Symantec Mail Security for Microsoft Exchange (SMSMSE) is Quarantining all Unscannable files even though it is set to Log only.
The Symptoms are:
- New installation of Windows 2008 server and Exchange 2007 and new installation of SMSMSE 6.5.6.
- The installation completed successfully without any errors.
- When changing in the SMSMSE console - Policies - Exceptions - Unscannable File Rule to Disposition/Action to take: Log only the change was deployed successfully.
- SMSMSE has been reinstalled but the problem still remains.
- There are no errors in Monitors - Event log.
- The Event log is showing the mail was unscannable and got quarantined.
- When changing the Unscannable File Rule action to Log only the respective change in the registry should be visible but is not. The HKLM\SOFTWARE\Wow6432Node\Symantec\SMSMSE\6.5\Server\Policies\Standard\ExceptionSubPolicy\UnscannableFileRule\ActionToTakeEnum key should change value from 4 to 2 but as the SMSMSE registry keys does not have sufficient permissions to change this there is no change.
The SMSMSE has not been installed with Domain Administrator priviliges as per the Implementation guide requirements.
The SMSMSE needs to be reinstalled with Domain Administrator rights.
1. Uninstall the Symantec Mail Security from add/remove programs or Programs and Features (run - appwiz.cpl). Ensure the deinstallation completes without errors.
2. Log out as the Domain User and Log back in as Domain Administrator or a user with Domain Admin priviliges. The Domain Admins are by default a part of the Local Administrators.
3. Install the version of SMSMSE which is required.
4. Change the Unscannable policy to Log only.
5. Confirm that changes now takes affect in the registry and Unscannable mails get the action Log only as set.
Symantec Mail Security for Microsoft Exchange 6.x