So Welcome on one of the many technical blogs out there on the web. So what is special about this blog? Well absolutely nothing :) ... This is the place where I store handy information I don't want to forget, while hoping that in the process I'm also helping some other poor soul on the web that is facing similar issues, or is interested in similar topics.
So who am I?
My name is Mark Priem, I was build in 1981 and live in the Netherlands together with my two sons, Roan and Levi, and my Wife Mylene (note the capital W... You know who's boss now), who I all love to death.
Aside from spending as much time as possible with my family I enjoy sports and socializing face to face and online. Your average Joe right? The little time that is left I spend on technology; My main focus currently is SharePoint and cloud solutions, which I work with on a daily basis as part of my Job, Consultant at Microsoft. As I'm a Microsoft Certified Master in SharePoint 2010 I think I can say I know a thing or two about SharePoint, which I hope has a positive effect on the quality of my posts.
If however you find any misinformation or plain wrong content, please let me know. We all make mistakes right? :)
Please enjoy your stay and let me know what you think by commenting to my posts.
Thanks!
Mark
Op verschillende plaatsen heb ik meldingen gelezen over bedrijven die last hebben van eventid 9874:Event Type: WarningEvent Source: MSExchangeISEvent Category: Virus ScanningEvent ID: 9874Date: 3/17/2008Time: 12:23:57 PMUser: N/AComputer: <servername>Description:Unexpected error 0x50a occurred in "EcProcessVirusScanQueueItem" during virus scanning.Mailbox Database: /o=<orgname>/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Configuration/cn=Servers/cn=<servername>/cn=Microsoft Private MDBFolder ID: 1-24Message ID: 1-D616AA3D
Event Type: WarningEvent Source: MSExchangeISEvent Category: Virus ScanningEvent ID: 9874Date: 3/17/2008Time: 12:23:57 PMUser: N/AComputer: <servername>Description:Unexpected error 0x50a occurred in "EcProcessVirusScanQueueItem" during virus scanning.Mailbox Database: /o=<orgname>/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Configuration/cn=Servers/cn=<servername>/cn=Microsoft Private MDBFolder ID: 1-24Message ID: 1-D616AA3D
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Dit event heeft te maken met dat Forefront bepaalde instellingen in het register niet goed kan verwerken. In mijn geval had het te maken met Background scanning opties die niet aanwezig waren in [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeIS\VirusScan].
Dit is de juiste inhoud van de key voor een server met alleen de mailboxrole (De ontbrekende DWORDS zijn vet gedrukt):
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeIS\VirusScan]"Library"="C:\\Program Files (x86)\\Microsoft Forefront Security\\Exchange Server\\FSEVsapiEx.dll""BackgroundScanning"=dword:00000000"ProactiveScanning"=dword:00000000"ScanRTF"=dword:00000001"ScanTimeout"=dword:00000258"EnableScanDeletion"=dword:00000001"OnAccessScanningRollingLowerAgeLimit"=dword:00360d80"ReloadNow"=dword:00000000"Enabled"=dword:00000001"OnAccessThresholdVersion"=dword:00000001"BackgroundScanningIgnoreStamp"=dword:00000001"BackgroundScanningOnlyUnscanned"=dword:00000001"BackgroundScanningAttachmentMessagesOnly"=dword:00000001
Dit kwam omdat de Background scanning job een keer gedraaid moet hebben om deze key op de juiste manier te vullen. Dit doe je door in Forefront het schedule voor de background scanning job aan te passen dat de job in ieder geval 1 keer draait.
Microsofts best practice is om deze job wekelijks te draaien en dan alleen unscanned berichten te scannen, ontvangen in de laatste week, met attachment.