Exchange 2016: TransportRoles\data\Temp\UnifiedContent directory clutters up the hard disk

An interesting problem was pointed out to me today. A reader reported the directory "TransportRoles\data\Temp\UnifiedContent" within the Exchange installation directory, which contains a lot of data and keeps filling up the hard disk.

I then had a look at my private installation and was also able to find some very old data in the relevant directory. Here is a screenshot of the "TransportRoles\data\Temp\UnifiedContent" directory:

The directory can be found under the path "$exinstall\TransportRoles\data\Temp\UnifiedContent"

cd $exinstall\TransportRoles\data\Temp\UnifiedContent

In my case, only a few hundred MB were stored there, but in the reader's case it was around 60 GB. The question "Can this go away?" is justified, especially if you are a little short of storage space.

The "Malware Agent" transport agent is responsible for the directory:

The agent is part of Exchange's built-in malware scanner and it stores a copy of every scanned mail in the directory mentioned. In principle, every mail with an attachment ends up in the directory.

Unfortunately, Exchange does not seem to clean this up, or the limits are very high. However, the directory can also be cleaned up manually. So if you find a lot of files here, you can delete the contents of the directory to create space again.

To the question "Can it go away?": Yes, it can go away and the malware agent with it...

In my opinion, the built-in Exchange AntiMalware Agent is not very effective. If an upstream SPAM filter is already scanning for viruses and malware, then the probability of the Exchange Malware Agent recognizing a malicious mail that has slipped through the SPAM filter is almost zero. Here I once had a simple test carried out.

Switching off the malware agent can be done with the following commands, here the transport service is also restarted, therefore no mails can be received for the period of the restart (normally not critical, as the service restarts quickly and mails end up in queues accordingly):

cd $exscripts
.\Disable-Antimalwarescanning.ps1
Restart service MSExchangeTransport

For the sake of completeness, the Malware Agent can also be reactivated:

cd $exscripts
.\Enable-Antimalwarescanning.ps1
Restart service MSExchangeTransport