Fix: The culprit behind 80% of Exchange crashes

If you’ve worked with me long enough, you’ll know that one of the first questions out of my mouth when you ask me for help with random Exchange crashes is, “Is the Symantec Information Foundation Mail Security for Microsoft Exchange fully up-to-date?”

I wish I didn’t have to ask this question—SMSMSE is an ancillary product in many cases—it supplements the AV scanning engine of whatever the client’s Anti-Spam solution is.  Very few clients use the SMSMSE’s anti-spam capability, in favor of a third-party appliance (usually a SonicWALL E-Mail Security) or a hosted service (such as Postini); however, by virtue of having been licensed for Symantec’s full protection suite, we frequently like to install SMSMSE as a “second safety-net,” given that the Anti-Spam solutions typically use a virus scanning engine other than Symantec’s.

Unfortunately, when troubleshooting an Exchange issue, which may include:

Ø  Crashing the Microsoft Exchange Transport service

Ø  ASP.NET errors

Ø  Stopping mail flow without errors in the Event Log

Ø  Blue screen (STOP) errors

…the last place that folks think to check is the SMSMSE, yet (in my experience), 80% of these issues are caused by an out-of-date SMSMSE conflicting with a recent security update or patch.

At two clients recently (also including us), we were running version, which caused error shown below.  In one case, this same error was the precursor to a halt to mail flow:

Log: Application

Type: Warning

Event: 2262

Agent Time: [REDACTED]

Event Time: [REDACTED]

Source: W3SVC-WP

Category: None

Username: N/A

Computer: [REDACTED]

Description: ISAPI 'C:\WINDOWS\Microsoft.NET\Framework64\v2.0.50727\aspnet_isapi.dll' reported itself as unhealthy for the following reason: 'Deadlock detected'.

After having set up a custom monitor set to catch this error, all three servers that were experiencing this all had one thing in common… version of SMSMSE:

…hence my recommendation in the bubble above.  If the “Currently available version” of SMSMSE is greater than the “Installed version,” I’d highly recommend installing the update ASAP.

The upgrade from 6.0.X to 6.5.X, and from 6.5.2.X to 6.5.2.Y is quite simple, takes about 15 minutes (after you download the ~400MB installation file from FileConnect), and only restarts the Microsoft Exchange Transport service.

During the installation (upgrade), you’ll notice that it registers some new types with ASP.NET 2.0.50727.1433 (also the same ASP.NET version loaded on all three problematic servers), thus also confirming my suspicions that the issue relates to an incompatibility between ASP.NET 2.0.50727.1433 and SMSMSE

At the time of this writing, the most recent available version is… when scrolling through the list on FileConnect, make sure you’re getting the latest iteration of 6.5, as the list sorting is a bit wacky.  Just look for the correct file with the most recent date:

Again, you’ll be surprised how many Exchange-related issues this upgrade will fix—and why that’s usually the first question I ask.