When a DAT update occurs, the scanning of mail and other items temporarily stops as the MSME scanning engine loads the new DAT files. In addition, if MSME is managed by ePolicy Orchestrator, the scanning engine reloads policies at every policy push interval scheduled in ePO. As with the DAT files, when these policies are reloaded, the scanning engine stops temporarily and is restarted when the process completes.

If your Exchange server is under heavy load when these events occur, mail can start to build up in the submission queue, and the Event ID described above will appear in the Application log.