Exchange 2003 – Antigen 1023 Errors\Performance Logs?
We began seeing Event Id 1023 errors on all of our Backend Exchange servers that are running Sybari’s Antigen Anti-Virus suite. This problem occurs because the Performance Logs and Alerts service (Smlogsvc.exe) does not have sufficient permissions to access the performance counter DLL directory (C:\Program Files\Sybari Software\Antigen for Exchange) for Microsoft Antigen Services (Version: 9.00.1055). The Smlogsvc.exe service runs as the Network Service account (Local machine) which requires "Read" permissions within the directory. More specifically, the AntigenPMDLL.dll file controls the Antigen Perfmon Counters. Adding the "Read" permission for the Network Service account on the AntigenPMDLL.dll file resolved the problem. This KB article goes into more detail on a similar issue involving SQL server.