Topic Last Modified: 2005-11-18

The Microsoft® Exchange Server Analyzer Tool queries the Win32_Service Microsoft Windows® Management Instrumentation (WMI) class to determine whether a value is set for the Started key on the SMSMSE (Symantec Mail Security for Microsoft Exchange) service. The Win32_Service class determines whether SMSMSE is installed on the Exchange Server 2003 computer. A value of True indicates that the SMSMSE service is running. A value of False indicates that the SMSMSE service is not running. The Exchange Server Analyzer displays a warning if the following conditions exist:

In Exchange Server 2003, the advanced queuing engine uses the Exchange Transport AntiVirus API as one of the six transport event sinks to deliver messages to their destinations. The Exchange Transport AntiVirus API event sink is implemented in OnSubmit.dll and enables non-Microsoft vendors, such as Symantec, to implement virus scanners, which examine each message for malicious attachments and data structures before they reach their destinations. This event is registered for the OnSubmission event.

By default, transport antivirus scanning is not enabled because it causes messages to be scanned twice, one time at the SMTP layer and one time in the Exchange store. However, if you are using front-end servers to connect an Exchange organization to the Internet, you can enable transport antivirus scanning on these servers.

This article contains information about editing the registry. Before you edit the registry, make sure you understand how to restore the registry if a problem occurs. For information about how to restore the registry, view the "Restore the Registry" Help topic in Regedit.exe or Regedt32.exe.
To enable transport antivirus scanning
  1. Open a registry editor, such as Regedit.exe or Regedt32.exe.

  2. Navigate to HKEY_LOCAL_MACHINE\Software\Microsoft\Exchange\TransportAVAPI.

  3. Create a new DWORD value with a value name called Enabled. Assign a value data of 1 to the Enabled value name.

  4. Close the registry editor.

Before you edit the registry, and for information about how to edit the registry, see the Microsoft Knowledge Base article 256986, "Description of the Microsoft Windows registry" (

Transport-scanning functionality is available only with Exchange virus scanners that are based on Virus Scanning Application Programming Interface (VSAPI) 2.5.

For more information about SMTP Transport Architecture, see the Exchange Server 2003 Technical Reference Guide (

For more information about how to use antivirus software with Exchange Server, see the following Knowledge Base articles:

For a list of third-party antivirus software that is available for Exchange Server, see the Exchange Server Partners: Antivirus Web site (

Web addresses can change, so you might be unable to connect to the Web site or sites that are mentioned here.