Microsoft Exchange FIP-FS Scan Engine failed to load after update 01/01/2022 0x80004005 Can't convert to long

Andrey 181

Greetings and Happy New Year!

Tpday 01/01/200 faced this issue after auto update the FIP-FS (filtering management service) on our on-premium server MS Exenge 2016 21 KU with the latest security updates (KB5007409).

The FIP-FS "Microsoft" Scan Engine failed to load. PID: ХХХХХ, Error Code: 0x80004005. Error Description: Can't convert "2201010001" to long. (2201010002, 2201010003 etc)

Since the service is interconnected with the transport service, mail stops coming in and out, respectively.

And yes, as a workaround, disabling Disable-AntimalwareScanning.ps1 helps

Mark Stott 21 Reputation points

2022-01-01T07:48:01.883+00:00

Exactly the same issue here. Got called out at 7AM to issues with email delivery. I'm logging with Microsoft support.
Rob Wnuk 1 Reputation point

2022-01-01T11:22:52.54+00:00

Having the same issue!!!! Please keep this post updated! Thanks in advance!
Mike Fynboh 1 Reputation point

2022-01-01T12:16:27.583+00:00

Exchange 2019 as well.
Thanks for the heads up!
Markus Hnatek 6 Reputation points

2022-01-01T12:17:17.497+00:00

Can't convert "2201010001" to long looks like a version number including the date (20)22.01.01.0001 ... as max-long is 2147483647 it worked for (20)21.12.31.xxx but not for (20)22.01.01.0000
Fits the first Log entry today at 02:20 am :(

As mentioned Disable-AntimalwareScanning.ps1 helps
Brandon C 6 Reputation points

2022-01-01T12:29:21.423+00:00

I too am having the issue. Exchange 2016
Terence Swales 6 Reputation points

2022-01-01T12:31:29.223+00:00

same issue here. Disabling malware scanning works and queues have come down but they are not clearing completely with an average of 70 mails still stuck in the submission queue on each of the 3 servers for this client and experiencing mail delays because of this. Works fine at another client i must add.
Kozerski, Raffael 6 Reputation points

2022-01-01T13:46:32.657+00:00

queue suspend and resume will help here:

Get-Queue | Get-Message | Suspend-Message

Get-Queue | Get-Message | Resume-Message
Cam Matson 6 Reputation points

2022-01-01T15:41:06.347+00:00

We have had the same issue for the last 6 hours, had tried everything spoken about here but our mail Q's kept on building. It also turns out you need to check for any Transport rules that may check mails for Credit card numbers, attachments as they use the same engine, disable these and mail will work.
Кирилл Семенов 1 Reputation point

2022-01-02T02:02:23.213+00:00

Exchange 2019 CU11 as well.
Thanks for the heads up!
jhon heaps 1 Reputation point

2022-01-02T13:52:58.37+00:00

Yes, those bugs will never stop :)
Think to switch to Linux and say goodbay to these bugs and stop asking support from stupid guys.
For me, saying goodbye to Microsoft has never been easier, or so satisfying :)

Accepted answer

Corbett Enders 101 Reputation points

2022-01-02T01:01:09.413+00:00

Office Exchange Team blog post here: https://techcommunity.microsoft.com/t5/exchange-team-blog/email-stuck-in-transport-queues/ba-p/3049447
Please sign in to rate this answer.

2 people found this answer helpful.
Kozerski, Raffael 6 Reputation points

2022-01-02T09:01:26.6+00:00

yes, the "ResetScanEngineVersion.ps1" worked like a charme. After running and downloading the new Malware ScanEngine I enabled the Malware ScanEngine and everything works fine (Exchange 2016).
Thanks to all! Raffael

JV 6 Reputation points

2022-01-02T15:34:25.727+00:00

Did you have to put in maintenance mode? I think it just restarts the transport and then the Filtering management service?

Kozerski, Raffael 6 Reputation points

2022-01-02T15:59:07.003+00:00

No maintenance mode (only single mailbox server); the script stops and starts FMS and Transport Services.
Sign in to comment

10 additional answers

Maroiane Ghédira 31 Reputation points

2022-01-01T15:11:46.783+00:00

Hello,
As a workaround you can just bypass malware filtering on all servers with a transport service restart afterwards (solution tested and validate)
--> Set-MalwareFilteringServer -Identity <SERVER NAME> -BypassFiltering $true
--> Restart-Service MSExchangeTransport
Please sign in to rate this answer.

3 people found this answer helpful.
JV 6 Reputation points

2022-01-01T16:00:01.347+00:00

I don't see anything on our queue for all mail servers and transport service is running. Emails seems to be going in and out. Should i just wait instead of applyinh your workaround? It seems the worst thing is the Filter Management service shut off. I was going nuts last night but check the FIPFS Engine and Data directory which suddenly recall from 2003 days that this has happened before.

Maroiane Ghédira 31 Reputation points

2022-01-01T16:10:31.65+00:00

Following the feedback I have, the problem only concerns Exchange 2016/2019 servers, if you receive emails I do not recommend the workaround.

JV 6 Reputation points

2022-01-01T16:15:54.097+00:00

Thanks for the reply. Yes we are on Exchange 2016 CU 20. Is there any other spot to check aside from the queue and transport service? What a New Year huh?

Maroiane Ghédira 31 Reputation points

2022-01-01T16:41:36.377+00:00

This year is off to a good start !!! I hope it will be better than last year :)
The main impact of this problem is the failure to receive and send emails to all mailboxes with the blocking of emails in the queues even all Exchange services are started normally, on the server event log there is "The FIP-FS" Microsoft "Scan Engine failed to load. PID: 39268, Error Code: 0x80004005. Error Description: Can't convert" 2201010003 "to long. / Event ID 5300". if you are not concerned by the problem I think the antimalware module is already disabled on your environment

JV 6 Reputation points

2022-01-01T16:47:26.367+00:00

Yes let’s hope so. I do have the error in my event log and the Filtering Management service stops. It starts up though but stop again. As you said, If mail is coming in and out and nothing in the queue I guess I am not affected other than that service stopped. I will wait for MS to roll out an updated malware. I noticed last night the date on the folder had a future date on it which was odd. Thanks bud!

Terence Swales 6 Reputation points

2022-01-01T16:48:33.15+00:00

perhaps you already have the antimalware agent disabled. use this command to verify

Get-TransportAgent "Malware Agent"

JV 6 Reputation points

2022-01-01T16:51:36.583+00:00

You guys are right - it says False for Enabled.
Sign in to comment
Brandon C 6 Reputation points

2022-01-01T12:28:22.81+00:00

I too am having the same issue. Exchange 2016.
Please sign in to rate this answer.

1 person found this answer helpful.
Dat Lam 6 Reputation points

2022-01-01T20:48:48.793+00:00

If mail queue is being backed up., check for event log D 3811 reffering to anti-mailware. If it appears, then run the following command to disable anti-mailware

Set-MalwareFilteringServer <ServerIdentity> -BypassFiltering $true. This worked for me.

more on commands disabling malware services on
https://learn.microsoft.com/en-us/exchange/disable-or-bypass-anti-malware-scanning-exchange-2013-help
Sign in to comment
Markus Hnatek 6 Reputation points

2022-01-01T12:37:36.797+00:00

Can't convert "2201010001" to ... long looks like a date + version number ... (20)22.01.01.0001 ... max-long is 2147483647 so it worked for (20)21.12.31.0000 but not for (20)22.01.01.0000. Fits the first log entries at 02:20 am today.

Exchange 2019 latest CU ... Disable-AntimalwareScanning.ps1 ... queus are "empty" now
Please sign in to rate this answer.

1 person found this answer helpful.

0 comments No comments
Sign in to comment
Lawrence Patterson 6 Reputation points

2022-01-01T14:24:10.987+00:00

Hello, confirming that my Exchange 2016 CU22 is having a similar issue, started just after 8 PM EST, though my error is " The FIP-FS "Microsoft" Scan Engine failed to load. PID: 29572, Error Code: 0x80004005. Error Description: Can't convert "2201010002" to long. " which appears to be just slightly different from what I've seen.

Also see https://borncity.com/win/2022/01/01/exchange-fip-fs-scan-engine-failed-to-load-cant-convert-2201010001-to-long-1-1-2022/ with a further confirmation.

Can and will wait for a response from Microsoft, as we are in the middle of a downtime.
Please sign in to rate this answer.

1 person found this answer helpful.

0 comments No comments
Sign in to comment