Antivirus on Exchange Server: the exclusions Microsoft documents and how to test them

Antivirus and Exchange can run on the same server, but only with the exclusions Microsoft documents. Without them, a scanner can lock or quarantine a database or log file that Exchange has open, and Microsoft warns this can cause severe problems, including data loss. Here's what to exclude on Exchange Server SE and 2019, how AMSI fits in, and how to test the exclusions instead of trusting a policy screenshot.

How it works#

• Windows antivirus scans in two ways: real-time (memory-resident) protection of files and processes as they're used, and file-level scans of the disk on demand or on a schedule. Microsoft's folder exclusions apply to both.
• Microsoft says its Exchange exclusion guidance takes precedence over vendor guidance, because of the way Exchange uses its files.
• Windows antivirus doesn't replace mail hygiene: it can't detect threats that exist only inside email. That's the job of the Exchange Malware agent, Exchange Online Protection or your mail filter.
• AMSI is a separate layer. Exchange's Antimalware Scan Interface integration hands the content of incoming HTTP requests to your AMSI-capable antivirus before Exchange processes them. File and process exclusions don't switch that off, and you should keep it on; see Exchange Emergency Mitigation service and AMSI. CSS-Exchange has a separate Test-AMSI.ps1 script for that side.

What Microsoft says to exclude#

Paths use %ExchangeInstallPath% (default C:\Program Files\Microsoft\Exchange Server\V15\). If you moved databases, logs or transport folders, exclude their real locations; Get-MailboxDatabase -Server EX01 | Format-List EdbFilePath, LogFolderPath shows the database paths.

Folders (Mailbox servers)#

Edge Transport servers add TransportRoles\Data\Adam and TransportRoles\Data\IpFilter. Exchange 2016 also has four UnifiedMessaging folders; Unified Messaging isn't available in Exchange 2019 or SE.

Processes#

Microsoft lists more than 40 processes. The critical ones are the Information Store (Microsoft.Exchange.Store.Service.exe, Microsoft.Exchange.Store.Worker.exe), transport (EdgeTransport.exe, MSExchangeTransport.exe, MSExchangeFrontendTransport.exe, MSExchangeDelivery.exe, MSExchangeSubmission.exe), replication (MSExchangeRepl.exe, MSExchangeDagMgmt.exe), search (Microsoft.Exchange.Search.Service.exe, noderunner.exe, ParserServer.exe, hostcontrollerservice.exe), the FIP-FS scanning components (fms.exe, ScanningProcess.exe, UpdateService.exe), Managed Availability (MSExchangeHMHost.exe, MSExchangeHMWorker.exe), plus inetinfo.exe and OleConverter.exe. Take the full list from Microsoft's page or the script below rather than typing it by hand.

File name extensions#

A safety net in case folder exclusions fail or files move: .config; .chk, .edb, .jfm, .jrs, .jsl, .log, .que (databases); .dsc and .txt (Group Metrics); .lzx (offline address book); and on Exchange 2016, .cfg and .grxml (Unified Messaging).

Step-by-step#

1. Generate the list for each server#

CSS-Exchange's Set-ExchAVExclusions.ps1 works out the expected exclusions for the local server. Run it from an elevated Exchange Management Shell on each Exchange server:

.\Set-ExchAVExclusions.ps1 -ListRecommendedExclusions -FileName .\Exclusions-EX01.txt

On servers protected by Microsoft Defender Antivirus, running the script without parameters adds the exclusions to Defender. For a third-party product, give the file to whoever manages it.

2. Put them in the managing policy#

If Defender is managed centrally (Intune, Configuration Manager or Group Policy), add the exclusions to that policy too, so the security team sees them and they still apply if local exclusions stop being merged. Check what Defender is really using:

$mp = Get-MpPreference
$mp.ExclusionPath; $mp.ExclusionProcess; $mp.ExclusionExtension

3. Test them with Test-ExchAVExclusions.ps1#

Warn your security team first. The script writes the harmless EICAR test file into every folder on Microsoft's list and tests each documented extension in a temporary folder, so alerts are expected.

.\Test-ExchAVExclusions.ps1
.\Test-ExchAVExclusions.ps1 -Recurse -WaitingTimeForAVAnalysisInMinutes 10

By default it waits five minutes for the antivirus to react. A test file that disappears means that path or extension is being scanned. Next, it lists the modules loaded into Exchange processes and reports the non-default ones; a module from an antivirus or security vendor is a strong sign the process exclusions aren't working. -Recurse also drops the file into every subfolder. Results land next to the script: a results log, a debug log and BadExclusions-<Server>-<DateTime>.txt listing the folders, extensions and processes to fix.

4. Fix and test again#

Work through the bad-exclusions file with the vendor, then repeat the test until it comes back clean. Run it again after antivirus agent upgrades, policy changes and Exchange cumulative updates, because exclusions are easy to lose.

Verify#

• EICAR files survive in every tested folder, and the extension test files survive too.
• No antivirus or security vendor modules are reported inside Exchange processes.
• Databases stay mounted and copies healthy: Get-MailboxDatabaseCopyStatus -Server EX01 | Format-Table Name, Status, ContentIndexState shows Mounted or Healthy with a Healthy content index.

Tips & gotchas#

• Signs of missing exclusions follow from the locking problem Microsoft describes: databases that dismount or won't mount, ESE error -1032 (JET_errFileAccessDenied, a file locked or in use), transaction logs quarantined, a failed content index, slow or stuck transport queues, high CPU from scanning, and updates that fail on locked files. Test the exclusions before you chase anything else.
• Remote scans count. Microsoft notes that scanning Exchange folders from another machine can cause the same file locks.
• Third-party security agents can still cause unexpected behaviour with correct exclusions; when troubleshooting, Microsoft may ask you to disable or uninstall them temporarily to establish a baseline.
• Exclusions don't blind you everywhere. The web-facing folders where Microsoft has found web shells aren't on the list, so a full scan still covers them; see Is my Exchange server compromised?
• Updates. If an update fails on a locked file, see Installing Exchange Server security updates.

References#

• Running Windows antivirus software on Exchange servers (Microsoft Learn)
• Test-ExchAVExclusions (CSS-Exchange)
• Set-ExchAVExclusions (CSS-Exchange)