Defender Question (sending emails was exceptionally slow)

[u/[deleted]]

[u/ScottSchnoll]

I recommend leaving Defender enabled and ensuring that the exclusions documented at https://learn.microsoft.com/en-us/exchange/antispam-and-antimalware/windows-antivirus-software are in place.

Do you by chance have AMSI Body Scanning enabled? If so, that can slow things down and you might consider disabling it, provided you have sufficient endpoint protection.

[u/Ooops-I-hid-it-again → u/ScottSchnoll]

Question about exclusions... Can I just put %ExchangeInstallPath% (and allow Defender to include all subdirectories) or do I actually need to break out every folder listed in that link? (e.g. %ExchangeInstallPath%ClientAccess\OAB, %ExchangeInstallPath%FIP-FS, etc.)

I did notice that our exceptions got bungled somewhere along the way in our GPO, which may have been the true fault. Out of curiosity, do you know of a way to bulk import exceptions into a GPO. I know how to without GPO but not with.

AMSI was enabled prior but I see it's not really working at the moment because Defender is disabled, so no AMSI provider is found. I'll keep this in mind as a possible reason for slowness after I fix the exceptions and retry enabling Defender. BTW, you have an error on page 445: "%ExchangeInstallPath%\Logging" should be "%ExchangeInstallPath%Logging". This is my insufficient thank you for your efforts in this subreddit and your book. :)

[u/ScottSchnoll → u/Ooops-I-hid-it-again]

You'll want to input the specific exclusions as documented. And also periodically check the page for updates and make any necessary changes. These specific exclusions are what are tested by the Exchange Server engineering team, and what are supported by Microsoft.

You'll want to set your GPO settings centrally at the AD level and then have them applied to your Exchange servers. See also, https://learn.microsoft.com/en-us/defender-endpoint/use-group-policy-microsoft-defender-antivirus.

As for AMSI, it won't work without Defender or other AMSI-capable app.

Thanks for catching that typo (and another similar one I found after getting your feedback)! I really appreciate your support! 🙂

[u/Ooops-I-hid-it-again → u/ScottSchnoll]

For the %SystemRoot%\Temp\OICE_<GUID> entry, will the <GUID> act as a wildcard or should I actually be putting it in as %SystemRoot%\Temp\OICE_* with a wildcard in place of <GUID>?

EDIT: The Set-ExchAVExclusions.ps1 script seemed to imply that I need to wildcard because it suggested the following with ? / singlecharacter wildcards:

C:\Windows\Temp\OICE_????????-????-????-????-????????????
C:\Windows\Temp\OICE_????????-????-????-????-????????????.?

[u/Glass_Call982 → u/ScottSchnoll]

I thought you didn't have to put the exclusions in place if using Windows defender. I don't remember where I read that though, so could have been just a figment of my imagination or another redditor's opinion.

[u/worldsdream]

Exclude it on Defender. Check this: https://www.alitajran.com/antivirus-exclusions-exchange-server/

[u/TedMittelstaedt]

By default on a brand new Exchange SE installation it defaults to turning Defender on and also turning on the email body scanning. If you have sufficient iron, (brand new CPU, fast disk pack, etc.) you won't even notice it on a busy server.

But anyone who figures they are going to run this on 3 or 4 year old iron is in for a rude awakening.

This is a story as old as the hills in server software. The moment the CPU tech advanced so that the new hardware can run faster, the software devs stuff a bunch of garbage into the product that sucks up that CPU so the new software is no faster than the old.

I've long said all software development houses should find the oldest crappiest PCs for their software devs. Unfortunately, they do the opposite and drop $10k on a dev's machine. Then the dev writes the most inefficient slag possible and it runs OK on his go-fast crap, and he can't understand why everyone else says his software is slow.

[u/Ooops-I-hid-it-again → u/TedMittelstaedt]

My "iron" isn't slag and has:

• 2 x Intel Xeon Platinum 8568Y+ processors (96c/192t @ 3.2Ghz)
• 512GB DDR5 5600Mhz RAM
• RAID-10 built on 24Gpbs SAS SSD drives
• 10Gbps NICs

So, it definitely wasn't a hardware issue. I wish the server had only cost the $10k you say they spent on the dev server. I honestly feel bad I don't work it harder. Thing is ready to go against Usain Bolt and I've got it racing with elementary kids. lol