Test by sending a harmless eicar test virus through MailMarshal. A sample Eicar.com test file (not a real virus) can be found in the install location, in the subfolder \Unpacking\avcheck.
- Note: Depending on other rules and installed software, the test email may be blocked before it is scanned for viruses. To ensure you test the scanner, you might need to change the order of rules.

Notes:

If more than one MailMarshal or WebMarshal product is installed on a server, only one copy of the McAfee for Marshal software is required. Each MailMarshal or WebMarshal product must have an appropriate key.

This article was previously published as:: NETIQKB29285; Marshal KB237

What happens to my license key if I change or add a domain in MailMarshal?

Charles — Tue, 22 Aug 2023 20:39:38 GMT

This article applies to:

MailMarshal for Exchange
MailMarshal (SEG)

Question:

What happens to my license key if I change or add an email domain in MailMarshal?

Information:

Most customers have a Computer SID or Windows Domain SID based license key. These keys are not affected by changes in email domains. However, if a key is rendered invalid by any change, a pop-up will display alerting you to the need to request a new key and there is a 14-day grace period to receive and apply your new key. During this period, you should follow the key request process outlined in this knowledge base article:

Q10418: How do I obtain MailMarshal license keys?

This article was previously published as:

NETIQKB29561

Installing Exchange Cumulative Updates with ECM

Charles — Tue, 22 Aug 2023 02:11:45 GMT

This article applies to:

MailMarshal ECM
Exchange 2016/2019
Cumulative Updates

Question:

What are the best practices for installing Exchange Cumulative Updates (CUs) where ECM is installed?
After installing CU the Exchange Transport Service stops with error from ECM Agent: Could not get pickup directory path

Background:

Some installations experience problems with the MailMarshal ECM Agent after installing CUs on the servers where the Agent is installed.

The error Could not get pickup directory path always means that the registry entry where this value should be found, cannot be read by the ECM services (usually because it does not exist).

Reports from the field suggest that sometimes Exchange CU installs remove this registry entry and do not re-create it.

Procedure:

When installing a CU, as best practice:

Set the status of ECM Exchange Agent to “Agent not installed”.
Install the CU and restart the server.
Confirm all relevant Exchange services are started.
Confirm the presence and correct data in the required registry entry, on all Exchange servers where ECM Agent is installed:
- Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ExchangeServer\v15\Pickup
- String value named: Path
- The value is the location of the Pickup folder. By default this is
  C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Pickup
Confirm that security settings allow all services to read this Registry location.
Set the status of ECM Exchange Agent to Installed/Bypass.
Set the status to Installed/Enabled.

Some customers have created a GPO setting to ensure the Registry entry always exists.

Notes:

On “test” Exchange Server systems without a full Microsoft Exchange license, it has sometimes been observed that CU installation may not start the Exchange services in order or in a timely way. On test systems you may need to manually start Exchange services.

What directories need to be excluded from resident virus scanning and regular backups?

Charles Creegan — Wed, 10 May 2023 00:55:38 GMT

This article applies to:

MailMarshal (SEG)
MailMarshal ECM/MailMarshal Exchange
WebMarshal

Question:

What directories need to be excluded from resident virus scanning and regular backups?

Information:

Note: It is essential that the listed working directories are excluded from resident scanning as well as regular backups. The services are expecting temporary files to be in a certain place and available.
It may also be necessary to exclude applications such as the product Engine and 7zip from interference.

While the LevelBlue products are designed to warn about the presence of traditional scanners, some new technology scanners may not be detected because they only react to specific activities.
If an outside application is interfering with Marshal temporary files the Marshal services will be affected.

Services might halt.

Temporary files might not be deleted as expected, resulting in later issues that can be very difficult to trace.
For background information about this requirement, see LevelBlue Knowledgebase article Q21197.

If you are using Bitdefender for Marshal 1.1 see also the information in the related article below.

To learn how to exclude directories from scanning, consult the documentation for your virus scanner.

Note that this article only covers the requirements for supported product versions.

SEG 8.X and above

Note: These exclusions must be placed on the Array Manager and any Processing Nodes. Some of these folders will not exist on a standalone Array Manager.
Default Install path:

C:\Program Files\Trustwave\Secure Email Gateway\
Directories to be excluded (The exclusion should apply to all subfolders as well):

%InstallPath%\Logging (Only exclude for Backups. Exception: if your backup software has the ability to exclude files that are less than a day old, you can allow backup of this folder)

%InstallPath%\Quarantine (Only exclude for AV software, not Backups)

%InstallPath%\Queues

%InstallPath%\Unpacking

%InstallPath%\SpamProfiler (Exclude from Backups; exclude from AV scanning if your scanner alerts on this folder)

MailMarshal Exchange 7.X:

Note: These exclusions will need to be placed on the Array Manager and any MailMarshal nodes. Some of these folders will not exist on a standalone Array Manager.
Default Install path:

C:\Program Files (x86)\Marshal\M86 MailMarshal Exchange
Directories to be excluded (The exclusion should apply to all subfolders as well):

%InstallPath%\Logging (Only exclude for Backups. Exception: if your backup software has the ability to exclude files that are less than a day old, you can allow backup of this folder)

%InstallPath%\Quarantine (Only exclude for AV software, not Backups)

%InstallPath%\Unpacking

WebMarshal 7.X:

Note: These exclusions should be placed on the Array Manager and any processing servers (nodes). Some of these folders will not exist on a standalone Array Manager.
Default Install path (64 bit):

C:\Program Files\Trustwave\WebMarshal\
Directories to be excluded (The exclusion should apply to all subfolders as well):

%InstallPath%\Logging (Exclude from backups only. If your backup software has the ability to exclude files that are less than a day old, you can allow backup of this folder)

%InstallPath%\Temp

In version 6.5 and above, the location can be customized. See article Q12249.

%InstallPath%\Node\ (For processing servers - Exclude from virus scanning. Policy related files in this location may contain material that scanners see as "suspicious URLs", since WebMarshal is itself configured to check for these same URLs.)

%InstallPath%\ArrayManager\ (For Array Manager - Exclude from virus scanning. Policy related files in this location may contain material that scanners see as "suspicious URLs", since WebMarshal is itself configured to check for these same URLs.)

Notes:

For the Nod32 virus scanner, specify directories using the 8.3 legacy naming format (for instance, c:\progra~1\marshal).

This article was previously published as:: NETIQKB40812

How do I move the Array Manager component to another server?

Charles Creegan — Sun, 19 Mar 2023 22:25:27 GMT

This article applies to:

MailMarshal (SEG)
MailMarshal ECM/MailMarshal Exchange 7.X

Question:

How do I move the Array Manager component to another server?

Procedure:

For more detailed steps, see the documents available on the SEG and ECM documentation pages.

Additional steps are required in MailMarshal (SEG) 10.0 and above
For arrays in MailMarshal SPE installations, a Registry entry is required. See article Q14198.

Summary of Steps:

On the machine that is currently the Array Manager, open the Configurator/Management Console and export the configuration.
- Note: If the configuration includes large User Groups that are not imported from connectors (such as harvested external groups), you should consider pruning these groups first. See article Q21028.
- For a list of other items you may need to back up and move, see the User Guide for your product version.
If you are wanting to move the SQL database(s) to a new SQL instance, follow the steps in LevelBlue Knowledgebase article Q10410: How do I move my SEG, ECM, or MailMarshal SQL database to a new server?
Stop services on the old Array Manager.
On the machine that is to be the new Array Manager, run the MailMarshal or ECM installer. This must be the same version (all four numbers, such as 10.0.0.1428) as the current installation.
Choose the option to install the Array Manager only.
At the Database selection screen choose a new temporary database. Do not use the database currently used by your existing Array Manager.
- For MailMarshal 10.0 and above, two temporary databases are required (Configuration Service and SEG).
Open the MailMarshal or ECM Configurator/Management Console. Complete the initial wizard.
For MailMarshal 10.0 and above, close the Management Console, then open the MailMarshal SEG Configuration Service Admin Tool and change the Database setting to use the production Config Service database used by the old Array Manager. Recycle the Config Service website app pool.
Open the MailMarshal or ECM Configurator/Management Console. Import the configuration exported in step 1 above.
- Configurations that include large user groups can take many hours to import.
- To avoid user interface timeouts in MailMarshal 10.0 and above, large configurations should be imported using the MMExportCfg command line tool.
If you are using a custom database retention period, set this period.
- The database retention period is not included in configuration backup. If not set it reverts to the default 100 days.
Commit the configuration (Reload the rules).
Open the Server Tool (found in the Start Menu program group) and change the database location to the database used by the old Array Manager.
- Also update the location of the Syslog database if configured.
On each processing node, use the Server Tool to rejoin the array.
Use the SQL Management Studio to delete the temporary database(s) created in step 6 above.
On the old Array Manager server, run the MailMarshal or ECM setup program and remove the Array Manager component. If prompted for the location of Array Manager, enter the name or IP address of the new Array Manager.

Notes:

The new Array Manager server must be clean of any MailMarshal or ECM components. Ensure that any MailMarshal or ECM services, or Configurator and Console, are removed prior to installing the Array Manager.

This article was previously published as:: NETIQKB43080

How do I move my quarantined email to a new node (SQL Method)?

Charles — Sun, 19 Mar 2023 22:21:40 GMT

This article applies to:

MailMarshal (SEG)
MailMarshal ECM/MailMarshal Exchange 7.X

Question:

How do I move my quarantined email to a new node ?
How do I migrate email processing nodes?
I am moving MailMarshal to a new server and need to preserve the mail on the current server

Background:

MailMarshal stores archived and quarantined email in files on the servers that process email (standalone server, or email processing nodes of an array). MailMarshal indexes these files in the SQL database.

If you move to a new server, to preserve the quarantined and archived email you must move the files. You must then make changes so that MailMarshal can find the files in their new location.

There are two documented methods for moving quarantined email to a new server. The method described in this article involves manipulating SQL table entries. Another method, described in Q10412, involves renaming your quarantined email.

This SQL method is significantly faster, but can only be used if the new node has not yet processed any messages.

Most customers use the method described in Q10412.

Procedure:

This procedure assumes that you have already installed the MailMarshal software on the new node. For array installation, during installation you will have joined the new node to the array.

Notes:

This procedure works by changing the ID of the new server (within the MailMarshal array) so it appears as the old server. The new node must not be used to process messages until after this procedure is complete. If quarantined mail is already present on the new node, see the procedure described in Q10412.

To install a new email processing node AND retain quarantined messages from the email processing node that is being removed, follow each procedure below.

Before you start, determine the Server ID of the old and new nodes. In supported versions of the product, you can find the Server ID and match it to the Server Name of each node in the MailMarshal Configurator > Servers pane or MailMarshal (SEG) 10 Management Console > Mail Servers list.

For versions below 7.2, see the notes at the end of this article.

Transfer quarantined mail

Stop all MailMarshal services on the email processing node that will be removed.
Stop all MailMarshal services on the new email processing node.
Move all of your quarantined email to the target node. The quarantined email is stored, by default in {install}\Quarantine, and within the Quarantine folder we see subfolders with GUID names (naming format is xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx). Move this entire GUID folder structure to an equivalent location on the target Node.

Update Node ID

For version 10.0 and above:

On the new node, edit the file controller.config.json
Change the value of NodeID to the oldNodeId value that you have previously found.

For earlier versions:

Edit the Registry and navigate to the SEG Node key:
- In version 8.X: HKEY_LOCAL_MACHINE\SOFTWARE\Trustwave\Secure Email Gateway\Node
- For full details of the location for each product version, see article Q10832.
Change the value of the NodeId DWORD (integer) to the oldNodeId value that you have previously found.

Update SQL Data

Make changes to SQL data and apply the changes.

On your SQL Server, open SQL Server Management Studio.
Select the MailMarshal database from the drop-down list.
In the SQL pane, enter the following:
DECLARE @nServerName  varchar(32), @nDescription  varchar(256), @nLocation  varchar(128), @nTimeZoneOffset  int, @nTimeZoneName  varchar(128), @nProductVersion  varchar(50), @nOSVersion  varchar(128)

SELECT @nServerName  = ServerName, @nDescription  = Description, @nLocation  = Location, @nTimeZoneOffset  = TimeZoneOffset, @nTimeZoneName  = TimeZoneName, @nProductVersion  = ProductVersion, @nOSVersion  = OSVersion FROM Server WHERE ServerID =newNodeId

UPDATE Server SET ServerName = @nServerName, Deleted  = 0, Description = @nDescription, Location  = @nLocation, TimeZoneOffset = @nTimeZoneOffset, TimeZoneName = @nTimeZoneName, ProductVersion = @nProductVersion, OSVersion = @nOSVersion WHERE ServerID =oldNodeId

UPDATE Server SET Deleted = 1 WHERE ServerID =newNodeId

GO
Replace oldNodeId with the value of the NodeId DWORD from the old email processing node.
Replace newNodeId with the value of the NodeId DWORD originally discovered on the new email processing node.
Execute the query. You should see "The command(s) completed successfully" in the result pane.
Restart the MMArrayManager service on the Array Manager using the MailMarshal Server Tool.
Commit the configuration changes.
Restart all MailMarshal services on the new email processing node.

The migration to the new email processing node should be complete at this point. You can view all quarantined mail and process email normally using the new email processing node.

Notes:

Determining Server ID in MailMarshal versions below 7.2:

The Registry locations mentioned in this section apply to 32 bit installation of MailMarshal SMTP 6.8. For details of the default locations for each MailMarshal version, see LevelBlue Knowledgebase article Q10832 (SEG/SMTP) or Q14003 (ECM/Exchange)

Old Node ID: Perform these steps on the old server, or the email processing node that is being removed.

Open the Registry Editor.
Navigate to the following registry key:
HKEY_LOCAL_MACHINE\Software\Marshal\MailMarshal\Node
Note the value of the NodeId DWORD entry. This will be the oldNodeId.

New Node ID: Perform these steps on the new server, or new email processing node.

Open the Registry Editor.
Navigate to the following registry key:
HKEY_LOCAL_MACHINE\Software\Marshal\MailMarshal\Node
Note the value of the NodeId DWORD entry. This will be the newNodeId.

This article was previously published as:: NETIQKB44812

Software Version	Release Date	Support Status	End of Support	End of Threat Protection Updates
11.3.0.7659	December 2, 2025	Active
11.2.0.7413	September 4, 2025	Active
11.1.0.6958	May 29, 2025	Active
10.2.5.7024	June 5, 2025	Active
10.2.5.6043	September 10. 2024	Active
10.2.0.5718	July 2, 2024	Active	June 1, 2026	June 1, 2026
10.1.0.5102	April 3, 2024	Active	June 1, 2026	June 1, 2026
10.1.0.5089	March 28, 2024	Withdrawn	April 3, 2024
10.0.7.3979	September 29, 2023	Active	June 1, 2026	June 1, 2026
10.0.7.3969	September 12, 2023	Withdrawn	September 29, 2023
10.0.6.3739	February 28, 2023	Discontinued	February 1, 2025	June 1, 2025
10.0.5.3470	August 31, 2022	Discontinued	February 1, 2025	June 1, 2025
10.0.4.3361	May 16, 2022	Discontinued	February 1, 2025	June 1, 2025
10.0.3.2387	July 6, 2021	Discontinued	February 1, 2024	December 31, 2024
10.0.2.2230	April 28, 2021	Deprecated	July 6, 2021	December 31, 2024
10.0.1.2030	November 3, 2020	Discontinued	September 1, 2022	December 31, 2024
10.0.0.1428	April 14, 2020	Deprecated	November 3, 2020	December 31, 2024
8.3.2.11492	September 29, 2023	Active	August 1, 2025	December 31, 2025
8.2.6.11305	December 22, 2020	Discontinued	February 1, 2025	June 1, 2025
8.2.4.11170	October 31, 2019	Discontinued	March 31, 2022	December 31, 2024
8.2.3.11111	July 2, 2019	Discontinued	March 31, 2021	December 31, 2024
8.2.2.11949	February 14, 2019	Discontinued	March 31, 2021	December 31, 2024
8.2.1.11863	December 14, 2018	Discontinued	March 31, 2021	December 31, 2024
8.2.0.11849	December 6, 2018	Withdrawn	December 14, 2018	December 31, 2024

LevelBlue Knowledge Base » Knowledgebase » Email Content Manager

Latest versions of Unpacker and Filetype for MailMarshal (SEG) and ECM

This article applies to:

Question:

Information:

Latest File Versions

MailMarshal (SEG) Supported Versions

MailMarshal (SEG) Older Versions

ECM

What versions of MailMarshal (SEG), ECM, and SES are currently supported by LevelBlue Technical Support?

This article applies to:

Question:

Information:

MailMarshal (SEG)

MailMarshal ECM (formerly MailMarshal Exchange)

MailMarshal Secure Email Server (SES)

Notes:

What file types are recognized by MailMarshal (SEG) and ECM?

This article applies to:

Question:

Information:

Archive

Azure IRM Protected Documents

Document

Drawing

Encrypted

Executable

Font

Image

Mail Components

Other

Sound

Video

Web Browsing

Non-Selectable Types

Notes:

Excluding some users from digest notifications

This article applies to:

Question:

Procedure:

Note:

SQM or Customer Console "Remember Me" not working

This article applies to:

Symptoms:

Causes:

Resolution:

Notes:

Why are message digests incorrectly being delivered to external addresses?

This article applies to:

Question:

Information:

Procedure:

Self-Management option:

Notes:

How do I delete an entire folder from the MailMarshal Console?

This article applies to:

Question:

Procedure:

Note:

How to use the Support Tool for SEG, ECM, WebMarshal or MRC

This article applies to:

Question:

Information:

Installation

Using the tool

The fields on the window are defined as follows:

Items to gather

Output

Notes:

How do I automatically save a file or attachment from a mail message?

This article applies to:

Question:

Procedure:

How do I notify LevelBlue of new Spam so MailMarshal files can be updated?

This article applies to:

Question:

Before you start:

Procedures

Spam that was not identified:

Microsoft Report Button