Is it necessary to reboot the Exchange server after upgrading Symantec Mail Security for Microsoft Exchange (SMSMSE)?

Products

• Mail Security for Microsoft Exchange

Issue/Introduction

It's important to know in advance whether a critical mail server will need to be rebooted after the latest upgrade of SMSMSE is applied.

Cause

Any downtime needs to be planned in advance.

Resolution

• Upgrading any version of SMSMSE may require a start of the IIS processes (iisreset).
• Upgrading from any release of SMSMSE 5.x to any update of SMSMSE 5.x will not require a reboot.
• On an Exchange 2000/2003, upgrading from any release of SMSMSE 6.x to any update of SMSMSE 6.x does not require a reboot.
• On Exchange 2007/2010 upgrading to 6.X may require a reboot.  This is typically required if files are locked.

Technical Information

The reason for a reboot during an upgrade can be found in the MSI installation log.  Turn on installation logging (if not already on) by using this article: How to Obtain Detailed Logging While Installing Symantec Mail Security for Microsoft Exchange (SMSMSE).  Open the file %TEMP%\smsmse_verbose_install.log and search for this text:

RESTART MANAGER: Did detect that a critical application holds file[s] in use, so a reboot will be necessary.

Here is an example:

MSI (s) (00:78) [12:03:53:239]: RESTART MANAGER: Detected that application with id 4944, friendly name 'EdgeTransport.exe', of type RmCritical and status 1 holds file[s] in use.
MSI (s) (00:78) [12:03:53:239]: RESTART MANAGER: Did detect that a critical application holds file[s] in use, so a reboot will be necessary.

Later in the same MSI log is this information:

MSI (s) (00:78) [12:06:00:724]: Executing op: FileCopy(SourceName=SYMANT~2.DLL|Symantec.MailSecurity.Server.TransportAgent.dll,SourceCabKey=

symantec.mailsecurity.server2,DestName=Symantec.MailSecurity.ServerTransportAgent.dll,

Attributes=16384,FileSize=138112,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,Version=6.5.5.255,Language=0,InstallMode=126091264,,,,,,,)
MSI (s) (00:78) [12:06:00:724]: File: C:\Program Files (x86)\Symantec\SMSMSE\6.5\Server\Symantec.MailSecurity.Server.TransportAgent.dll;    Overwrite;    Won't patch;    Existing file is a lower version
MSI (s) (00:78) [12:06:00:724]: Source for file 'symantec.mailsecurity.server2' is compressed
InstallFiles: Installing:  C:\Program Files (x86)\Symantec\SMSMSE\6.5\Server\Symantec.MailSecurity.Server.TransportAgent.dll
MSI (s) (00:78) [12:06:00:724]: Re-applying security from existing file.
Info 1603.The file C:\Program Files (x86)\Symantec\SMSMSE\6.5\Server\Symantec.MailSecurity.Server.TransportAgent.dll is being held in use.  Close that application and retry.
MSI (s) (00:78) [12:06:00:724]: Product: Symantec Mail Security for Microsoft Exchange. The file C:\Program Files (x86)\Symantec\SMSMSE\6.5\Server\Symantec.MailSecurity.Server.TransportAgent.dll is being used by the following process: Name: EdgeTransport , Id 4944.
MSI (s) (00:78) [12:06:00:755]: Verifying accessibility of file: Symantec.MailSecurity.Server.TransportAgent.dll

This example shows that the Exchange Transport Agent process EdgeTransport.exe has the file C:\Program Files (x86)\Symantec\SMSMSE\6.5\Server\Symantec.MailSecurity.Server.TransportAgent.dll locked.  The installer cannot update it immediately.  It is updated on reboot.

Here is another example where system processes have files locked:

MSI (s) (F8:C4) [14:46:05:488]: RESTART MANAGER: Detected that application with id 788, friendly name 'DHCP Client', service short name 'Dhcp', of type RmService and status 1 holds file[s] in use.
MSI (s) (F8:C4) [14:46:05:488]: Note: 1: 2262 2: ServiceControl 3: -2147287038
MSI (s) (F8:C4) [14:46:05:488]: RESTART MANAGER: Detected that application with id 788, friendly name 'Windows Event Log', service short name 'eventlog', of type RmService and status 1 holds file[s] in use.
MSI (s) (F8:C4) [14:46:05:488]: Note: 1: 2262 2: ServiceControl 3: -2147287038
MSI (s) (F8:C4) [14:46:05:488]: RESTART MANAGER: Detected that application with id 788, friendly name 'TCP/IP NetBIOS Helper', service short name 'lmhosts', of type RmService and status 1 holds file[s] in use.
MSI (s) (F8:C4) [14:46:05:488]: Note: 1: 2262 2: ServiceControl 3: -2147287038
MSI (s) (F8:C4) [14:46:05:488]: RESTART MANAGER: Detected that application with id 884, friendly name 'WinHTTP Web Proxy Auto-Discovery Service', service short name 'WinHttpAutoProxySvc', of type RmService and status 1 holds file[s] in use.
MSI (s) (F8:C4) [14:46:05:488]: Note: 1: 2262 2: ServiceControl 3: -2147287038
MSI (s) (F8:C4) [14:46:05:488]: RESTART MANAGER: Detected that application with id 832, friendly name 'Task Scheduler', service short name 'Schedule', of type RmCritical and status 1 holds file[s] in use.
MSI (s) (F8:C4) [14:46:05:488]: Note: 1: 2262 2: ServiceControl 3: -2147287038
MSI (s) (F8:C4) [14:46:05:488]: RESTART MANAGER: Did detect that a critical application holds file[s] in use, so a reboot will be necessary.

In many instances the Windows Application Event log contains information about the files that are locked during the upgrade.  The following events are examples:

Type: Information
Date: 2/19/2009
Time: 7:58:33 AM
Event: 1025
Source: MsiInstaller
Category: None
User: DOMAINNAME\Administrator
Computer: SERVERNAME
Description: Product: Symantec Mail Security for Microsoft Exchange. The file C:\Program Files (x86)\Symantec\SMSMSE\6.0\Server\Symantec.MailSecurity.Server.MCLink.dll is being held in use by the following process Name: EdgeTransport , Id 4108.

Type: Information
Date: 2/19/2009
Time: 7:58:33 AM
Event: 1025
Source: MsiInstaller
Category: None
User: DOMAINNAME\Administrator
Computer: SERVERNAME
Description: Product: Symantec Mail Security for Microsoft Exchange. The file C:\Program Files (x86)\Symantec\SMSMSE\6.0\Server\Symantec.MailSecurity.Server.TransportAgent.dll is being held in use by the following process Name: EdgeTransport , Id 4108.