Shortly after midnight on 1 January 2022, Exchange Server 2016 and 2019 stopped delivering mail worldwide. Messages piled up in the transport queues and the event log showed “Can’t convert ‘2201010001’ to long” from the FIP-FS scanning engine. The malware engine’s new version number (starting with 22) no longer fitted in the field Exchange used to store it – a “Y2K22” bug.
Workaround: get mail flowing again
In the Exchange Management Shell, bypass malware filtering on each mailbox server and restart transport:
Set-MalwareFilteringServer -Identity u003cServerNameu003e -BypassFiltering $truenRestart-Service MSExchangeTransportQueued messages start delivering within minutes. Mail is now not scanned for malware on the server, so treat this as temporary.
Permanent fix
- Download Microsoft’s Reset-ScanEngineVersion.ps1 script from the Microsoft Exchange Team’s guidance for this issue.
- Run it in an elevated Exchange Management Shell on every mailbox server (it stops services, removes the bad engine files and downloads a corrected engine).
- Turn malware filtering back on and restart transport:
Set-MalwareFilteringServer -Identity u003cServerNameu003e -BypassFiltering $falsenRestart-Service MSExchangeTransportCheck the result
Run Get-EngineUpdateInformation – the engine version should now start with 2112330001 and mail should flow with filtering on. Keep Exchange on a supported Cumulative Update so fixes like this arrive quickly.
Background reading: BleepingComputer’s report on the Exchange 2022 bug.
Geschrieben von
Inder Kochar
System- & Netzwerkingenieur – Ich schreibe die Lösungen auf, die ich bei Kunden einsetze – getestet auf echten Systemen. Hängen Sie an etwas Ähnlichem fest?
