System administrators looking at Microsoft Exchange servers probably haven’t had the best start to the year. This is because there was a massive date processing failure issue because the new chosen value “2.201.010.001” exceeds what the servers are able to process under the current Int32 data type. As a result, the malware check engine crashes and as a result, emails and messages got stuck in transport queues on Exchange 2016 and 2019 servers with event log errors of application 5300 and 1106 (FIPFS).
Microsoft said it is aware of the problem and is working on a fix.
We are aware of and are working on an issue causing messages to hang in transport queues on Exchange Server 2016 and Exchange Server 2019.
[…] We are actively working to resolve this issue and plan to post details on how to resolve this issue later today.
The company kept its promise and posted a resolution to the issue. It provided both an automated scan engine reset script solution as well as a manual entry solution.
First, we have the scan engine auto reset script (available at https://aka.ms/ResetScanEngineVersion). It can be run in parallel on multiple servers. Successful completion of the script should give the following output:
[PS] C:Program FilesMicrosoftExchange ServerV15Scripts>.Reset-ScanEngineVersion.ps1 EXCH1 Stopping services... EXCH1 Removing Microsoft engine folder... EXCH1 Emptying metadata folder... EXCH1 Starting services... WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to start... WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to start... WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to start... WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to start... WARNING: Waiting for service 'Microsoft Exchange Transport (MSExchangeTransport)' to start... EXCH1 Starting engine update... Running as EXCH1-DOMAdministrator. -------- Connecting to EXCH1.CONTOSO.com. Dispatched remote command. Start-EngineUpdate -UpdatePath http://amupdatedl.microsoft.com/server/amupdate -------- [PS] C:Program FilesMicrosoftExchange ServerV15Scripts>Get-EngineUpdateInformation Engine : Microsoft LastChecked : 01/01/2022 08:58:22 PM -08:00 LastUpdated : 01/01/2022 08:58:31 PM -08:00 EngineVersion : 1.1.18800.4 SignatureVersion : 1.355.1227.0 SignatureDateTime : 01/01/2022 03:29:06 AM -08:00 UpdateVersion : 2112330001 UpdateStatus : UpdateAttemptSuccessful
Then the steps for manual fix are provided for those who prefer to do a manual restore.
Remove existing engine and metadata
- Stop the Microsoft Filtering Management Service. When you are prompted to also stop the Microsoft Exchange Transport service, click Yes.
- Use Task Manager to make sure updateservice.exe is not running.
- Delete the following folder:% ProgramFiles% Microsoft Exchange Server V15 FIP-FS Data Engines amd64 Microsoft.
- Delete all the files from the following folder:% ProgramFiles% Microsoft Exchange Server V15 FIP-FS Data Engines metadata.
Update to the latest engine
- Start the Microsoft Filtering Management Service and the Microsoft Exchange Transport Service.
- Open the Exchange Management Shell, navigate to the Scripts folder (% ProgramFiles% Microsoft Exchange Server V15 Scripts), and run Update-MalwareFilteringServer.ps1.
Check engine update information
- In the Exchange Management Shell, run Add-PSSnapin Microsoft.Forefront.Filtering.Management.Powershell.
- Run Get-EngineUpdateInformation and verify that the UpdateVersion information is 2112330001.
You can find more details on the official Microsoft blog linked here.