Getting the Kaspersky Engine to Successfully Update in Forefront Security for Exchange
For the most part, the AV engines in Forefront Security for Exchange update without issues. But occassionally, I see event ID 6014 in the application event log, which say:
Event Type: Error
Event Source: GetEngineFiles Event
Category: Engine Error
Event ID: 6014
Date: 2/7/2009
Time: 10:53:00 PM
User: N/A
Computer: troy-email2
Description: Microsoft Forefront Server Security encountered an error while performing a scan engine update. Scan Engine: Kaspersky5 Update Path: http://forefrontdl.microsoft.com/server/scanengineupdate/x86/Kaspersky5 Proxy Settings: Disabled Error Code: 0xC0001F58 Description: The operation timed out.
When trying to update the engine manually from within the Forefront console, the same problem happens – the update fails to finish in a timely manner. Eventually, we see event ID 7006, which says:
Event Type: Error
Event Source: Microsoft Forefront Security
Event Category: Health Status
Event ID: 7006
Date: 2/7/2009
Time: 10:51:59 PM
User: N/A
Computer: troy-email2
Description: At least one of the engines enabled for updates has not been updated in the last week. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
I’ve seen this enough on both Hub Transport and Edge Transport servers to go diving for a solution. Fortunately, we can extend the timeout period so that the engine can be updated. Here’s how:
Open the trusty regedit on the server and navigate to
HKLM\SOFTWARE\Wow6432Node\Microsoft\Forefront Server Security\Exchange Server
Create a new DWORD, “EngineDownloadTimeout“. Give it a decimal value of 600. Close regedit. No service or server restarts are necessay. This increases the timeout from the default of 5 minutes to 10 minutes. My testing has shown that this is long enough for the Kaspersky engine to update successfully. You can force an update in Forefront by opening the Forefront Server Security Administrator console, and going to Settings>Scanner Updates. Highlight the Kaspersky Antivirus Technology engine, and click Update Now. Or, you can just wait for the next update cycle.
Follow Me