Microsoft releases emergency repair for Trade 12 months 2022 bug

Microsoft has launched an emergency repair for a 12 months 2022 bug that’s breaking e-mail supply on on-premise Microsoft Trade servers.

Because the 12 months 2022 rolled in and the clock struck midnight, Trade admins worldwide found that their servers have been now not delivering e-mail. After investigating, they discovered that mail was getting caught within the queue, and the Home windows occasion log confirmed one of many following errors.

Log Identify: Utility 
Supply: FIPFS 
Logged: 1/1/2022 1:03:42 AM 
Occasion ID: 5300 
Stage: Error 
Laptop: server1.contoso.com
Description: The FIP-FS "Microsoft" Scan Engine did not load. PID: 23092, Error Code: 0x80004005. Error Description: Cannot convert "2201010001" to lengthy.

Log Identify: Utility 
Supply: FIPFS 
Logged: 1/1/2022 11:47:16 AM 
Occasion ID: 1106 
Stage: Error 
Laptop: server1.contoso.com 
Description: The FIP-FS Scan Course of failed initialization. Error: 0x80004005. Error Particulars: Unspecified error.

These errors are brought on by Microsoft Trade checking the model of the FIP-FS antivirus scanning engine and making an attempt to retailer the date in a signed int32 variable.

Nonetheless, this variable can retailer solely a most worth of two,201,010,001, which is lower than the brand new date worth of two,201,010,001 for January 1st, 2022, at midnight.

Resulting from this, when Microsoft Trade makes an attempt to test the AV scanning model, it could generate a bug and trigger the malware engine to crash.

“The model checking carried out towards the signature file is inflicting the malware engine to crash, leading to messages being caught in transport queues,” Microsoft defined in a weblog put up.

Microsoft releases non permanent repair

Microsoft has launched a short lived repair requiring buyer motion whereas engaged on an replace that robotically fixes the problem.

This repair comes within the type of a PowerShell script named ‘Reset-ScanEngineVersion.ps1.’ When executed, the script will cease the Microsoft Filtering Administration and Microsoft Trade Transport companies, delete older AV engine information, obtain the brand new AV engine, and begin the companies once more.

To make use of the automated script to use the repair, you possibly can observe these steps on every on-premise Microsoft Trade server in your group:

1. Obtain the Reset-ScanEngineVersion.ps1 script from https://aka.ms/ResetScanEngineVersion.
2. Open an elevated Trade Administration Shell.
3. Change the execution coverage for PowerShell scripts by working Set-ExecutionPolicy -ExecutionPolicy RemoteSigned.
4. Run the script.
5. When you had beforehand disabled the scanning engine, allow it once more utilizing the Allow-AntimalwareScanning.ps1 script.

Microsoft warns that this course of could take a while, relying on the group’s measurement.

Microsoft has additionally offered steps that admins can use to replace the scanning engine manually.

After working the script, Microsoft says that e-mail will begin delivering once more, however it might take a while to finish relying on the quantity of e-mail that was caught within the queue.

Microsoft additionally explains that the brand new AV scanning engine can be model quantity 2112330001, which references a date that doesn’t exist and that admins shouldn’t be involved.

“The newly up to date scanning engine is totally supported by Microsoft. Whereas we have to work on this sequence long term, the scanning engine model was not rolled again, fairly it was rolled ahead into this new sequence,” defined Microsoft.

“The scanning engine will proceed to obtain updates on this new sequence.”