How to use the Fscutility.exe program to disconnect the Forefront Security services from Exchange Server or from SharePoint Portal Server

This article describes how to use the Fscutility.exe program in Microsoft Forefront Security for Exchange or in Microsoft Forefront Security for SharePoint to disconnect the Forefront Security services from Microsoft Exchange Server or from Microsoft SharePoint Portal Server.

Note Forefront Security for Exchange was previously called Microsoft Antigen for Exchange. Forefront Security for SharePoint was previously called Antigen for SharePoint.

Warning This workaround may make a computer or a network more vulnerable to attack by malicious users or by malicious software such as viruses. We do not recommend this workaround but are providing this information so that you can implement this workaround at your own discretion. Use this workaround at your own risk.

If you are an administrator, you can use the Fscutility.exe program to disconnect the Forefront Security services from the Exchange server or from the SharePoint server. After you disconnect the Forefront Security services from the Exchange server or from the SharePoint server, Forefront Security is disabled.

In this scenario, Forefront Security remains installed. However, it is no longer connected to the Exchange server or to the SharePoint server. Therefore, Forefront Security cannot scan incoming and outgoing e-mail messages. You may have to disable Forefront Security to do any of the following:

• Troubleshoot issues with Forefront Security
• Run diagnostics on the server
• Install a service pack on the server

For example, if you are experiencing an issue with Forefront Security but you are not sure whether the issue is caused by Forefront Security, you can use the Fscutility.exe program to disable Forefront Security. Then, you can test to see whether the issue still occurs.

You can use the following command-line options with the Fscutility.exe program:

• /status Use this option to display the status of Forefront Security and of the Exchange server or the SharePoint server.
• /enable Use this option to enable Forefront Security if the Exchange server or the SharePoint server services have been stopped.
• /disable Use this option to disable Forefront Security if the Exchange server or the SharePoint server services have been stopped.
• /remove Use this option to remove Microsoft Forefront Security’s registry keys.
• /regmon Use this option to register FSCMonitor.
• /unregmon Use this option to unregister FSCMonitor.

To use the Fscutility.exe program to disconnect the Forefront Security services from the Exchange server or from the SharePoint server, follow these steps:

1. Stop the Exchange server services or the SharePoint server services and the Forefront Security services. To do this, follow these steps:
   1. Click Start, click Run, type services.msc, and then click OK.
   2. Right-click the service that you want to stop, and then click Stop.
      
      Note Stop the Exchange server services in the following order:
      1. FSCController
      2. Microsoft Exchange Transport Service
      3. System Attendant
      4. Information Store
      
      Note Stop the SharePoint server services in the following order:
      1. FSCController
      2. IIS Admin Service
      Note When you stop the Exchange server services or the SharePoint server services, the Forefront Security services will be stopped automatically. If a Forefront Security service is still running after you stop the Exchange server services or the SharePoint server services, right-click the Forefront Security service that is still running. Then, click Stop.
2. Start a command prompt, and then move to the Forefront Security for Exchange folder. By default, the Forefront Security for Exchange folder is in the following location:
   Program Files (x86)\Microsoft Forefront Security\Exchange Server
   The Forefront Security for SharePoint folder is in one of the following locations:
   • x86
     Program Files\Microsoft Forefront Security\SharePoint
   • x64 or IA-64
     Program Files (x86)\Microsoft Forefront Security\SharePoint
3. At the command prompt, type the following command to disable the Forefront Security service, and then press ENTER.
   
   Important When you run this command, the Forefront Security services will be disconnected from the Exchange Server or from the SharePoint server. During this time, Forefront Security will be disabled. Forefront Security will not be protecting your environment by using enhanced virus protection. We recommend that you use the Fscutility.exe program to disable Forefront Security only in a controlled environment. Additionally, make sure that you use an alternative method to maintain enhanced virus protection when Forefront Security is disabled.
   
   Fscutility /disable
   
   After you run this command, you receive the following message:
   Microsoft Forefront Server Security VSAPI hooking dll is disabled.
   Status: Microsoft Forefront Server Security NOT Integrated
   To enable the Forefront Security service, type the following command, and then press ENTER:
   
   Fscutiliy /enable
   
   After you run the command, you receive the following message:
   Microsoft Forefront Server Security VSAPI hooking dll is enabled.
   Status: Microsoft Forefront Server Security successfully integrated!
4. To make sure that the Forefront Security services are disconnected from the Exchange server or from the SharePoint server, type Fscutility /status, and then press ENTER.
5. Troubleshoot Forefront Security, run diagnostics, or install a service pack.
6. Restart the Exchange server or the SharePoint server services that you stopped. To do this, follow these steps:
   1. Click Start, click Run, type services.msc, and then click OK.
   2. Right-click the Exchange server services or the SharePoint server services that you want to start, and then click Start.
      
      After you start the Exchange server services or the SharePoint server services, make sure that the Forefront Security services have restarted. The Forefront Security services should automatically restart after you restart the Exchange server services. If a Forefront Security service has not restarted, right-click the Forefront Security service, and then click Start.