[Fix] Microsoft Exchange Server Email Messages Stuck in Transport Queues

Starting year 2022, Microsoft Exchange Server users are facing problems with email messages delivery. All email messages are stuck in transport queues. Microsoft has acknowledged the issue and provided an official workaround to fix the issue.

PROBLEM DESCRIPTION AND REASON:

Microsoft Exchange Servers are having an issue causing messages to be stuck in transport queues on Exchange Server 2016 and Exchange Server 2019. The problem relates to a date check failure with the change of the new year. Microsoft has mentioned that the issue is not a failure of the AV engine itself. This is not an issue with malware scanning or the malware engine, and it is not a security-related issue. The version checking performed against the signature file is causing the malware engine to crash, resulting in messages being stuck in transport queues.

The problem occurs due to a latent date issue in a signature file used by the malware scanning engine within Exchange Server. When the issue occurs, you’ll see errors in the Application event log on the Exchange Server, specifically event 5300 and 1106 (FIPFS), as shown below:

PROBLEM SOLUTION:

Microsoft has provided a temporary fix to resolve the issue immediately. You can implement the fix automatically using a scan engine reset script provided by Microsoft or manually using the steps given below. Whether you perform the steps automatically or manually, they must be performed on every Exchange 2016 and Exchange 2019 server in your organization. If you use the automated script, you can run it on multiple servers in parallel. Microsoft recommends starting with the servers in your environment that have the largest queues. You can use Get-Queue to view queue size and determine which queues are the largest.

A. AUTOMATED SOLUTION:

First download the script provided by Microsoft using following link:

Download Scan Engine Reset Script

Run the script on each Exchange server in your organization. You can run this script on multiple servers in parallel.

B. MANUAL SOLUTION:

To manually resolve this issue, you must perform the following steps on each Exchange server in your organization:

1. Remove existing engine and metadata

• Stop the Microsoft Filtering Management service. When prompted to also stop the Microsoft Exchange Transport service, click Yes.
• Use Task Manager (Ctrl+Shift+Esc) to ensure that updateservice.exe is not running.
• Delete the following folder: %ProgramFiles%\Microsoft\Exchange Server\V15\FIP-FS\Data\Engines\amd64\Microsoft.
• Remove all files from the following folder: %ProgramFiles%\Microsoft\Exchange Server\V15\FIP-FS\Data\Engines\metadata.

2. Update to latest engine

• Start the Microsoft Filtering Management service and the Microsoft Exchange Transport service.
• Open the Exchange Management Shell, navigate to the Scripts folder “%ProgramFiles%\Microsoft\Exchange Server\V15\Scripts” and run Update-MalwareFilteringServer.ps1 <server FQDN> command.

3. Verify engine update info

• In the Exchange Management Shell, run Add-PSSnapin Microsoft.Forefront.Filtering.Management.Powershell command.
• Run Get-EngineUpdateInformation and verify the UpdateVersion information is 2112330001.

After following above mentioned solutions, the mail flow should be working fine and FIPFS error events should no longer aappear in the Application event log.

Microsoft is working on a fix that would eliminate the need for customer action, but it might require several days to develop and deploy.

Also Check:

Why Outlook Adding “Safelinks.Protection.Outlook.Com” to All URLs in Your Emails and How to Disable it?