There are various configuration settings that you can adjust for the Microsoft Forefront Protection 2010 for SharePoint (FPSP) realtime scan in order to meet the needs of your environment. These include selecting the number of scan engines to use for each scan, setting the action to take when malware is detected, and specifying whether or not to quarantine detected files.To configure the realtime scan
In the Forefront Protection 2010 for SharePoint Administrator Console, click Policy Management and in Antimalware, click Realtime.
In the Antimalware - Realtime pane, configure the following settings:
- Enable realtime antivirus scan—Select or clear this
check box to enable or disable the realtime scan. This setting is
enabled by default.
- Enable realtime antispyware scan—Select or clear this
check box to enable or disable the realtime antispyware scan. This
setting is enabled by default.
- Enable realtime antivirus scan—Select or clear this check box to enable or disable the realtime scan. This setting is enabled by default.
In the Antimalware - Realtime pane, in the Engines and performance section, configure the number of scan engines that should be used for this scan. For more information, see Configuring the number of scan engines used for each scan.
In the Antimalware - Realtime pane, in the Scan actions section, configure the following settings:
- Action—Select the action that you want performed when a
virus or spyware is detected. For more information, see Configuring the action
when malware is detected.
- Quarantine files—Using the drop-down list, enable (by
selecting Yes) or disable (by selecting No) saving
infected files detected by the file-scanning engines. Quarantining
is enabled by default. Enabling quarantine causes deleted files to
be storedin a secure location, from which you can recover them. For
more information about quarantine, see Viewing and managing
- Edit Malware Deletion text—You can specify deletion
text, which is used to replace the contents of an infected file
during a delete operation. The default deletion text informs you
that an infected file was removed, along with the name of the file
and the name of the malware found. To change the default text,
click Edit Deletion Text, make the modifications to the
deletion text in the Edit Malware Deletion Text dialog box,
and then click OK to return to the Antimalware -
Note: FPSP provides keywords that can be used in the deletion text field to obtain information from the message in which the infection was found. To use them, in the Malware Deletion Text dialog box, right click, select Insert Field, and then select the desired macro. For more information about this feature, see Keyword substitution macros.
- Action—Select the action that you want performed when a virus or spyware is detected. For more information, see Configuring the action when malware is detected.
In the Antimalware - Realtime pane, in the SharePoint and WSS antivirus settings section, you can optionally modify several other settings via SharePoint Central Administration. These include scanning documents when they are uploaded or downloaded, allowing users to download infected documents, and the time-out value for the realtime scan. For more information, see Configuring other settings via SharePoint Central Administration.
Optionally, configure the settings to tell FPSP what to do if a scan encounters a corrupted compressed file. For more information, see Deleting corrupted compressed files.
Optionally, configure the settings to tell FPSP what to do if certain threshold levels are exceeded. For more information, see Configuring maximum file sizes and other threshold levels.
Configuring additional realtime scan options
You can configure several additional settings for the realtime scan. In the FPSP Administrator Console, click Policy Management, and then in Global Settings, click Scan Options. In the Realtime scan section, you can configure the following settings:
- Bypass realtime scanning—You can
configure FPSP to bypass realtime scanning of all SharePoint files.
When you configure FPSP to bypass realtime scanning, no malware
scanning or filtering is performed by the realtime scan job. This
setting is disabled by default. To enable it, select the Bypass
realtime scanning check box, and then click Save.
Important: Bypassing the realtime scan should only be used for troubleshooting and under the direction of a Customer Service and Support (CSS) engineer. When enabled (it is disabled by default), the realtime scan offers no protection from malware and all files are marked as "Clean". When you are finished troubleshooting, in order to once again be protected against malware, you must restore scanning by disabling the bypass. Do this by clearing the Bypass realtime scanning check box and then clicking Save. If you bypassed scanning for any period of time, it is also recommended that you run a full scheduled scan for malware that may have been bypassed.
- Scan .doc files as containers—
Configures the realtime scan to scan .doc files and any other files
that use structured storage and the OLE embedded data format (for
example, .xls, .ppt, or .shs) as container files. This ensures that
any embedded files are scanned as potential malware carriers. This
setting is enabled by default.
- Scan after engine update—Configures
the realtime scan to rescan previously scanned files when they are
accessed following an engine update.
This setting is disabled by default. When enabled, this setting provides heightened security protection by rescanning files that have already been scanned. Files are rescanned the first time an "on-access" event occurs and during every "on-access" event after the initial one if new engine definition updates have been received since the last time the file was scanned.
Note: The SharePoint server may experience increased malware scanning when this option is enabled. This may impact server performance.
- Process Count—Configures the number of
processes you want running per Web Front End server. The default
value is 4; the maximum value is 10.
When multiple realtime processes are running, the first process scans the file unless it is busy; in which case, the file is delivered to the second process for scanning. If the second process is busy, and a third is enabled, the third process scans the file. Whenever possible, FPSP delivers files to the first process if it is available.
Multiple processes increase the load on the server at startup when the processes are being loaded, and whenever they are called upon to scan a file. More than the default number of processes should not be necessary, except in high-volume environments. Because increasing the number of processes consumes additional server resources, it is best to increase them one at a time, and evaluate the performance at each step.
It is recommended that the number of realtime processes should be set to twice the number of effective processors on the server. For example, a two-processor server or a single processor dual core server should have the realtime Process count set to the default value of 4. If the server contains two processors each of which is dual core, the recommended setting is 8.
Important: You must stop and then start the Microsoft Forefront Server Protection Controller Service and World Wide Web Publishing Service in order for changes to this setting to take effect.
- Maximum container scan time
(seconds)—Configures the number of seconds that the realtime
scan scans a compressed file before reporting it as a
"ScanTimeExceeded" incident. This option is intended to prevent the
risk of denial of service due to zip-of-death attacks. The default
value is 120 seconds (2 minutes).
Click Save after making any changes to your settings.
Indicating whether notifications should be sent
You can indicate whether virus or spyware notifications should be sent when malware is detected by using the Forefront Management Shell.
To access the Forefront Management Shell, click Start, point to All Programs, point to Microsoft Forefront Server Protection, and then click Forefront Management Shell.After accessing the Forefront Management Shell, you can issue the following command:
The possible values are $false and $true. The default of $false indicates that if virus or spyware notifications are enabled, they are sent. If they are disabled, this parameter has no effect.