Exchange 2013 built-in anti-malware: MS Filtering Engine Update process was unsuccessful in contacting the Primary Update Path

Issue: Exchange 2013 cannot download anti-malware updates

Event Viewer error:

MS Filtering Engine Update process was unsuccessful in contacting the Primary Update Path. Update Path: http://forefrontdl.microsoft.com/server/scanengineupdate

·        Source: FIPFS

·        ID: 6027
·        User: Network Service
 

Exchange 2013 server:

·        The Exchange 2013 server has Internet access and can access path: http://forefrontdl.microsoft.com/server/scanengineupdate

·        Exchange installed on D: drive
·        Exchange 2013 CU9 (Multi-Role) on Windows 2012 R2

 

Exchange 2013 Malware Engine Updates Troubleshooting states:

“If the above will not resolve your issue check that "NT AUTHROITY\Network Service" has full access for the folder Program Files\Microsoft\Exchange\V15\FIP-FS\Data\Engines\amd64\Microsoft\bin, in case you have installed Exchange in different drive, you need to add "NT AUTHROITY\Network Service" on the drive itself.”
 

My ‘solution’:

·        Browse with File Explorer to D:\Program Files\Microsoft\Exchange\V15\FIP-FS\Data\Engines\amd64\Microsoft\bin

·        When accessing FIP-FS directory (and some other subdirectories) File Explorer displays a dialog box that prompts you with the following: You don’t currently have permission to access this folder. Click Continue to permanently get access to this folder.

·        After clicking Continue you are able to browse directory contents

·        NTFS security permissions on D:\Program Files\Microsoft\Exchange\V15\FIP-FS\Data\Engines\amd64\Microsoft\bin show NETWORK SERVICE with appropriate permissions

After performing these steps anti-malware updates are being downloaded.

Event Viewer:

MS Filtering Engine Update process performed a successful scan engine update.
Scan Engine: Microsoft
Update Path: http://forefrontdl.microsoft.com/server/scanengineupdate

·        Source: FIPFS
·        ID: 6033
·        User: Network Service


Links:

·        When you click Continue for folder access in Windows Explorer, your user account is added to the ACL for the folder