======Microsoft - Exchange - Notes - Scanningprocess.exe crashes======

// Observed on Exchange Server 2016 CU 19 on Windows Server 2016. //

=====Scenario=====
After removing the Backup Exec Agent 16.0.1142 from an Exchange Server 2016 server and rebooting the mails were suddenly not delivered anymore and were stuck in the Submission queue with last error "Message deferred by categorizer agent".

The Event Log showed that the scanningprocess.exe crashed multiple times in succession with error 0xc0000005 (access violation):

<code>
Log Name:      Application
Source:        Application Error
Date:          13-8-2021 13:05:08
Event ID:      1000
Task Category: (100)
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      EX1.domain.local
Description:
Faulting application name: scanningprocess.exe, version: 15.1.2176.14, time stamp: 0x6088b147
Faulting module name: scanningprocess.exe, version: 15.1.2176.14, time stamp: 0x6088b147
Exception code: 0xc0000005
Fault offset: 0x000000000005c5fd
Faulting process id: 0x48d8
Faulting application start time: 0x01d7903313c0e66e
Faulting application path: C:\Program Files\Microsoft\Exchange Server\V15\FIP-FS\Bin\scanningprocess.exe
Faulting module path: C:\Program Files\Microsoft\Exchange Server\V15\FIP-FS\Bin\scanningprocess.exe
Report Id: 11bbc60e-4d86-4c73-8572-c1b8fb967af5
Faulting package full name:
Faulting package-relative application ID:
</code>

And the Microsoft Filtering Management Service also crashed multiple times.


=====Workaround=====

The workaround was to disable the malware transport agent with:

<code>
& $env:ExchangeInstallPath\Scripts\Disable-Antimalwarescanning.ps1
</code>

Followed by a restart of the Transport Agent service.
<code>
Restart-Service MSExchangeTransport
</code>

After this the mails stuck in the Submission queue and subsequent mails will now be delivered, but they will no longer be scanned for malware until the malware transport agent is turned on again.

Source: [[https://docs.microsoft.com/en-us/exchange/disable-or-bypass-anti-malware-scanning-exchange-2013-help|Disable or bypass anti-malware scanning]] for Exchange 2013, but also works on Exchange 2016.


====="Solution"=====

Installing CU 21 for Exchange Server 2016 solved this issue.

When installing CU 21 it complained at the prerequisite check that Visual Studio C++ 2013 Redistributables weren't installed.

After installing the Visual Studio C++ 2013 Redistributables manually the CU 21 installation was completed without problems and the original problem was solved.

The malware transport agent was re-enabled with:
<code>
& $env:ExchangeInstallPath\Scripts\Enable-Antimalwarescanning.ps1
</code>

Followed by a restart of the Transport Agent service.
<code>
Restart-Service MSExchangeTransport
</code>

The assumption is that the removal of the Backup Exec Agent 16.0.1142 agent also removed the Visual Studio C++ 2013 Redistributables, but this was not further investigated. 

As the Visual Studio C++ 2013 Redistributables are listed on the [[https://docs.microsoft.com/en-us/Exchange/plan-and-deploy/prerequisites?view=exchserver-2016|Exchange Server prerequisites]] page for Exchange Server 2016 it is unlikely that they weren't installed before removing Backup Exec 11.


=====Similar cases found online=====

[[https://docs.microsoft.com/en-us/answers/questions/302892/the-fip-fs-scan-process-failed-initialization-erro.html|Micrsoft Q&A - The FIP-FS Scan Process failed initialization. Error: 0x80010105 AND Faulting application name: scanningprocess.exe]] \\
[[https://social.msdn.microsoft.com/Forums/windowsdesktop/en-US/58d7271e-62b3-47b6-975a-94277f7a6e29/attachment-filtering-does-not-work-scanningprocessexe-does-not-work?forum=exchangesvrdevelopment|Windows Dev Center - Attachment Filtering Does Not Work / ScanningProcess.exe Does Not Work RRS feed]] \\
[[https://social.technet.microsoft.com/Forums/en-US/33020637-55a8-4c03-a239-e8aabff23b4d/the-fipfs-scan-process-failed-initialization?forum=exchangesvrsecuremessaging|TechNet - The FIP-FS Scan Process failed initialization]] \\