Download engine and definition updates
Applies to: Exchange Server 2013
Topic Last Modified: 2013-10-22
Microsoft Exchange Server 2013 administrators can manually download anti-malware engine and definition (signature) updates. We strongly recommend that you download engine and definition updates on your Exchange server prior to placing it in production.
Estimated time to complete: 5 minutes
To download updates, your computer must be able to access the Internet and be able to establish a connection on TCP port 80 (HTTP).
You can only use the Shell to perform this procedure.
You need to be assigned permissions before you can perform this procedure or procedures. To see what permissions you need, see the “Anti-malware” entry in the Anti-spam and anti-malware permissions topic.
For information about keyboard shortcuts that may apply to the procedures in this topic, see Keyboard shortcuts in the Exchange admin center.
To download engine and definition updates, run the following command:
& $env:ExchangeInstallPath\Scripts\Update-MalwareFilteringServer.ps1 -Identity <FQDN of server>
This example manually downloads the engine and definition updates on a server named mailbox01.contoso.com:
& $env:ExchangeInstallPath\Scripts\Update-MalwareFilteringServer.ps1 -Identity mailbox01.contoso.com
Optionally, you can specify the –EngineUpdatePath parameter which lets you download updates from somewhere other than the default of http://forefrontdl.microsoft.com/server/scanengineupdate. This can be an HTTP address or a UNC path; if the latter then the network service must have access to the path. This example manually downloads engine and definition updates from a local directory onto a server named mailbox01.contoso.com:
& $env:ExchangeInstallPath\Scripts\Update-MalwareFilteringServer.ps1 -Identity mailbox01.contoso.com -EngineUpdatePath \\Server\sharename
In order to verify that updates were downloaded successfully, you need to access Event Viewer and view the event log. We recommend that you filter only FIPFS events, as described in the following procedure.
From the Start menu, click All Programs > Administrative Tools > Event Viewer.
In Event Viewer, expand the Windows Logs folder, and then click Application.
In the Actions menu, click Filter Current Log.
In the Filter Current Log dialog box, from the Event sources drop-down list, select the FIPFS check box, and then click OK.
If engine updates were downloaded successfully, you will see Event ID 6033, which will appear similar to the following:
MS Filtering Engine Update process performed a successful scan engine update.
Scan Engine: Microsoft
Update Path: http://forefrontdl.microsoft.com/server/scanengineupdate
Last Update time: 2012-08-16T13:22:17.000Z
Engine Version: 1.1.8601.0
Signature Version: 1.131.2169.0