Unable to open vaulted message from Outlook

My user has returned from vacation and created the "Max trace" log file for me.  It's attached.

They are getting a rather generic 'error' when they try to open an item:

<snip>

02/01/2013 16:40:32.868[1972][L]: ~CDownloadBytesImpl::Connect: 0x80004005
02/01/2013 16:40:32.868[1972][L]: CDownloadBytesImpl::OutlookExiting
02/01/2013 16:40:32.868[1972][L]: ~CDownloadBytesImpl::OutlookExiting
02/01/2013 16:40:32.868[1972][L]: CDownloadBytesImpl::OutlookExiting
02/01/2013 16:40:32.869[1972][L]: ~CDownloadBytesImpl::OutlookExiting
02/01/2013 16:40:32.869[1972][L]: CDownloadBytesImpl::DeleteCritSect
02/01/2013 16:40:32.869[1972][L]: ~CDownloadBytesImpl::DeleteCritSect
02/01/2013 16:40:32.869[1972][L]: CDownloadBytesImpl::Complete
02/01/2013 16:40:32.869[8592][L]: ~CDownloadBytesImpl::WaitComplete
02/01/2013 16:40:32.869[8592][L]: ~CDownloadBytes::WaitComplete
02/01/2013 16:40:32.869[8592][L]: CDownloadBytes::End
02/01/2013 16:40:32.869[8592][L]: CDownloadBytesImpl::End
02/01/2013 16:40:32.869[8592][M]: Waiting for DownloadBytes thread, THID=1972 to exit
02/01/2013 16:40:32.870[1972][L]: ~CDownloadBytesImpl::Complete
02/01/2013 16:40:32.870[1972][L]: ~CDownloadBytesImpl::ThreadMain
02/01/2013 16:40:32.870[1972][M]: CThreadManager::Remove thread THID=1972
02/01/2013 16:40:32.870[1972][L]: ~CDownloadBytesImpl::FetchDataInThread
02/01/2013 16:40:32.870[8592][L]: ~CDownloadBytesImpl::End
02/01/2013 16:40:32.870[8592][L]: ~CDownloadBytes::End
02/01/2013 16:40:32.871[8592][L]: CDownloadBytes::Result
02/01/2013 16:40:32.871[8592][L]: ~CDownloadBytes::Result
02/01/2013 16:40:32.871[8592][L]: DesktopTls::TlsData::PopDownloadBytes
02/01/2013 16:40:32.871[8592][L]: ~DesktopTls::TlsData::PopDownloadBytes 

02/01/2013 16:40:32.871[8592][L]: ~CDownloadSTA::DoDownload: 0x80004005</snip>

The URL they're hitting is:

<snip>

02/01/2013 16:40:32.849[8592][M]: Downloading: http://evserver/EnterpriseVault/download.asp?VaultID=19D24AB2B34E4DE4794F9230C6B1798071110000evserver&SaveSetID=201212064797495~201211211953020000~Z~8098D6CF1A210E0F6ACA6BAFDC6E0EB1&FormatType=Unicode&Client=EV9.0.4.1097-Outlook14&Format=MUD&AttachmentID=0

</snip>

Can you try that in Internet Explorer and report back findings, please?

It is another one of those days when I don't have an EV environment set up..  But I also see failures to connect like this :

<snip>

02/01/2013 16:39:48.936[6560][M]: HaveConnection::ExecuteTest - Connection test to: evserver/EnterpriseVault/clienttest.gif failed

</snip>

And

<snip>

02/01/2013 16:40:48.969[6560][M]: HaveConnection::ExecuteTest - Connection test to: evserver/EnterpriseVault/clienttest.gif failed

</snip>

User gets an error message that "The webpage cannot be found."

What happens if they go to :

http://evserver/enterprisevault

?

Still an error message?

I mean ..  that's gotta be a clue right?  Is that the name of your EV server?  Can it be pinged?

The user gets a "web page not found" error when she clicks on http://evserver/enterprisevault as well, but nslookup of evserver works for her as well as pinging of evserver from her computer.

This URL - http://evserver/enterprisevault

Does the URL work for you?

Does the URL work for other people?

What is different about these particular machines? Are they resolving to the correct address? Is there a proxy server configured in Internet Explorer which is forcing HTTP traffic to take a different path to the NSLOOKUP or PING commands?

So I would review some of the problem machines - check they haven't configured a proxy, check that they're getting the right IP address back, check that they're pinging the right name, do a network monitor trace when they go to the URL in internet explorer.... etc

I had three other people try the same url and it works for them.  There is no proxy. 

I can find no occurrence of this one user's logon name in the IIS logs in C:\WINDOWS\system32\LogFiles\W3SVC1 for my EV server.  That makes sense actually, since she's getting an error on her end. 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTTP\Parameters]

"MaxFieldLength"=dword:00010000

"MaxRequestBytes"=dword:00010000

I did an iisreset on my EV server after adding these two keys.  We've had a MaxTokenSize key set for workstations for quite a while to deal w/ the large group membership issue.  But in the end this has not worked.  I'm wondering if I need to restart all EV services or bounce the server itself?

This isn't a computer problem.  I've had the user log into multiple computers that I'm able to open vaulted messages on, and she's not able to.  I believe her kerberos token is too large and it's creating a problem when she tries to retrieve a message from EV.  That's why we tried the registry edit I mentioned (but didn't explain) above.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTTP\Parameters]

"MaxFieldLength"=dword:00010000

"MaxRequestBytes"=dword:00010000

Unfortunately, this didn't make a difference.  I've done an iisreset, as well as restarted all the EV services.  It doesn't seem to help.

Does anyone know enough about kerberos that may know what to do if a user with a large kerberos token tries to access items in EV?