Topic Last Modified: 2006-04-21

The Microsoft® Exchange Server Analyzer Tool reads the following registry entry to determine the value for ScanningThreadPoolCount:

HKEY_LOCAL_MACHINE\Software\TrendMicro\ScanMail for Exchange\RealTimeScan\ScanOption

The ScanningThreadPoolCount registry value represents the number of scanning threads that will be initialized and readied for use when ScanMail for Exchange services is started. The default value is 12. When all the threads created on startup are used up, ScanMail for Exchange will create additional threads to be used until it reaches the number of threads controlled by the MaxScanningThreadCount registry value described in Trend ScanMail low thread count.

The Exchange Server Analyzer also reads the following registry entry to determine whether Virus Scanning API (VSAPI) message scanning is enabled:


A value of 1 for Enabled indicates that VSAPI scanning is enabled. A value of 0 indicates VSAPI scanning is not enabled.

The Exchange Server Analyzer also queries the Win32_ComputerSystem Microsoft Windows® Management Instrumentation (WMI) class to determine the value set for the NumberOfProcessors key. This value represents the number of processors installed on the computer, and it includes both physical processors and logical processors. Using Hyper-Threading technology from Intel, a physical processor can be split into two logical processors.

The Exchange Server Analyzer also queries the Active Directory® directory service to determine the number of objects with an object class of msExchPrivateMDB. The count of these objects represents the number of mailbox stores on this Exchange Server computer.

If the Exchange Server Analyzer finds that the value for ScanningThreadPoolCount is less than (2 × NumberOfProcessors + 1) + 3 + the number of mailbox stores) on an Exchange Server computer that has VSAPI scanning enabled, a warning is displayed.

If Hyper-Threading is enabled, the value for NumberOfProcessors will be double the number of physical processors. It is recommended that you use the above formula for systems that have physical processors, as well as for systems that have both physical and logical processors.

This warning indicates that the ScanningThreadPoolCount registry value may not be optimized for your environment. This value should be set to be at least equal to the attachment size limit you have set on your Exchange servers.

This article contains information about editing the registry. Before you edit the registry, make sure you understand how to restore the registry if a problem occurs. For information about how to restore the registry, view the "Restore the Registry" Help topic in Regedit.exe or Regedt32.exe.

To correct this warning

  1. Open a registry editor, such as Regedit.exe or Regedt32.exe.

  2. Navigate to: HKLM\Software\TrendMicro\ScanMail for Exchange\RealTimeScan\ScanOption.

  3. In the right pane, double-click ScanningThreadPoolCount.

  4. Enter a value recommended by the Exchange Server Analyzer.

  5. Close the registry editor, and then restart the ScanMail_RealTimeScan service and the Microsoft Exchange Information Store service for the change to take effect.

Before you edit the registry, and for information about how to edit the registry, read the Microsoft Knowledge Base article 256986, "Description of the Microsoft Windows Registry" (

For more information about Hyper-Threading technology, visit the Intel Web site (

Web addresses can change, so you might be unable to connect to the Web site or sites mentioned here.