Commands › Exchange Online

Set-MalwareFilteringServer

Exchange Online ExchangeOnlineManagement Set-*

Configure the Malware agent settings in the Transport service on a Mailbox server.

Quick start script

# Set-MalwareFilteringServer — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org

# 2. Capture the current state first — you cannot roll back what you never recorded
$before = Get-MalwareFilteringServer
$before | Format-List

# 3. Make the change (dry run first)
Set-MalwareFilteringServer -Identity <MalwareFilteringServerIdParameter> -WhatIf
Set-MalwareFilteringServer -Identity <MalwareFilteringServerIdParameter>

# 4. Verify and diff
$after = Get-MalwareFilteringServer
Compare-Object ($before | Out-String) ($after | Out-String)

Syntax

Set-MalwareFilteringServer [-Identity] <MalwareFilteringServerIdParameter>
 [-BypassFiltering <Boolean>]
 [-Confirm]
 [-DeferAttempts <Int32>]
 [-DeferWaitTime <Int32>]
 [-DomainController <Fqdn>]
 [-ForceRescan <Boolean>]
 [-MinimumSuccessfulEngineScans <Int32>]
 [-PrimaryUpdatePath <String>]
 [-ScanErrorAction <MalwareScanErrorAction>]
 [-ScanTimeout <Int32>]
 [-SecondaryUpdatePath <String>]
 [-UpdateFrequency <Int32>]
 [-UpdateTimeout <Int32>]
 [-WhatIf]
 [<CommonParameters>]

Parameters (15)

Parameter	Type	Required	What it controls
-Identity	MalwareFilteringServerIdParameter	yes	The Identity parameter specifies the server where you want to configure the anti-malware settings. You can use any value that uniquely identifies the server. For example:
-BypassFiltering	Boolean		The BypassFiltering parameter temporarily bypasses malware filtering without disabling the Malware agent on the server. The Malware agent is still active, and the agent is still called for every message, but no...
-Confirm	SwitchParameter		The Confirm switch specifies whether to show or hide the confirmation prompt. How this switch affects the cmdlet depends on whether the cmdlet requires confirmation before proceeding.
-DeferAttempts	Int32		The DeferAttempts parameter specifies the maximum number of times to defer a message that can't be scanned by the Malware agent. Valid input for this parameter is an integer between 1 and 5. The default value is 3.
-DeferWaitTime	Int32		The DeferWaitTime parameter specifies the time period in minutes to increase the interval to resubmit messages for malware filtering in an effort to reduce the workload on the server.
-DomainController	Fqdn		The DomainController parameter specifies the domain controller that's used by this cmdlet to read data from or write data to Active Directory. You identify the domain controller by its fully qualified domain name...
-ForceRescan	Boolean		The ForceRescan parameter specifies that messages should be scanned by the malware agent, even if the message was already scanned by cloud-based protection. Valid values are:
-MinimumSuccessfulEngineScans	Int32		This parameter is reserved for internal Microsoft use.
-PrimaryUpdatePath	String		The PrimaryUpdatePath parameter specifies where to download malware scanning engine updates. The default value is `http://forefrontdl.microsoft.com/server/scanengineupdate`. The location specified by the...
-ScanErrorAction	MalwareScanErrorAction		The ScanErrorAction parameter specifies the action to take when a message can't be scanned by the malware filter. Valid values for this parameter are Block or Allow. The default value is Block.
-ScanTimeout	Int32		The ScanTimeout parameter specifies the timeout interval in seconds for messages that can't be scanned by the malware filter. Valid input for this parameter is an integer between 10 and 900. The default value is 300...
-SecondaryUpdatePath	String		The SecondaryUpdatePath parameter specifies an alternate download location for malware scanning engine updates. The default values is blank ($null). This means no alternate download location is specified.
-UpdateFrequency	Int32		The UpdateFrequency parameter specifies the frequency interval in minutes to check for malware scanning engine updates. Valid input for this parameter is an integer between 1 and 38880 (27 days). The default value is...
-UpdateTimeout	Int32		The UpdateTimeout parameter specifies the timeout interval in seconds to use when checking for malware scanning engine updates. Valid input for this parameter is an integer between 60 and 300. The default value is...
-WhatIf	SwitchParameter		The WhatIf switch shows what the command does without making any changes. You don't need to specify a value with this switch.

Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.