Hi All, I'm having annoying problem in Microsoft Exchange Server 2007 SP1 RU 3 with the Forefront Security for Exchange Server SP1 All of the user in my domain could not send any files to anywhere if it is larger than 2 MB (from inside - Inside, inside to outside) and the following error message generated to the Administrator (which is myself). -----Original Message----- From: ForefrontServerSecurity@ExchangeServer2007.com [mailto:ForefrontServerSecurity@ExchangeServer2007.com] Sent: Friday, 25 September 2009 4:50 PM To: Administrator Subject: Microsoft Forefront Server Security transport scan encountered an error Microsoft Forefront Security transport scan had a problem processing the message, From: administrator@domain.com To: Administrator@gmail.com; Subject: Testing ? The message has been archived and purged. I've double check in the following area: Exchange Server: Outgoing connector max. size limit: 20 MB Receiving connector max. size limit: 20 MB FFSE: Max Container size: 26214400 bytes is there any way to diagnose the email flow ? Thanks. /* Windows Infrastructure Support Engineer */

Is there any error event in the application log after reproduced the issue? Please run ExBPA against the exchange servers for health check Please disable FSE on the exchange server to determine if the issue was caused by FSE (Reference)

You should probably check the the log file to see if a ScanTimeExceeded virus has been reported. If so, I think this issue is related to a scan timeout rather than simply the size of the file. You may increase the value of Max Container Scan Time (msec) - Realtime/Transport, the default value is two minutes. It may be that the files you are using for testing are taking more than two minutes to scan.

Yes, you're right, there are soo many reports about scan time exceeded.But this is very annoying because I can't even send any attachment larger than 3 MB in any types to anywhere :-|/* Windows Infrastructure Support Engineer */

So,was the issue caused by FSE?

Yes it is and now I'm getting different error message like the following: FILE QUARANTINED The original contents of this file have been replaced with this message because of its characteristics. File name: 'winmail.dat->p3008-SCHEME-SRS01-Iss3.5a.doc.zip->p3008-SCHEME-SRS01-Iss3.5a.doc' Virus name: 'CorruptedCompressedFile' how come all in a sudden attachment could not be transferred in the email traffic ?/* Windows Infrastructure Support Engineer */

Please see KB 953956, and as the issue is related to FSE, please use forefront server for exchange forum which would be the right place for the question