An e-mail message is not delivered to a document library and Event ID 6874 is logged when you use Forefront Security for SharePoint

Article ID: 934285 - View products that this article applies to.
Important This article contains information about how to modify the registry. Make sure that you back up the registry before you modify it. Make sure that you know how to restore the registry if a problem occurs. For more information about how to back up, restore, and modify the registry, click the following article number to view the article in the Microsoft Knowledge Base:
322756
(http://support.microsoft.com/kb/322756/ )
How to back up and restore the registry in Windows
Expand all | Collapse all

SYMPTOMS

Consider the following scenario:
  • A Microsoft Office SharePoint Server 2007 farm is running on a server. Other applications are running on another server.
  • Incoming e-mail functionality is enabled for a Microsoft Windows SharePoint Services document library.
  • On an Internet Information Services server, you use Microsoft Forefront Security for SharePoint to scan e-mail messages for unsolicited commercial e-mail (UCE). UCE is also known as spam.
In this scenario, when you send an e-mail message to the document library, you experience the following symptoms:
  • The e-mail message is not delivered to the document library.
  • Event ID 6874 is logged in the Application log together with the following description:

    An error while attempting to create an attachment for an item sent via email.

    Note This log entry should begin as "An error occurred."
Back to the top | Give Feedback

CAUSE

This problem occurs because the FSCRealtimeScanner.exe process in Forefront Security for SharePoint runs under the Network Service account. This configuration is by default. Therefore, the FSCRealtimeScanner.exe process does not have access to the SPSTimer service.
Back to the top | Give Feedback

WORKAROUND

Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall the operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.

To work around this problem, configure the FSCRealtimeScanner.exe process to run under the Local System account. To do this, use set the LegacyScanAccount registry entry to 1 (one). To configure this registry entry, follow these steps:
  1. Stop the FSCController service. After you stop this service, start Windows Task Manager and then verify that the following processes do not appear in the list of running processes:
    • FSCController.exe
    • FSCRealtimeScanner.exe
  2. Start a command prompt. To do this, click Start, click Run, type cmd, and then click OK.
  3. At the command prompt, type iisreset /stop, and then press ENTER.
  4. At the command prompt, type net stop sptimerv3, and then press ENTER.
  5. Modify the registry. To do this, use one of the following steps, depending on the version of Windows that you are running:
    • For 32-bit versions of Windows, follow these steps:
      1. Click Start, click Run, type regedit, and then click OK.
      2. Locate and then click the following registry subkey:
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Forefront Server Security\SharePoint
      3. Right-click a blank area in the details pane, point to New, and then click DWORD Value.
      4. Type LegacyScanAccount, and then press ENTER to name the new registry entry.
      5. Right-click LegacyScanAccount, and then click Modify.
      6. In the Value data box, type 1 (one), and then click OK.
    • For 64-bit versions of Windows, follow these steps:
      1. Click Start, click Run, type regedit, and then click OK.
      2. Locate and then click the following registry subkey:
        HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Forefront Server Security\SharePoint\
      3. Right-click a blank area in the details pane, point to New, and then click DWORD Value.
      4. Type LegacyScanAccount, and then press ENTER to name the new registry entry.
      5. Right-click LegacyScanAccount, and then click Modify.
      6. In the Value data box, type 1 (one), and then click OK.
  6. Exit Registry Editor.
  7. At the command prompt, type net start sptimerv3, and then press ENTER.
  8. At the command prompt, type iisreset /start, and then press ENTER.
  9. Send a test e-mail message to the document library. The FSCRealtimeScanner.exe process should now run under the Local System account when you send the e-mail message to the document library.
Back to the top | Give Feedback

Properties

Article ID: 934285 - Last Review: November 20, 2007 - Revision: 2.1
APPLIES TO
  • Microsoft Forefront Security for SharePoint
Keywords: 
kbspam kbregistry kbtshoot kbprb KB934285
Back to the top | Give Feedback

Give Feedback

 
Back to the topBack to the top