Forefront Security for Exchange Server Best Practices - Store scanning

Article
07/23/2014

Applies to: Forefront Security for Exchange Server

The following sections show, in table format, the effects that the various options have on Store Scanning.

Store scanning When Using Default Settings

The following table describes the default Store Scanning used by Forefront Security for Exchange Server. This is the behavior you will see if no default settings are changed.

Normal Mode (defaults)
On submission to store (Proactive scan)	Do not scan
On first access, if mail is newer than the On Access Cutoff value*	Scan only if never scanned before
On first access, if mail is older than the On Access Cutoff value*	Do not scan
On subsequent access	Do not scan
During Background Scan	Always scan
During manual scan	Always scan

Note

The items marked with an asterisk (*) have to do with the On Access Cutoff value. For more information about this value, see Exchange 2007 mailbox server on-access scanning.

The following tables show deviations from the normal mode as you enable the various options.

Store scanning with a single option enabled

The following tables show the effect of enabling one additional store scanning option when running a Realtime or Manual Scan Job.

Scan on Scanner Update enabled
On first access	Always scan
On subsequent access	Scan if an engine has updated since previous on-access scan

Proactive Scanning enabled (using registry key)
On submission to store (Proactive scan)	Always scan
On first access	Do not scan if scanned proactively

DisableAVStamping registry key enabled
On first access	Always scan

Store scanning with two options enabled

The following tables describe the effect of enabling combinations of two store scanning options.

Scan on Scanner Update enabled Enable Background Scan if “Scan on Scanner Update” enabled
On first access	Always scan
On subsequent access	Scan if an engine has updated since previous on-access scan
Background Scan Frequency	Start background scan every time an engine updates

Scan on Scanner Update enabled Proactive Scanning enabled (using registry key)
On submission to store (Proactive scan)	Always scan
On first access	Scan if engine has updated since Proactive Scan
On subsequent access	Scan if engine has updated since last on-access scan

Scan on Scanner Update enabled DisableAVStamping registry key enabled
On first access	Always scan
On subsequent access	Scan if engine has updated since last on-access scan

Proactive Scanning enabled DisableAVStamping registry key enabled
On submission to store (Proactive scan)	Always scan
On first access	Scan if engine has updated since Proactive Scan
On subsequent access	Scan if engine has updated since last on-access scan

Store scanning with three options enabled

The following tables describe the effect of enabling combinations of three store scanning options.

Scan on Scanner Update enabled Enable Background Scan if “Scan on Scanner Update” enabled Proactive Scan enabled using registry key
On submission to store (Proactive scan)	Always scan
On first access	Scan if an engine has updated since Proactive Scan
On subsequent access	Scan if an engine has updated since previous on-access scan
Background Scan Frequency	Start background scan every time an engine updates

Scan on Scanner Update enabled Proactive Scan enabled using registry key Disable AV Stamp enabled
On submission to store (Proactive scan)	Always scan
On first access	Scan if an engine has updated since Proactive Scan
On subsequent access	Scan if an engine has updated since previous on-access scan

Scan on Scanner Update enabled

Proactive Scan enabled using registry key

Disable AV Stamp enabled

On submission to store (Proactive scan)

Always scan

On first access

Scan if an engine has updated since Proactive Scan

On subsequent access

Scan if an engine has updated since previous on-access scan

Scan on Scanner Update enabled Enable Background Scan if “Scan on Scanner Update” enabled Disable AV Stamp enabled
On first access	Always scan
On subsequent access	Scan if an engine has updated since previous on-access scan

Scan on Scanner Update enabled

Enable Background Scan if “Scan on Scanner Update” enabled

Disable AV Stamp enabled

On first access

Always scan

On subsequent access

Scan if an engine has updated since previous on-access scan

Store scanning with four options enabled

The following table describes the effect of enabling all four store scanning options.

Scan on Scanner Update enabled Enable Background Scan if “Scan on Scanner Update” enabled Proactive scanning enabled Disable AV Stamp enabled
On submission to store (Proactive scan)	Always scan
On first access	Scan if an engine has updated since Proactive Scan
On subsequent access	Scan if an engine has updated since previous on-access scan

Scan on Scanner Update enabled

Enable Background Scan if “Scan on Scanner Update” enabled

Proactive scanning enabled

Disable AV Stamp enabled

On submission to store (Proactive scan)

Always scan

On first access

Scan if an engine has updated since Proactive Scan

On subsequent access

Scan if an engine has updated since previous on-access scan

Forefront Security for Exchange Server Best Practices - Store scanning

Store scanning When Using Default Settings

Store scanning with a single option enabled

Store scanning with two options enabled

Store scanning with three options enabled

Store scanning with four options enabled

Additional resources