Forefront’s TechNet site covers the common registry keys but I wanted to provide a little (very little) information about some not-so-common registry keys.  By default, these keys will be listed under the Exchange Server folder within the following registry values:

32-bit: HKLM\Software\Microsoft\Forefront Server Security\
64-bit: HKLM\Wow6432Node\Software\Microsoft\Forefront Server Security\

 

Advanced Logging Registry Keys

These keys are related to advanced logging when troubleshooting Forefront issues.  However, by enabling these keys, there is a performance hit that could impact how quickly email is processed by Forefront.

  • EventLogTraceCategory (Set to “2”)
  • TextFileTraceCategory (Set to “2”)
  • TraceEventLog (setting of 0 = off)
  • TraceTextWriter (setting of 0 = off)

Engine Timeout Keys (often related to event 6014)

  • EngineDownloadTimeout – Controls the time it takes to download engines (default is 300 sec – 5min)
  • GetFileHTTPTimeout – Controls timeout value for WinHttp calls

Other Registry Keys

  • DisablePurgeOnMultipleScanFailures – Used as a means to get around memory error deletions that might occur on Forefront.  Consult with Microsoft Support prior to implementing.
  • DoNotScanIPMReplicationMessages - Setting this DWORD registry key to 1 prevents the Transport Scan Job from scanning IPM (Public Folder) replication messages
  • ExpirationNotifications - Setting to 0 turns Expiration Notifications off (default is 1 - on)
  • InternetTimeout - Used to prevent timeouts during Transport scanning (http://technet.microsoft.com/en-us/library/bb795154.aspx)

Good Luck
Doug