David Overton's Blog and Discussion Site
This site is my way to share my views and general business and IT information with you about Microsoft, IT solutions for ISVs, technologists and businesses, large and small. I specialise in Windows Intune and SBS 2008.
This blog is purely the personal opinions of David Overton. If you can't find the information you were looking for e-mail me at admin@davidoverton.com.

To find out more about my Windows Intune BOOK - Microsoft Windows Intune 2.0: Quickstart Administration click here

To find out more about my SBS 2008 BOOK - Small Business Server 2008, Installation, Migration and Configuration click here

SBS 2008 Forefront Virus protection for e-mail Errors or Warnings - “At least one of the engines enabled for update has not been updated in the last week” – how to solve
David Overton's Blog

Buy my books

Windows Intune:Quickstart Administration

This is the RAW book (Read as Written).
Click here for more information
Buy or pre-order today

SBS 2008 - Installation, Migration and Configuration

Small Business Server 2008 – Installation, Migration, and Configuration

Buy today in book or e-book form

Request a Review Copy



My SBS 2008 installation is pretty good, but one area I’ve noticed some problems was with ForeFront.  I either had errors or at best warnings all the time about the scan engines.  I would go and hit a manual update, but the bar would be 30-90% across and suddenly stop.

failure to update engines


When I looked in the event log I could see errors like these below.


Searching the internet delivered me the KB article http://support.microsoft.com/kb/939411/en-us which talks about timeout issues, however even with the recommended change things did not resolve themselves.

Source:        GetEngineFiles
Event ID:      6014
Level:         Error
Microsoft Forefront Server Security encountered an error while performing a scan engine update.
   Scan Engine: AhnLab
   Update Path: http://forefrontdl.microsoft.com/server/scanengineupdate/x86/AhnLab
   Proxy Settings: Disabled
   Error Code: 0xC0001F58
   Description: The operation timed out.


Source:        Microsoft Forefront Security
Event ID:      7003
Level:         Warning
Not all of the selected engines enabled for updates successfully updated at the last attempt


Source:        GetEngineFiles
Event ID:      6012
Level:         Error
Microsoft Forefront Server Security encountered an error while performing a scan engine update.
   Scan Engine: Kaspersky5
   Error Code: 0x80070102
   Description: Unable to acquire the scan engine update mutex within the designated timeout period.


The fix was to realise that the timeout value in the KB was still too slow.  The KB recommended creating a DWORD called EngineDownloadTimeout in HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Forefront Server Security\Exchange Server and setting the value to 600 decimal for 10 minutes.  I’ve now set mine to 900 (384 hex) for 15 minutes and finally all the updates have succeeded.

While the console has not shown the change just yet, looking at the events in the event log show that indeed everything is now up to date.




Posted Sun, Dec 21 2008 2:18 PM by David Overton

Add a Comment

Remember Me?

(c)David Overton 2006-13