FSE can be used to filter specific file types from e-mail messages.  This is helpful if you want to prevent users from sending executable files, music files, movie files, or other unwanted files through e-mail.

To create and configure a file filter to remove specific file types in Forefront Security for Exchange Server: 

  1. In the Shuttle Navigator click FILTERING, and then click the File icon. The File Filtering pane appears.

  2. In the upper work pane, select the scan job for which you would like to create the file filter. (Manual scan, Transport scan, Realtime scan)

  3. Create the filter * (the asterisk symbol) and set the File Types selection to the exact file type you want to filter.

    For example: Create the filter * and set the File Types to MP3. This ensures that all MP3 files are filtered no matter what their file name or extension.

    Note: One advantage of setting a generic * filter and associating it with a certain file type (for example, EXE) is that it prevents the potential of users bypassing the filter by simply changing the extension of a file.

  4. Ensure that the File Filter is set to Enabled. It is enabled by default.

  5. Indicate the Action to take if there is a filter match. (Skip: detect only, Delete: remove contents, Purge: eliminate message, or Identify: tag message. The "Identify" option is only available for filters enabled for the Transport scan job.) 

  6. Indicate whether to Send Notifications for the selected file name. This does not affect reporting to the Incidents log. In addition, you must also configure the notifications. It is disabled by default.

  7. Indicate whether to Quarantine Files for the selected file name. It is enabled by default. Enabling quarantine causes deleted attachments and purged messages to be stored, making it possible for you to recover them. However, worm-purged messages are not recoverable.

  8. Optionally, you can specify Deletion Text, which is used to replace the contents of an infected file during a delete operation. The default deletion text informs you that an infected file was removed, along with the name of the file and the name of the filter. To create your own custom message, click Deletion Text.

  9. Click Save to save your filter.

For more information about file filters, please refer to the FSE File Filtering topic on TechNet: http://technet.microsoft.com/en-us/library/bb795068.aspx