Microsoft Forefront Server Security encountered an error while performing a scan engine update.
   Scan Engine: Norman
   Update Path: http://forefrontdl.microsoft.com/server/scanengineupdate/x86/Norman
   Proxy Settings: Enabled
   Error Code: 0×80004005
   Description: An error occurred while checking if an update was available.

Microsoft Forefront Server Security encountered an error while performing a scan engine update.
   Scan Engine: Norman
   Error Code: 0×80070102
   Description: Unable to acquire the scan engine update mutex within the designated timeout period.

And in ProgramLog.txt

"INFORMATION: Attempting to download the Norman scan engine package from http://forefrontdl.microsoft.com/server/scanengineupdate/x86/Norman."
"INFORMATION: The proxy settings will be used for this connection."
"ERROR: The Norman scan engine update timed out while downloading files"
"ERROR: UpdateException: GetFileCommand failed on norman_fullpkg.cab.  (0×00002efe) The connection with the server was terminated abnormally.  WinHttpClient failed while reading data."
"INFORMATION: The Norman scan engine has been rolled back."

"INFORMATION: Attempting to download the Norman scan engine package from http://forefrontdl.microsoft.com/server/scanengineupdate/x86/Norman."
"INFORMATION: The proxy settings will be used for this connection."
"ERROR: Unable to acquire the scan engine update mutex within the designated timeout period (300 seconds)."
"ERROR: The Norman scan engine update timed out while downloading files"
"ERROR: UpdateException: GetFileCommand failed on norman_fullpkg.cab.  (0×00002efe) The connection with the server was terminated abnormally.  WinHttpClient failed while reading data."
"INFORMATION: The Norman scan engine has been rolled back."

"INFORMATION: Attempting to download the AhnLab scan engine package from http://forefrontdl.microsoft.com/server/scanengineupdate/x86/AhnLab." 
"INFORMATION: The proxy settings will be used for this connection." 
"ERROR: Unable to load manifest from: http://forefrontdl.microsoft.com/server/scanengineupdate/x86/AhnLab/Package/manifest.cab : WinHttpClient send request returned an invalid return code 404."

This happens because timeout occurs while updating the engines. The solution is to increase the default 300 seconds timeout period. This can be done by editing the following registry key:

Notice that you need to edit a registry value, so make sure you take a backup of your registry before changing any value.

Locate the REG_DWORD registry value EngineDownloadTimeout in the key:

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Forefront Server Security\Exchange Server

And increase it to 600 seconds and try to update, if the update fails again then increase the period. If it is not found, create it.

Another important thing, make sure that the engines updates schedules don’t overlap.

I found that the solution was to install Hotfix Rollup 2 for Forefront Security for Exchange Server Service Pack 1 (KB 946864).

Get-TransportServer <TransportServerName>| fl *track*

To set the maximum message tracking logs age to another period you can use the following command:

Set-TransportServer <TransportServerName> -MessageTrackingLogMaxAge dd.hh:mm:ss

Now check
Get-TransportServer <TransportServerName>| fl *track*

To solve this issue you can force Outlook to communicate directly with the global catalog server in its site or with the closest catalog if the client moves between sites.
Notice that you need to edit a registry value, so make sure you take a backup of your registry before changing any value.

To force Outlook to communicate with the closest global catalog server:
-Open the Registry Editor. Click Start, click Run, type regedit.exe, and then click OK.
-Locate the following key in the registry:
HKEY_CURRENT_USER\Software\Microsoft\Exchange\Exchange Provider
You may have to create the registry path if it does not exist.
-On the Edit menu, click Add Value, and then add the following registry value:
Value name: Closest GC
Data type: REG_DWORD
Value data: 1
-Quit Registry Editor.

Or use the following command to create the key and the value:
REG ADD “HKEY_CURRENT_USER\Software\Microsoft\Exchange\Exchange Provider” /v “Closest GC” /t REG_DWORD /d 1

To force Outlook to communicate with the a specific global catalog server:
-Open the Registry Editor. Click Start, click Run, type regedit.exe, and then click OK.
-Locate the following key in the registry:
HKEY_CURRENT_USER\Software\Microsoft\Exchange\Exchange Provider
You may have to create the registry path if it does not exist.
-On the Edit menu, click Add Value, and then add the following registry value:
Value name: DS Server
Data type: REG_SZ (string)
Value data: FQDN.OF.GlobalCatalog
-Quit Registry Editor.

Or use the following command to create the key and the value:
REG ADD “HKEY_CURRENT_USER\Software\Microsoft\Exchange\Exchange Provider” /v “DS Server” /t REG_SZ /d GC.Child.Domain.Local

EntryType : Error
EventID : 9334
Message : OALGen encountered error ffffffff while initializing the offline address list
generation process. No offline address lists have been generated.
Please check the event log for more information.
- Default Offline Address Book

Category : OAL Generator
CategoryNumber : 13
ReplacementStrings : {ffffffff, Default Offline Address Book}
Source : MSExchangeSA
TimeGenerated : 7/17/2008 3:10:31 PM
TimeWritten : 7/17/2008 3:10:31 PM

EntryType : Warning
EventID : 9109
Message : OALGen encountered an error ffffffff (internal ID 505068d) while generating address list ‘/o={Organization Name}/cn=addrlists/cn=oabs/cn=Default Offline Address Book’. Check other logged events to see if this is a serious error.
- Default Offline Address Book

Category : OAL Generator
CategoryNumber : 13
ReplacementStrings : {ffffffff, 505068d, /o={Organization Name}/cn=addrlists/cn=oabs/cn=Default Offline Address Book, Default Offline Address Book}
Source : MSExchangeSA
TimeGenerated : 7/17/2008 3:10:31 PM
TimeWritten : 7/17/2008 3:10:31 PM

Microsoft told us that this is a Bug and they are working to solve it, but don’t worry there is a workaround to generate the Offline Address Book.

When we are installing the mailbox server role the setup process will create the following registry value ‘SYSTEM\CurrentControlSet\Services\MSExchangeSA\Parameters\{Clustered-Mailbox-Server name}\OabDropFolderLocation’ which is the shared registry location between the server nodes, and points to the existing path on shared storage.

The bug is that the Exchange 2007 can not generate the OAB on the shared media using this type of cluster. So you have to change the registry value to point to a path that is stored locally on the node, e.g. ‘C:\ExchangeOAB’.
Now try to generate the offline address book.
Update-OfflineAddressBook “Default Offline Address Book”
The OAB must now be successfully generated. Do the same procedure on the other node.