First of all, IMF needs to be enabled because it's not by 
default. To enable, from ESM go to Global Settings and 
right click on Message Delivery. Click on the "Intelligence 
Nessage Filter" tab, and change from "No Action" 
to "Archive". Also, enable the IMF on the Virtual SMTP 
server by right clicking on the default SMTP server and 
clicking on properties, then Advanced tab, then click on 
edit. Now you can check on the "Apply IMF" tab.

There are two options in configuring Intelligence Message 
Filter (IMF):
Gateway Blocking Configuration - this is where the messages 
will be blocked at the server, and the users will not even 
see them. 

Store Junk E-mail Configuration - this is where the 
messages will be delivered to the user's Outlook and stored 
in their Junk Email folder (Outlook 2003 in cached mode 
only, or OWA).