Exchange Virus Scanning API has low thread count

[This topic is intended to address a specific issue called out by the Exchange Server Analyzer Tool. You should apply it only to systems that have had the Exchange Server Analyzer Tool run against them and are experiencing that specific issue. The Exchange Server Analyzer Tool, available as a free download, remotely collects configuration data from each server in the topology and automatically analyzes the data. The resulting report details important configuration issues, potential problems, and nondefault product settings. By following these recommendations, you can achieve better performance, scalability, reliability, and uptime. For more information about the tool or to download the latest versions, see "Microsoft Exchange Analyzers" at]  

Topic Last Modified: 2009-09-29

The Microsoft® Exchange Server Analyzer Tool reads the following registry entry to determine the value for ScanningThreads:


The ScanningThreads registry value represents the maximum number of Virus Scanning API (VSAPI) threads that are allocated for scanning.

The Exchange Server Analyzer also reads the following registry entry to determine whether VSAPI message scanning is enabled:


A value of 1 for Enabled indicates that VSAPI scanning is enabled. A value of 0 indicates VSAPI scanning is not enabled.

Additionally, the Exchange Server Analyzer queries the Win32_ComputerSystem Microsoft Windows® Management Instrumentation (WMI) class to determine the following:

  • If the NumberOfLogicalProcessors property exists in WMI, the Exchange Server Analyzer determines the current value for NumberOfLogicalProcessors. NumberOfLogicalProcessors returns the logical processor count in the computer. This property is available in Windows Server 2008. By default, NumberOfLogicalProcessors is not available in Windows Server 2003. The hotfix that is mentioned in Microsoft Knowledge Base article 932370, "The number of physical hyperthreading-enabled processors or the number of physical multicore processors is incorrectly reported in Windows Server 2003" ( adds the NumberOfLogicalProcessors property to Windows Server 2003.

  • If the NumberOfLogicalProcessors property does not exist the Exchange Server Analyzer determines the current value for NumberOfProcessors. In Windows Server 2008, NumberOfProcessors only returns the number of physical processors. By default, in Windows Server 2003, NumberOfProcessors returns the number of logical processors.

The returned value represents the number of processors installed on the computer, and it includes both physical processors and logical processors. Using Hyper-Threading technology from Intel, a physical processor can be split into two logical processors.

If the Exchange Server Analyzer finds that the value for ScanningThreads is less than (2 × NumberOfProcessors) + 1 on an Exchange Server computer that has VSAPI scanning enabled, a warning is displayed. The optimal value for ScanningThreads is equal to (2 × NumberOfProcessors) + 1. For example, on an Exchange Server computer with two processors, the optimal value for ScanningThreads is 5.


If Hyper-Threading is enabled, the value for the number of logical processors will be double the number of physical processors. It is recommended that you check with your antivirus software manufacturer to determine if physical or logical processors should be used in the above formula.


This article contains information about editing the registry. Before you edit the registry, make sure you understand how to restore the registry if a problem occurs. For information about how to restore the registry, view the "Restore the Registry" Help topic in Regedit.exe or Regedt32.exe.

To correct this warning

  1. Open a registry editor, such as Regedit.exe or Regedt32.exe.

  2. Navigate to: HKLM\System\CurrentControlSet\Services\MSExchangeIS\VirusScan

  3. In the right pane, double-click ScanningThreads.

  4. Enter the value returned from the above formula.

  5. Close the registry editor, and then restart the Microsoft Exchange Information Store service for the change to take effect.

Before you edit the registry, and for information about how to edit the registry, see the Microsoft Knowledge Base article 256986, "Description of the Microsoft Windows Registry" (

For more information about Hyper-Threading technology, visit the Intel Web site.


Web addresses can change, so you might be unable to connect to the Web site or sites mentioned here.