Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

Unable to open vaulted message from Outlook

Created: 19 Dec 2012 • Updated: 20 Dec 2014 | 20 comments
This issue has been solved. See solution.

I have a curious situation.  I have one user who cannot open vaulted messages in her Outlook.  She gets the following pop-up:

"Could not process the selected items.  Reason: A server error has occurred."

"The URL sent to the web server did not contain enough information."

There is also a message across the top of the message window in Outlook that reads"

         This item was archived by Enterprise Vault on Tuesday, December 04, 2012 9:59:03 AM.

There was an error loading this item - some functionality may not be available.

Some data points:

- User is working from freshly imaged workstation with Windows 7 SP1, Outlook 2010, SEV HTTP-only add-in 9.0.4.R1

- User has apparently never been able to view vaulted messages on this workstation.

- User can access vaulted messages from same workstation via OWA.

- I can log into user's workstation and access my vaulted messages in Outlook 2010.

- User can log into another workstation, creating a new local profile, and get same error in Outlook 2010.

- The SEV Outlook add-in has been removed and re-installed.

- SEV server is 9.0.4.R1

Comments 20 CommentsJump to latest comment

Rob.Wilcox's picture

Have you tried obtaining a client trace?

With maximum logging enabled?

Do they see the Enterprise Vault ribbon inside Outlook?

It is interesting that you say that OWA works fine for them - implying that the Enterprise Vault settings, contained in a hiddem message in the mailbox, are okay.  It is further interesting that you say that on a different machine, they get the same error.

JesusWept3's picture

Is it cached or uncached btw?
May just need to run a quick repair in Outlook in order for it to force the downloading of the hidden message again (used to ScanOST.exe but is now part of the main repair routine in Outlook 2010)

There is also this technote which talks about host headers, but that would most likely mean everyone was affected and not just this user.

http://www.symantec.com/business/support/index?page=content&id=TECH55529

Also does the user have any proxy enabled in IE?
If so, does it work if you disable it? And is EV correctly added to the proxy bypass lists?

TonySterling's picture

I would try the TN about host headers.  I have seen it be the cause of this issue and not everyone was affected.

Rob.Wilcox's picture

<snip>

Is it cached or uncached btw?
May just need to run a quick repair in Outlook in order for it to force the downloading of the hidden message again (used to ScanOST.exe but is now part of the main repair routine in Outlook 2010)

</snip>

From OP:

<snip>

- User can log into another workstation, creating a new local profile, and get same error in Outlook 2010.

</snip>

JesusWept3's picture

errr, thanks?

RhoSysAdmin's picture

I've already stumbled upon that TN.  I checked my IIS setup and we have no headers defined.

The user's Outlook setup is not cached.  There is no PST in her profile directory to scan.

JesusWept3's picture

Then a client trace will be necessary to see how it's calling the URL

What about the proxy settings??

RhoSysAdmin's picture

No proxy's.  What do I run my client trace against?

TonySterling's picture

You create the client trace in Outlook and just try to recall some archived items.

To set the client trace press CTRL+SHIFT keys together, keep pressed, click on an EV Icon.  This should open the Client Diagnostics page.  Set the logging level to max, close Outlook and re-open and try to open some items. 

Please attach that log here and we will take a look.

RhoSysAdmin's picture

My user is now on vacation for Christmas.  It looks like I'll need to wait until Jan to find out what the client trace finds.

Thanks for the help.  I'll reply back when I have the trace.

RhoSysAdmin's picture

My user has returned from vacation and created the "Max trace" log file for me.  It's attached.

AttachmentSize
ev_client_log_20130102113948.txt 236.98 KB
Rob.Wilcox's picture

They are getting a rather generic 'error' when they try to open an item:

<snip>

02/01/2013 16:40:32.868[1972][L]: ~CDownloadBytesImpl::Connect: 0x80004005
02/01/2013 16:40:32.868[1972][L]: CDownloadBytesImpl::OutlookExiting
02/01/2013 16:40:32.868[1972][L]: ~CDownloadBytesImpl::OutlookExiting
02/01/2013 16:40:32.868[1972][L]: CDownloadBytesImpl::OutlookExiting
02/01/2013 16:40:32.869[1972][L]: ~CDownloadBytesImpl::OutlookExiting
02/01/2013 16:40:32.869[1972][L]: CDownloadBytesImpl::DeleteCritSect
02/01/2013 16:40:32.869[1972][L]: ~CDownloadBytesImpl::DeleteCritSect
02/01/2013 16:40:32.869[1972][L]: CDownloadBytesImpl::Complete
02/01/2013 16:40:32.869[8592][L]: ~CDownloadBytesImpl::WaitComplete
02/01/2013 16:40:32.869[8592][L]: ~CDownloadBytes::WaitComplete
02/01/2013 16:40:32.869[8592][L]: CDownloadBytes::End
02/01/2013 16:40:32.869[8592][L]: CDownloadBytesImpl::End
02/01/2013 16:40:32.869[8592][M]: Waiting for DownloadBytes thread, THID=1972 to exit
02/01/2013 16:40:32.870[1972][L]: ~CDownloadBytesImpl::Complete
02/01/2013 16:40:32.870[1972][L]: ~CDownloadBytesImpl::ThreadMain
02/01/2013 16:40:32.870[1972][M]: CThreadManager::Remove thread THID=1972
02/01/2013 16:40:32.870[1972][L]: ~CDownloadBytesImpl::FetchDataInThread
02/01/2013 16:40:32.870[8592][L]: ~CDownloadBytesImpl::End
02/01/2013 16:40:32.870[8592][L]: ~CDownloadBytes::End
02/01/2013 16:40:32.871[8592][L]: CDownloadBytes::Result
02/01/2013 16:40:32.871[8592][L]: ~CDownloadBytes::Result
02/01/2013 16:40:32.871[8592][L]: DesktopTls::TlsData::PopDownloadBytes
02/01/2013 16:40:32.871[8592][L]: ~DesktopTls::TlsData::PopDownloadBytes 

02/01/2013 16:40:32.871[8592][L]: ~CDownloadSTA::DoDownload: 0x80004005</snip>

The URL they're hitting is:

<snip>

02/01/2013 16:40:32.849[8592][M]: Downloading: http://evserver/EnterpriseVault/download.asp?VaultID=19D24AB2B34E4DE4794F9230C6B1798071110000evserver&SaveSetID=201212064797495~201211211953020000~Z~8098D6CF1A210E0F6ACA6BAFDC6E0EB1&FormatType=Unicode&Client=EV9.0.4.1097-Outlook14&Format=MUD&AttachmentID=0

</snip>

Can you try that in Internet Explorer and report back findings, please?

It is another one of those days when I don't have an EV environment set up..  But I also see failures to connect like this :

<snip>

02/01/2013 16:39:48.936[6560][M]: HaveConnection::ExecuteTest - Connection test to: evserver/EnterpriseVault/clienttest.gif failed

</snip>

And

<snip>

02/01/2013 16:40:48.969[6560][M]: HaveConnection::ExecuteTest - Connection test to: evserver/EnterpriseVault/clienttest.gif failed

</snip>

RhoSysAdmin's picture

User gets an error message that "The webpage cannot be found."

Rob.Wilcox's picture

What happens if they go to :

http://evserver/enterprisevault

?

Still an error message?

I mean ..  that's gotta be a clue right?  Is that the name of your EV server?  Can it be pinged?

RhoSysAdmin's picture

The user gets a "web page not found" error when she clicks on http://evserver/enterprisevault as well, but nslookup of evserver works for her as well as pinging of evserver from her computer.

Rob.Wilcox's picture

This URL - http://evserver/enterprisevault

Does the URL work for you?

Does the URL work for other people?

What is different about these particular machines? Are they resolving to the correct address? Is there a proxy server configured in Internet Explorer which is forcing HTTP traffic to take a different path to the NSLOOKUP or PING commands?

RhoSysAdmin's picture

I had three other people try the same url and it works for them.  There is no proxy. 

I can find no occurrence of this one user's logon name in the IIS logs in C:\WINDOWS\system32\LogFiles\W3SVC1 for my EV server.  That makes sense actually, since she's getting an error on her end. 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTTP\Parameters]

"MaxFieldLength"=dword:00010000

"MaxRequestBytes"=dword:00010000

I did an iisreset on my EV server after adding these two keys.  We've had a MaxTokenSize key set for workstations for quite a while to deal w/ the large group membership issue.  But in the end this has not worked.  I'm wondering if I need to restart all EV services or bounce the server itself?

Rob.Wilcox's picture

So I would review some of the problem machines - check they haven't configured a proxy, check that they're getting the right IP address back, check that they're pinging the right name, do a network monitor trace when they go to the URL in internet explorer.... etc

RhoSysAdmin's picture

This isn't a computer problem.  I've had the user log into multiple computers that I'm able to open vaulted messages on, and she's not able to.  I believe her kerberos token is too large and it's creating a problem when she tries to retrieve a message from EV.  That's why we tried the registry edit I mentioned (but didn't explain) above.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTTP\Parameters]

"MaxFieldLength"=dword:00010000

"MaxRequestBytes"=dword:00010000

Unfortunately, this didn't make a difference.  I've done an iisreset, as well as restarted all the EV services.  It doesn't seem to help.

Does anyone know enough about kerberos that may know what to do if a user with a large kerberos token tries to access items in EV?

Rob.Wilcox's picture

I would personally suggest contacting Symantec Support and working with them to try to troubleshoot the issue, and/or reproduce it.

SOLUTION