Scan engines, signature files, and worm list updates can be downloaded automatically from the Microsoft HTTP server, or from another Microsoft Exchange server running Antigen. Setting a schedule for checking the HTTP or Exchange server for a new scan engine means that you are automatically protected against new viruses without having to check versions or manually update the files. After Antigen has automatically downloaded an updated scan engine, it automatically puts that scan engine to use. During file scanner updates, only the engine being updated is taken offline. The other engines continue to scan for viruses.

To set the schedule times for updating the scanning engines, click SETTINGS in the left navigation shuttle and then click the Scanner Updates icon. The Scanner Update Settings work pane appears on the right.

The top portion of the work pane shows the list of supported file scanners and the worm list. The bottom portion of the work pane contains the scheduling features for the selected scanner along with information about that scanner.

Note:
If a scan engine becomes locked or it generates an error message when it attempts to load, you may need to rebuild the scan engine. For more information, see "Rebuilding scan engines" in Chapter 21 - Troubleshooting overview.

You can control when your scanning engines update, how often, and the update source.

Note:
If you are using the optional Microsoft Antigen Enterprise Manager to update the scan engines, you should use the Scanner Updates work pane to disable scheduled updates.

1. Select Scanner Updates in the SETTINGS shuttle. The Scanner Update Settings work pane appears. The top of the pane shows a list of all supported file scanners and the worm list.

2. Select a scan engine to be scheduled. The bottom pane contains the primary and secondary update paths and the update schedule for the selected engine, along with information about that engine. (For more information, see About scanner information.)

3. Set the primary update path by clicking Primary in the bottom pane and then entering a value into the Network Update Path field. By default, Antigen uses the primary update path to download updates. If the primary path fails for any reason, Antigen uses the secondary update path.

   The default primary update path is http://antigendl.microsoft.com/antigen. You can change it to point to another HTTP update site, or if you would prefer to use UNC updating as the primary update path, enter the UNC path to another Exchange server. For more information about UNC updating, see Distributing updates.

   To restore the default server path, right-click the Network Update Path field, and then select Default HTTP Path.

4. Set the secondary update path, if desired, by clicking Secondary in the bottom pane and entering a value into the Network Update Path field. If the primary path fails for any reason, Antigen will use the secondary update path. It is left blank by default.

   The secondary path can be set to use HTTP or UNC updating. Enter either a URL or a UNC path to another Exchange server. For more information about UNC updating, see Distributing updates.

5. Specify the Date to check for updates. If you choose a Frequency of Once, this date is the only time that update checking will occur; otherwise, this date represents the first time that update checking will occur. Click the left and the right arrows on the calendar to change the month. Click a particular day to select it. (The current date is circled in red; a selected date turns blue.)

6. Set a time for the update to take place. Each of the subfields (hour, minute, seconds, and AM/PM) can be selected and set separately. You can enter a time or use the up and down buttons to change the current value of each subfield. Antigen for Exchange defaults to staggering the update time, leaving an interval of five minutes between engines. It is recommended that you stagger updates a minimum of 15 minutes apart.

7. Specify how often the update occurs (the frequency). You can choose Once (update only once, on the specified date and time), Daily (update every day, at the same time), Weekly (update each week, on the same day and time), or Monthly (update each month, on the same date and time). It is recommended that you select Daily, and then set a Repeat interval to update the engine at multiple times during the day.

8. Optionally, indicate a repeat interval. Select Repeat, and then choose a time interval. (The minimum time is 15 minutes, which is the default value.) It is recommended that you check for updates at least every two hours. If a new update is not available at the scheduled time, the engine is not taken offline and no updating is done.

9. Use the Enable and Disable buttons to control whether the update check will be performed for a selected engine. All engine updates are enabled by default. Even if you are not using a particular engine, you should schedule updates for it. That way, if you find you need to use that engine in the future, it will already be at the current update level.

10. Click Save.

Note:
The Enable and Disable buttons control updating only, and not the use of the engine. To discontinue using the engine itself, see Chapter 6 - Configuring Manual Scan Jobs, Chapter 7 - Configuring Realtime Scan Jobs, Chapter 8 - Configuring SMTP Scan Jobs, and Chapter 9 - Configuring MTA Scan Jobs.

Update Now

Update on load

About scanner information

About Manifest.cab

The most common method of distributing updates is to have one server receive updates from the Microsoft HTTP server and then share those updates among the rest of the servers (the "spoke" servers) in your environment. After one server receives an engine update, it can share that update with any other server whose network update path points to it.

Configuring servers to distribute and receive updates

You must configure both the hub and the spoke servers before distributing updates.

To prepare a server to act as an update hub, you first need to establish a Windows® share for the Engines directory (which is usually in the Antigen installation directory).

Next, enable the Redistribution Server option in the Scanner Updates section of General Options on the chosen hub server. This configures Antigen to save the two most recent engine update packages in the engine package folder instead of the usual single engine package. Antigen will also download the full update package rather than performing an incremental update. The multiple engine packages allow the spoke servers to continue pulling updates from the redistribution server while a new update is being downloaded.

Then, enter the UNC credentials.

To configure UNC credentials

1. Select General Options from the SETTINGS shuttle.

2. Select Use UNC Credentials in the Scanner Updates section.

3. In the UNC Username field, enter the name of a user with access rights to the UNC path. Also enter the UNC Password.

4. Click Save.

After the hub server has been set up, configure the spoke servers to point to the shared directory by entering the hub's UNC path (\\ServerName\ShareName), in the Primary Network Update Path field of each of the spoke servers.

Note:
The use of static IP addresses within the update path is neither recommended nor supported.

Example: Server Ex1 receives its updates automatically from the Microsoft HTTP server. Ex1 has Antigen installed in C:\Program Files\Microsoft Antigen for Exchange, and you have created a share, called AdminShare, that begins at the Engines directory. Another server, Ex2, will get its updates from Ex1, by using \\Ex1\AdminShare as its primary network update path.

Antigen can be configured to send a notification to the Virus Administrator following each engine update. The notifications include:

Engine update notifications are controlled in the General Options work pane by selecting Send Update Notification in the Scanner Updates section.

After the download has successfully completed, the new file scanner is immediately put to use. Any currently running scan jobs are temporarily paused while the new file scanners are loaded. The previous file scanner files are then archived in a folder named LastKnownGood. If for any reason the newly downloaded file scanner fails, Antigen returns to the file scanner that was archived in the LastKnownGood folder.

In environments where the Exchange server must access the Internet through a proxy server, Antigen can be configured to retrieve engine updates through a proxy server.

1. Select General Options from the SETTINGS shuttle.

2. In the Scanner Updates section of General Options, select Use Proxy Settings.

3. Enter information about the proxy server: name or IP address, port, user name (optional), and password (optional). For more information about these fields, see Chapter 4 - Using the Antigen Administrator.

4. Click Save.

After the proxy server settings have been entered and saved, they can be deployed to other servers by replicating the General Options settings by using the Microsoft Antigen Enterprise Manager (AEM).