In environments with multiple Exchange servers, it is a good idea to use one server to download antivirus engine and definition updates from Microsoft and distribute them to the other servers in the environment.
The most common method of distributing engine and definition updates is to use Universal Naming Convention (UNC) updating where one Exchange server (the redistribution server or “hub”) downloads updates from the Microsoft HTTP server and then hosts those updates for the rest of the Exchange servers in your environment (the receiving servers or “spokes”). After the redistribution server downloads an update, any receiving server whose update path points to the redistribution server can download the updates from the redistribution server.
Note: You must configure both the hub and spoke servers before distributing updates.

Table of Contents




Configuring the redistribution (hub) server and UNC credentials


1.     To prepare a server to act as an update hub, establish a Windows share for its Engines directory (which is, by default, in c:\Program Files\Microsoft Forefront Security\Exchange Server\Data).


2.     Enable the Redistribution Server option in the Scanner Updates section of General Options on the chosen hub server. This configures Forefront Security for Exchange Server to save the two most recent engine update packages in the engine package folder instead of the usual single engine package. FSE will also download the full update package rather than perform an incremental update. The multiple engine packages enable the spoke servers to continue pulling updates from the redistribution server while a new update is being downloaded.

3.     Ensure that the redistribution server is configured to download engine and definition updates for all of the antivirus engines. If you are not sure how to do this, refer to the File Scanner Updating topic on TechNet.

4.     Enter the UNC credentials.

Configuring the UNC credentials


1.     In the SETTINGS section of the Shuttle Navigator, select General Options.

2.     In the Scanner Updates section, select Use UNC Credentials.
3.     In the UNC Username field, enter the name of a user with access rights to the UNC path. For more information, see "General Options" in Forefront Server Security Administrator.
4.     In the UNC Password field, enter the password for that user.
5.     Click Save to save your changes.


Configuring the spoke servers

After the hub server has been set up, configure the spoke servers to point to the shared directory by entering the hub's UNC path (\\ServerName\ShareName), in the Primary Network Update Path field of each of the spokes.

Note: Using static IP addresses within the update path is neither recommended nor supported.
Example:>UNC Password field, enter the password for that user.