Cập nhật bản vá xử lý FIP-FS Lỗi liên quan Y2K22 treo Email Queues khi Update Antimalware

Microsoft_Exchange_(2019-present).svg

Mô tả

Theo như bài viết ngày 01/01/2022 thông báo lỗi quan trọng lỗi liên Exchange không gửi/nhận được liên quan Y2K22 tại đây

Mới đây sau khi report 02/01/2022 các anh em kêu gào trên thế giới vì lỗi liên quan sản phẩm Exchange 2016, Exchange 2019. Microsoft đã xác nhận đây là lỗi Y2K22.

Microsoft đã tạo một giải pháp để giải quyết vấn đề thư bị kẹt trong hàng đợi truyền tải trên Exchange Server 2016 và Exchange Server 2019 do sự cố ngày tiềm ẩn trong tệp chữ ký được công cụ quét phần mềm độc hại trong Exchange Server sử dụng. 

Log Name: Application 
Source: FIPFS 
Logged: 1/1/2022 1:03:42 AM 
Event ID: 5300 
Level: Error 
Computer: NVPSRVEX01.viettechgroup.lab
Description: The FIP-FS "Microsoft" Scan Engine failed to load. PID: 23092, Error Code: 0x80004005. Error Description: Can't convert "2201010001" to long.
Log Name: Application 
Source: FIPFS 
Logged: 1/1/2022 11:47:16 AM 
Event ID: 1106 
Level: Error 
Computer: NVPSRVEX01.viettechgroup.lab
Description: The FIP-FS Scan Process failed initialization. Error: 0x80004005. Error Details: Unspecified error.

Nguyên Nhân

FIP-FS sử dụng kiểu “Int32” để lưu giá trị của các biến số thời gian. Giá trị tối đa mà kiểu này có thể lưu là “2.147.483.647”.

Tuy nhiên, các ngày trong năm 2022 có giá trị tối thiểu là 2.201.010.001 hoặc lớn hơn giá trị tối đa có thể được lưu trữ trong biến int32 đã ký, khiến FIP-FS “Microsoft” Scan Engine  thất bại và không phát hành thư để gửi nên bị giữ.

Xử lý Cập nhật

Cách 1 cập nhật tự động

Microsoft đã cập nhật 1 script tự động ResetscanengineVersion. Lưu ý trong hệ thống có bao nhiêu máy chủ Exchange thì chạy hết tất cả để cập nhật nhé.

Tải script bên dưới:

https://aka.ms/ResetScanEngineVersion

Lưu trước khi chạy nếu chưa có quyền thực thi Powershell thì chạy lệnh bên dưới:

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned

Thực hiện update như sau, nếu các bạn nào đã disabled hoặc bypassed antimalware scanning thì phải bật lại trước khi làm thao tác Update này nhé.

[PS] C:\Program Files\Microsoft\Exchange Server\V15\Scripts>.\Enable-AntiMalwareScanning.ps1
[PS] C:\Program Files\Microsoft\Exchange Server\V15\Scripts> Set-MalwareFilteringServer -BypassFiltering $false -identity  Servermbx

Run EMS Administrators trên tất cả Exchange Server chúng ta đang có nhé.

.\Reset-ScanEngineVersion.ps1

[PS] D:\Y2K22>.\Reset-ScanEngineVersion.ps1
NVPSRVEX01 Stopping services...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to stop...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to stop...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to stop...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to stop...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to stop...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to stop...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to stop...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to stop...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to stop...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to stop...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to stop...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to stop...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to stop...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to stop...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to stop...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to stop...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to stop...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to stop...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to stop...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to stop...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to stop...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to stop...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to stop...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to stop...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to stop...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to stop...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to stop...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to stop...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to stop...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to stop...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to stop...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to stop...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to stop...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to stop...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to stop...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to stop...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to stop...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to stop...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to stop...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to stop...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to stop...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to stop...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to stop...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to stop...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to stop...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to stop...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to stop...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to stop...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to stop...
NVPSRVEX01 Removing Microsoft engine folder...
NVPSRVEX01 Emptying metadata folder...
NVPSRVEX01 Starting services...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to start...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to start...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to start...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to start...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to start...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to start...
WARNING: Waiting for service 'Microsoft Filtering Management Service (FMS)' to start...
WARNING: Waiting for service 'Microsoft Exchange Transport (MSExchangeTransport)' to start...
WARNING: Waiting for service 'Microsoft Exchange Transport (MSExchangeTransport)' to start...
WARNING: Waiting for service 'Microsoft Exchange Transport (MSExchangeTransport)' to start...
NVPSRVEX01 Starting engine update...
Running as VIETTECHGROUP\Administrator.
--------
Connecting to NVPSRVEX01.viettechgroup.lab.
Dispatched remote command. Start-EngineUpdate -UpdatePath http://amupdatedl.microsoft.com/server/amupdate

Quá trình update diễn ra trong thời gian 15-30 phút tùy hệ thống mạng. Bằng cách kiểm tra bằng lệnh này:

Add-PSSnapin Microsoft.Forefront.Filtering.Management.Powershell.
Get-EngineUpdateInformation

Đảm bảo rằng phiên bản là 2112330001 và kiểm tra trong event viewer không có lỗi nhé

Cách 2: Cập nhật manual

Xóa thư mục tồn tại engine và metadata

1. Stop the Microsoft Filtering Management service. 
2. Dùng task Manager đảm bảo updateservice.exe đã stop
3. Xóa thư mục Microsoft theo đường dẫn: %ProgramFiles%\Microsoft\Exchange Server\V15\FIP-FS\Data\Engines\amd64\Microsoft.
4. Xóa file trong thư mục metadata theo đường dẫn : %ProgramFiles%\Microsoft\Exchange Server\V15\FIP-FS\Data\Engines\metadata.

Cập nhật engine mới nhất

1. Start dịch vụ Microsoft Filtering Management service và the Microsoft Exchange Transport service.
2. Mở EMS, navigate to the Scripts folder (%ProgramFiles%\Microsoft\Exchange Server\V15\Scripts), and run Update-MalwareFilteringServer.ps1 <server FQDN>

Kiểm tra phiên bản

1. EMS chạy Add-PSSnapin Microsoft.Forefront.Filtering.Management.Powershell.
2. Run Get-EngineUpdateInformation và xác nhận UpdateVersion information is 2112330001.

Nguồn Microsoft teams Exchange

Phương Nguyễn dịch edit