A hotfix has been released by Microsoftfor a 2022 bug that breaks email delivery on on-premises Microsoft Exchange servers.
See also: Hackers steal Microsoft Exchange credentials using IIS module
As the year turned and the clock struck midnight, Exchange administrators around the world discovered that their servers were no longer delivering email. Upon investigation, it was determined that mail was getting stuck and the Windows event log was showing some kind of error.
These errors are caused when Microsoft Exchange checks the version of the FIP-FS antivirus scanning engine and tries to store the date in a signed int32 variable.
However, this variable can only store a maximum value of 2,147,483,647, which is less than the new date value of 2,201,010,001 for January 1, 2022, at midnight.
Because of this, when Microsoft Exchange attempts to check the AV scan version, it will generate an error and cause the malware engine to crash.
"The version check performed against the signature file causes the malware engine to crash, resulting in messages getting stuck ," Microsoft explained in a blog post.
See also: Microsoft is testing a new “Games” panel in the Edge browser
Microsoft has released a temporary fix that requires user action when processing an update that automatically fixes the issue.
This fix comes in the form of a PowerShell named “Reset-ScanEngineVersion.ps1“. When executed, the script will stop the Microsoft Filtering Management and Microsoft Exchange Transport services, delete older AV engine files, download the new AV engine, and restart the services.
To use the automated script to apply the patch, you can follow these steps on each on-premises Microsoft Exchange server in your organization:
- Download the Reset-ScanEngineVersion.ps1 script from https://aka.ms/ResetScanEngineVersion.
- Open an elevated Exchange Management Shell.
- Change the execution policy for PowerShell scripts by running Set-ExecutionPolicy -ExecutionPolicy RemoteSigned.
- Run the script.
- If you previously disabled the scanning engine, enable it again using the Enable-AntimalwareScanning.ps1 script.
See also: How to enable Dark Mode in Microsoft Outlook?
Microsoft warns that this process may take a while, depending on the size of the organization.
Microsoft has also provided steps that administrators can use to update the scanning engine manually.
After running the script, Microsoft says emails will start being delivered again, but it may take a while to complete, depending on the volume of email that was stuck.
