Content filtering rule with user conditions does not apply as expected during Manual or Scheduled scans with Symantec Mail Security for Microsoft Exchange
Last Updated July 03, 2014
When running a scan of the mail store, a content filtering rule that should only apply to a specific user may not work as expected when another user has a name which contains the specific users name nested within it in a contiguous manner.
Symptoms Content filtering rules configured to look for specific users do not match correctly against emails that match the conditions of the rule.
For example, after creating a content filtering rule to look for the word "Test" in the subject line of the message and setting a condition to only apply if the sender of the message is in the list on the 'Users' tab of the rule, and add "email@example.com" to the list, then run a manual/scheduled scan of a mailbox that contains a message matching both conditions, the rule does not apply if there is another user in the Active Directory Global Address List similar to "firstname.lastname@example.org", such as "email@example.com".
Occurs only during a manual or scheduled scan.
Active directory global address list contains another user with a very similar name to the user you are trying to match against.
When querying Active Directory to resolve Sender or Recipient addresses, Symantec Mail Security for Microsoft Exchange (SMSMSE) will use a "contains" type query, instead of an "equals" type query.