Scan engine and signature files updates can be downloaded automatically from the Microsoft HTTP server, or from another SharePoint server running Forefront Security for SharePoint. Setting a schedule for checking the HTTP or SharePoint server for a new scan engine means that you are automatically protected against new viruses without having to check versions or manually update the files. After Forefront Security for SharePoint has automatically downloaded an updated scan engine, it automatically puts that engine to use, if you have selected it for any of the scanning jobs. During file scanner updates, only the engine being updated is taken offline. The other engines continue to scan for viruses.

You can control when your scanning engines update, how often, and the update source.

Note:
If you are using the optional Microsoft Forefront Server Security Management Console to update the scan engines, you should use the Scanner Updates work pane to disable scheduled updates.

1. In the SETTINGS section of the Shuttle Navigator, select Scanner Update. The Scanner Updates work pane appears. The top pane shows a list of all supported file scanners.

2. Select a scan engine to be scheduled. The bottom pane contains the Primary and Secondary update paths and the update schedule for the selected engine. Additionally, there is information about that engine. (For more information, see Scanner Information.)

3. Set the primary update path by clicking Primary in the bottom pane and entering a value into the Network Update Path field. By default, FSSP uses the primary update path to download updates. If the primary path fails for any reason, FSSP uses the secondary update path, if any.

   The default primary update path is http://forefrontdl.microsoft.com/server/scanengineupdate. You may change it to point to another HTTP update site. Or, if you prefer to use UNC updating as the primary update path, enter the UNC path to another SharePoint Server. For more information about UNC updating, see Distributing Updates.

   To restore the default server path, right-click in the Network Update Path field and select Default HTTP Path.

4. Set the secondary update path, if desired, by clicking Secondary in the bottom pane and entering a value in the Network Update Path field. If the primary path fails for any reason, FSSP will use the secondary update path. It is left blank by default.

   The secondary path may be set to use HTTP or UNC updating. Enter either a URL or a UNC path to another SharePoint server. For more information about UNC updating, see Distributing Updates.

5. Specify the Date to check for updates. If you choose a Frequency of Once, this date is the only time update checking will take place; otherwise, this date represents the first time update checking will take place. Click the left and right arrows on the calendar to change the month. Click a particular day to select it. (The current date is circled in red; a selected date turns blue.)

6. Set a time for the update to take place. Each of the subfields (hour, minute, seconds, and AM/PM) can be selected and set separately. You can enter a time or use the up and down buttons to change the current value of each subfield. FSSP defaults to staggering the update time, leaving an interval of five minutes between engines.

   Note:
   Do not use the Windows scheduler to set or change scan engine updating times. Changes you make in the operating system are not reflected in FSSP update scheduling. Use the Scanner Update Settings work pane only.

7. Specify how often the update occurs (the frequency). You can choose Once (update only once, on the specified date and time), Daily (update every day, at the same time), Weekly (update each week, on the same day and time), or Monthly (update each month, on the same date and time). It is recommended that you select Daily (the default), and then set a Repeat interval to update the engine at multiple times during the day.

8. Optionally indicate a repeat interval. Select Repeat, and then choose a time interval. (The minimum time is 15 minutes.) It is recommended that you check for updates at least every two hours. If a new update is not available at the scheduled time, the engine is not taken offline and no updating is done. The default is to repeat updating for each engine every hour.

9. Use the Enable and Disable buttons to control whether the update check will be performed for a selected engine. All engine updates are enabled by default. Even if you are not using a particular engine, you should schedule updates for it. That way, if you find you need to use that engine in the future, it will already be at the current update level.

Note:
Enable and Disable control updating only, and not the use of the engine. To discontinue using the engine itself, see "Configuring the Engines" in both SharePoint Manual Scan Job and SharePoint Realtime Scan Job.

When scheduling engine updates on multiple servers in your organization, it is recommended that you stagger the updates by at least five minutes, to prevent servers from timing out during the update process. When scheduling updates for multiple engines, it is also helpful to stagger the updates in five-minute intervals.

Note:
If you are using Microsoft Forefront Server Security Management Console (FSSMC) to update the scan engines, you should disable scheduled updates in Forefront Security for SharePoint.

To perform an immediate update of a selected scanner, click the Update Now button on the Scanner Updates work pane. If an update exists, Forefront Security for SharePoint will download the scanner and will start using it after the download is complete. While the engine download is in progress, the Update Now button remains inoperable. This button is useful for quick checks for a new scanner between regularly scheduled updates.

Forefront Security for SharePoint can be configured to update its file scanners when FSCController starts up. To configure Forefront Security for SharePoint to update at startup, select General Options in the SETTINGS shuttle. Then, in the Scanner Updates section, select the Perform Updates at Startup option. Updating when the service starts is useful for clustered SharePoint servers, where the inactive node will not receive updates while it is offline.

The updating of the engines is scheduled using the scheduler on the Scanner Updates work pane. The engines that are to be updated are scheduled in five-minute intervals to avoid possible conflicts.

This is the information that appears on the Scanner Updates work pane for a selected scanner:

• Engine Version. The version reported by the third-party scan DLL.
  
• Signature Version. The version of the scanner's virus definition files currently in use, as reported by the third-party scan DLL (not available with every scanner).
  
• Update Version. The value located in the Manifest.cab file. For more information, see Manifest.cab.
  
• Last Checked. The date and time of the last check made for a new scan engine or definition files.
  
• Last Updated. The date and time of the last update made to the scan engine or definition files.
  

The Manifest.cab files, maintained by Microsoft, store information for determining if a newer version of a scan engine is available for download. (Each engine has an associated Manifest.cab file in its Package folder.) During a scheduled update or when Update Now has been invoked, Forefront Security for SharePoint searches the network update path for a new update. To minimize overhead, the Manifest.cab file is first downloaded and used to determine if an update is required. If an update is not required, no further processing takes place. If an update is required, the update is then downloaded and applied. When the update is finished, the new Manifest.cab file overlays the old one.

This shows the directory structure of the scan engines on a server running Forefront Security for SharePoint:

Forefront Security Install\

   Data\

      Engines\

         x86\

            Engine Name\

               Package\

                  manifest.cab

                  Version Directory\

                        manifest.cab

                        enginename_fullpkg.cab

                        other enginename files

• Forefront Security Install is the top-level directory where all of the FSSP files are kept. This was created during the product's installation.
  
• Engine Name is a directory with the name of an engine's vendor (for example: Microsoft). There is an Engine Name directory for each engine.
  
• The Package directory contains the most recent Manifest.cab file.
  
• The Version Directory name has the format yymmddvvvv (year, month, day, version, for example: 0602020001). On any particular day, there may be multiple version directories. Each contains the current Manifest.cab, the enginename_fullpkg.cab (for example: norman_fullpkg.cab), and all other required files for the engine.
  

The most common method of distributing updates is to have one server (the “hub”) receive updates from the Microsoft HTTP server and then share those updates among the rest of the servers in your environment (the “spokes”). After the hub receives an engine update, it can share that update with any other server whose network update path points to it.

Configuring servers to distribute and receive updates

You must configure both the hub and spoke servers before distributing updates.

Configuring the redistribution (hub) server and UNC credentials

To prepare a server to act as an update hub, you need to establish a Windows share for its Engines directory (which is, by default, in c:\Program Files\Microsoft Forefront Security\SharePoint\Data).

Next, enable the Redistribution Server option in the Scanner Updates section of General Options on the chosen hub server. This configures Forefront Security for SharePoint to save the two most recent engine update packages in the engine package folder instead of the usual single engine package. FSSP will also download the full update package rather than perform an incremental update. The multiple engine packages enable the spoke servers to continue pulling updates from the redistribution server while a new update is being downloaded.

Finally, enter the UNC credentials.

To configure UNC credentials

1. In the SETTINGS section of the Shuttle Navigator, select General Options.

2. In the Scanner Updates section, select Use UNC Credentials.

3. In the UNC Username field, enter the name of a user with access rights to the UNC path. For more information, see "General Options" in SharePoint Forefront Server Security Administrator.

4. In the UNC Password field, enter the password for that user.

5. Click Save to save your changes.

Configuring the spoke servers

After the hub server has been set up, configure the spoke servers to point to the shared directory by entering the hub’s UNC path (\\ServerName\ShareName), in the Primary Network Update Path field of each of the spokes.

Note:
The use of static IP addresses within the update path is neither recommended nor supported.

Example:

Server Ex1 receives its updates automatically from the Microsoft HTTP server. Ex1 has Forefront Security for SharePoint installed in C:\Program Files(x86)\Microsoft Forefront Security\SharePoint, and you have created a share, called AdminShare, that begins at the Engines directory. Another server, Ex2, will get its updates from Ex1, using \\Ex1\AdminShare as its Primary network update path.

Forefront Security for SharePoint can be configured to send a notification to the Virus Administrator following each engine update. The notifications include:

• Successful update
  
  • Subject Line:Successful update of <engine_name> scan engine on server <server_name>
    
  • Body:The <engine_name> scan engine has been updated from <update_path>
    
• No update available
  
  • Subject Line:No new update for the <engine_name> scan engine on server <server_name>
    
  • Body:There are currently no new scan engine files available for the <engine_name> scan engine at <update_path>
    
• Error updating
  
  • Subject Line:Failed update of <engine_name> scan engine on server <server_name>
    
  • Body:An error occurred while updating the <engine_name> scan engine. [There may be an error message included here.] Please see the Program Log for more information.
    

    Note:
    If the Program Log contains the “could not create mapper object” error, it means that the engine in question did not load properly.

Engine update notifications are controlled in the General Options work pane by selecting Send Update Notification in the Scanner Updates section.

In environments where the SharePoint server must access the Internet through a proxy server, Forefront Security for SharePoint can be configured to retrieve engine updates through that server.

1. In the SETTINGS section of the Shuttle Navigator, select General Options.

2. In the Scanner Updates section of General Options, select Use Proxy Settings.

3. Enter information about the proxy server: name or IP address, port, user name (optional), and password (optional). For more information about these fields, see "General Options" in SharePoint Forefront Server Security Administrator.

4. Click Save.

After the proxy server settings have been entered and saved, they can be deployed to other servers by replicating the General Options settings using the Microsoft Forefront Server Security Management Console (FSSMC).

After a download has successfully completed, the newly-downloaded file scanner is tested. If the test fails, any scan jobs employing that file scanner continue to use the current version. Otherwise, all scan jobs using that file scanner are notified that there is a new version. If a scan job using the scanner is currently scanning a file, it will finish that file, and then load the new file scanner before continuing. If a scan job using the scanner is currently idle, it will load the new file scanner immediately.