Forefront’s TechNet site covers the common registry keys but I wanted to provide a little (very little) information about some not-so-common registry keys. By default, these keys will be listed under the Exchange Server folder within the following registry values:
32-bit: HKLM\Software\Microsoft\Forefront Server Security\ 64-bit: HKLM\Wow6432Node\Software\Microsoft\Forefront Server Security\
Advanced Logging Registry Keys
These keys are related to advanced logging when troubleshooting Forefront issues. However, by enabling these keys, there is a performance hit that could impact how quickly email is processed by Forefront.
Engine Timeout Keys (often related to event 6014)
Other Registry Keys
Good Luck Doug