5/2/2012 8:50:05 PM [3328,7] #############################################################
5/2/2012 8:50:05 PM [3328,7] Request processing started
5/2/2012 8:50:05 PM [3328,7] Url: https://webmail.domainllp.com/owa/forms/premium/StartPage.aspx
5/2/2012 8:50:05 PM [3328,7] RawUrl: /owa/default.aspx
5/2/2012 8:50:05 PM [3328,7] Query String parameters:
5/2/2012 8:50:05 PM [3328,7] Cookies
5/2/2012 8:50:05 PM [3328,7] sessionid: 19146937-c049-4660-af1c-9a3eaf85b8ba
5/2/2012 8:50:05 PM [3328,7] cadata: "1+RIzkMNKCMj0YTHLZ+zPx0G4wxOZIDDao92sgwXeX8pOZd0qDlms2Bfjnuw="
5/2/2012 8:50:05 PM [3328,7] UserContext: 7f0874f9e0194872a8284b0ae1e34f97
5/2/2012 8:50:05 PM [3328,7] Form:
5/2/2012 8:50:05 PM [3328,7] OWA Session details
5/2/2012 8:50:05 PM [3328,7] User agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729)
5/2/2012 8:50:05 PM [3328,7] Authentication type: Basic
5/2/2012 8:50:05 PM [3328,7] Authenticated user: domain\JDoe
5/2/2012 8:50:05 PM [3328,7] Client IP Address: 10.30.51.61
5/2/2012 8:50:05 PM [3328,7] Server IP Address: 10.30.1.186
5/2/2012 8:50:05 PM [3328,7] Host: webmail.domainllp.com
5/2/2012 8:50:05 PM [3328,7] Primary SMTP Address: John.Doe@domainllp.com
5/2/2012 8:50:05 PM [3328,7] Explicit Logon: False
5/2/2012 8:50:05 PM [3328,7] Explicit Logon Address: owa
5/2/2012 8:50:05 PM [3328,7] EV Extensions DLL version: 10.0.0.0
5/2/2012 8:50:05 PM [3328,7] [RequestProcessor::StartImpersonation] Impersonating logged on user
5/2/2012 8:50:05 PM [3328,7] [EVContext::Initialise] Loading EVContext
5/2/2012 8:50:05 PM [3328,7] [Resources::LoadLanguageFile] Trying to opening language file: D:\Program Files\Microsoft\Exchange\ClientAccess\owa\EnterpriseVault\v10.0.0.1316\Languages\en-us.lan
5/2/2012 8:50:05 PM [3328,7] [Resources::LoadLanguageFile] Language file not found
5/2/2012 8:50:05 PM [3328,7] [Resources::LoadLanguageFile] Trying to opening language file: D:\Program Files\Microsoft\Exchange\ClientAccess\owa\EnterpriseVault\v10.0.0.1316\Languages\en.lan
5/2/2012 8:50:05 PM [3328,7] [Resources::LoadLanguageFile] Loaded language: en
5/2/2012 8:50:05 PM [3328,7] [EVContext::ResetHiddenSettings] Resetting hidden settings to defaults
5/2/2012 8:50:05 PM [3328,7] [EVContext::LoadHiddenSettings] Loading hidden settings
5/2/2012 8:50:05 PM [3328,7] [EVContext::LoadHiddenSettings] Getting hidden message entry id using SMTP address: John.Doe@domainllp.com
5/2/2012 8:50:05 PM [3328,7] [WebDAVHelpers::GetEVHiddenMessageId] Mailbox Url: http://exchange/exchange/John.Doe@domainllp.com
5/2/2012 8:50:05 PM [3328,7] [WebDAVRequest::Send] Request url: http://exchange/exchange/John.Doe@domainllp.com
5/2/2012 8:50:05 PM [3328,7] [WebDAVRequest::Send] Request method: PROPFIND
5/2/2012 8:50:05 PM [3328,7] [WebDAVRequest::Send] Request timeout (milliseconds): 30000
5/2/2012 8:50:05 PM [3328,7] [WebDAVRequest::Send] Adding FBA cookies
5/2/2012 8:50:05 PM [3328,7] [WebDAVRequest::Send] Adding Depth header: 0
5/2/2012 8:50:05 PM [3328,7] [WebDAVRequest::Send] Request body:
5/2/2012 8:50:05 PM [3328,7] [WebDAVRequest::Send] Creating XmlDocument
5/2/2012 8:50:05 PM [3328,7] [WebDAVRequest::Send] Loading XmlDocument
5/2/2012 8:50:05 PM [3328,7] [WebDAVRequest::Send] Loaded XmlDocument: http://exchange/exchange/John.Doe@domainllp.com/HTTP/1.1 200 OKhttp://exchange/exchange/John.Doe@domainllp.com/Inbox
5/2/2012 8:50:05 PM [3328,7] [WebDAVHelpers::GetEVHiddenMessageId] Inbox Url: http://exchange/exchange/John.Doe@domainllp.com/Inbox
5/2/2012 8:50:05 PM [3328,7] [WebDAVRequest::Send] Request url: http://exchange/exchange/John.Doe@domainllp.com/Inbox
5/2/2012 8:50:05 PM [3328,7] [WebDAVRequest::Send] Request method: SEARCH
5/2/2012 8:50:05 PM [3328,7] [WebDAVRequest::Send] Request timeout (milliseconds): 30000
5/2/2012 8:50:05 PM [3328,7] [WebDAVRequest::Send] Adding FBA cookies
5/2/2012 8:50:05 PM [3328,7] [WebDAVRequest::Send] Request body: SELECT "http://schemas.microsoft.com/mapi/proptag/x0FFF0102" FROM SCOPE('shallow traversal of "http://exchange/exchange/John.Doe@domainllp.com/Inbox"') WHERE "DAV:ishidden" = true AND "http://schemas.microsoft.com/exchange/outlookmessageclass" = 'IPM.Note.EnterpriseVault.Settings'
5/2/2012 8:50:06 PM [3328,7] [WebDAVRequest::Send] Creating XmlDocument
5/2/2012 8:50:06 PM [3328,7] [WebDAVRequest::Send] Loading XmlDocument
5/2/2012 8:50:06 PM [3328,7] [WebDAVRequest::Send] Loaded XmlDocument: http://exchange/exchange/John.Doe@domainllp.com/Inbox/No%20Subject-9689.EMLHTTP/1.1 200 OKAAAAAFFObMD/j5JIkFu4wmAhJL4HALITzIOJr3pIvTAt3jeakLgAk902v5MAALITzIOJr3pIvTAt3jeakLgAp62kJVQAAA==
5/2/2012 8:50:06 PM [3328,7] [WebDAVHelpers::GetEVHiddenMessageId] ID: AAAAAFFObMD/j5JIkFu4wmAhJL4HALITzIOJr3pIvTAt3jeakLgAk902v5MAALITzIOJr3pIvTAt3jeakLgAp62kJVQAAA==
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] Retrieved hidden message entry id
5/2/2012 8:50:06 PM [3328,7] [Id::EwsId] Converting EntryId to EwsId
5/2/2012 8:50:06 PM [3328,7] [MailboxBase::MailboxBase] Connecting to Exchange Web Services using: https://10.30.1.186/ews/exchange.asmx
5/2/2012 8:50:06 PM [3328,7] [ConvertId::DoConvertId] Converting ID using web services
5/2/2012 8:50:06 PM [3328,7] [Id::EwsId] Converted EntryId to Mailbox EwsId: AAMkAGQ1YmMwZTZkLTZiNjctNGVmYy05NmY3LTk3ODJmNzUwNGEyOQBGAAAAAABRTmzA/4+SSJBbuMJgISS+BwCyE8yDia96SL0wLd43mpC4AJPdNr+TAACyE8yDia96SL0wLd43mpC4AKetpCVUAAA=
5/2/2012 8:50:06 PM [3328,7] [MailboxBase::MailboxBase] Connecting to Exchange Web Services using: https://10.30.1.186/ews/exchange.asmx
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] Retrieved hidden message from web services
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] Settings from hidden message:
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] SiteEntryId=110908EDFE008FF45A045495614D10A991d10000evcl
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] DefaultDoubleClickView=0
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] DefaultWebAppURL=http://evcl.domain.com/EnterpriseVault
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] OWAWebAppURL=http://evcl.domain.com/EVAnon
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] MailboxServer=exchange
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] SystemMailbox=SMTP:EVSysMail@domainllp.com
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] UsersCanDeleteItems=0
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] ServerVersion=10.00
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] MailboxState=1
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] MailboxDN=/o=domain/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=JDoe
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] DefaultArchiveId=192D23990F8B2604586339338FADBA7C11110000evcl
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] UseInactivityPeriod=0
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] UseQuotaLimit=1
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] InactivityPeriodUnits=1
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] InactivityPeriod=4
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] MinAgePeriodUnits=1
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] MinAgePeriod=0
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] UseLargeItemsSize=1
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] LargeItemsSizeKB=51200
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] ArchiveOnlyWithAttach=0
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] ArchiveDelItemsFolder=0
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] PFInactivityPeriodUnits=2
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] PFInactivityPeriod=6
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] PFMinAgePeriodUnits=1
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] PFMinAgePeriod=2
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] PFUseLargeItemsSize=0
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] PFLargeItemsSizeKB=10240
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] PolicyEntryId=15AD3E7931913E843A1C639326EB6325F1s10000evcl
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] PSTPolicyEntryId=12732BF7D7D04834BA3E3ADD7EF4BFC141s10000evcl
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] DefaultRetentionCategoryId=14FEB6954573C9F42BCB49D18A05766E51b10000evcl
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] PSTImportEnabled=0
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] ArchiveManagedFolders=0
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] ManagedFolderHandling=2
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] ArchiveSettingsLocked=1
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] AddServerToIntraNetZone=evcl.domain.com;erisevcluster.domain.com;eris.domain.com;evcl;erisevcluster;eris
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] AllowScriptPublicFolders=1
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] AllowScriptSharedFolders=1
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] ArchiveExplorerBtnVisible=1
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] BrowserSearchLink=0
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] DeleteBtnVisible=0
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] DeployFormsLocally=2
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] LaunchAEInBrowser=1
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] MarkPSTs=1
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] OVEnabled=2
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] OVStartDownloadBtnVisible=1
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] OVStoreSize=30720
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] OVStoreSizePercent=0
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] UseSelfInstallFunct=0
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] VVEnabled=1
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] VVReadingPaneContent=1
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] OWA2003CancelFromToolbar=0
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] OWA2003DeleteFromContextMenu=0
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] OWA2003DeleteFromToolbar=0
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] OWA2003DeleteMode=0
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] OWAClientUseDirectConnection=1
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] EVSERVERS=evcl.domain.com;ERISEVCLUSTER;
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] OVMessageClassInclude=IPM.Post*;IPM.Note*;IPM.Document*;
5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] Finished loading hidden settings
5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Mailbox Settings loaded at: Wednesday, May 02, 2012, 8:50:06 PM
5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Enabled for archiving: Enabled
5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Web App Url: http://evcl.domain.com/EVAnon
5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Default Web App Url: http://evcl.domain.com/EnterpriseVault
5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] External Web App Url: /enterprisevault
5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Mailbox DN: /o=domain/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=JDoe
5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Default Archive Id: 192D23990F8B2604586339338FADBA7C11110000evcl
5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Default Ret Cat Id: 14FEB6954573C9F42BCB49D18A05766E51b10000evcl
5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Site Entry Id: 110908EDFE008FF45A045495614D10A991d10000evcl
5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Users Can Delete Items: False
5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] EV Server Version: 10.00
5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] View Mode: OWA
5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Open Mode: ArchivedItem
5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Reply Mode: ArchivedItem
5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Reply to All Mode: ArchivedItem
5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Forward Mode: ArchivedItem
5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Delete Mode: ShortcutOnly
5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Archive on Toolbar: True
5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Restore on Toolbar: True
5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Cancel on Toolbar: False
5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Delete on Toolbar: False
5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Help on Toolbar: True
5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Archive on Context Menu: True
5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Restore on Context Menu: True
5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Cancel on Context Menu: True
5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Delete on Context Menu: False
5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Archive Explorer in Light Client: True
5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Archive Explorer in Premium Client: True
5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Search in Light Client: True
5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Search in Premium Client: True
5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Browser Search Link: False
5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Archive Managed Folders: False
5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Managed Folder Handling: Managed
5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Archive function in Light Client: Basic
5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Archive function in Premium Client: Enhanced
5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Archive Confirmation (basic function): True
5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Archive Sub Folders (basic function): False
5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Restore function in Light Client: Basic
5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Restore function in Premium Client: Enhanced
5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Delete Shortcut on restore (basic function): True
5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Restore confirmation (basic function): True
5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Restore to restored items folder (basic function): False
5/2/2012 8:50:06 PM [3328,7] [EVContext::Initialise] EVContext intialised at 5/2/2012 8:50:06 PM
5/2/2012 8:50:06 PM [3328,7] [EVContext::Initialise] Hidden settings loaded at 5/2/2012 8:50:06 PM
5/2/2012 8:50:06 PM [3328,7] [EVContext::IsValidBrowser] Checking browser...
5/2/2012 8:50:06 PM [3328,7] [EVContext::IsValidBrowser] User agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729)
5/2/2012 8:50:06 PM [3328,7] [EVContext::IsValidBrowser] Using premium client - browser valid
5/2/2012 8:50:06 PM [3328,7] [EVContext::IsValidBrowser] Returning: True
5/2/2012 8:50:06 PM [3328,7] [RequestProcessor::ProcessRequest] Setting response filter: Premium.WunderBar
5/2/2012 8:50:06 PM [3328,7] [RequestProcessor:StopImpersonation] Stopped impersonation
5/2/2012 8:50:06 PM [3328,7] Request processing finished
5/2/2012 8:50:06 PM [3328,7] #############################################################
5/2/2012 8:50:06 PM [3328,7] Request processing started
5/2/2012 8:50:06 PM [3328,7] Url: https://webmail.domainllp.com/owa/forms/premium/StartPage.aspx
5/2/2012 8:50:06 PM [3328,7] RawUrl: /owa/default.aspx
5/2/2012 8:50:06 PM [3328,7] Query String parameters:
5/2/2012 8:50:06 PM [3328,7] Cookies
5/2/2012 8:50:06 PM [3328,7] sessionid: 19146937-c049-4660-af1c-9a3eaf85b8ba
5/2/2012 8:50:06 PM [3328,7] cadata: "1+RIzkMNKCMj0YTHLZ+zPx0G4wxOZIDDao92sgwXeX8pOZd0qDlms2Bfjnuw="
5/2/2012 8:50:06 PM [3328,7] UserContext: 7f0874f9e0194872a8284b0ae1e34f97
5/2/2012 8:50:06 PM [3328,7] Form:
5/2/2012 8:50:06 PM [3328,7] OWA Session details
5/2/2012 8:50:06 PM [3328,7] User agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729)
5/2/2012 8:50:06 PM [3328,7] Authentication type: Basic
5/2/2012 8:50:06 PM [3328,7] Authenticated user: domain\JDoe
5/2/2012 8:50:06 PM [3328,7] Client IP Address: 10.30.51.61
5/2/2012 8:50:06 PM [3328,7] Server IP Address: 10.30.1.186
5/2/2012 8:50:06 PM [3328,7] Host: webmail.domainllp.com
5/2/2012 8:50:06 PM [3328,7] Primary SMTP Address: John.Doe@domainllp.com
5/2/2012 8:50:06 PM [3328,7] Explicit Logon: False
5/2/2012 8:50:06 PM [3328,7] Explicit Logon Address: owa
5/2/2012 8:50:06 PM [3328,7] EV Extensions DLL version: 10.0.0.0
5/2/2012 8:50:06 PM [3328,7] [RequestProcessor::StartImpersonation] Impersonating logged on user
5/2/2012 8:50:06 PM [3328,7] [EVContext::Initialise] EVContext intialised at 5/2/2012 8:50:06 PM
5/2/2012 8:50:06 PM [3328,7] [EVContext::Initialise] Hidden settings loaded at 5/2/2012 8:50:06 PM
5/2/2012 8:50:06 PM [3328,7] [EVContext::IsValidBrowser] Returning: True
5/2/2012 8:50:06 PM [3328,7] [RequestProcessor::PostProcessRequest] Checking for reply/forward to EV item
5/2/2012 8:50:06 PM [3328,7] [RequestProcessor:StopImpersonation] Stopped impersonation
5/2/2012 8:50:06 PM [3328,7] Request processing finished
5/2/2012 8:50:06 PM [3328,7] #############################################################
5/2/2012 8:50:06 PM [3328,7] Response filter started
5/2/2012 8:50:06 PM [3328,7] Url: https://webmail.domainllp.com/owa/forms/premium/StartPage.aspx
5/2/2012 8:50:06 PM [3328,7] RawUrl: /owa/default.aspx
5/2/2012 8:50:06 PM [3328,7] Query String parameters:
5/2/2012 8:50:06 PM [3328,7] Form:
5/2/2012 8:50:06 PM [3328,7] EV Extensions Resource version: v10.0.0.1316
5/2/2012 8:50:06 PM [3328,7] [EVContext::Initialise] EVContext intialised at 5/2/2012 8:50:06 PM
5/2/2012 8:50:06 PM [3328,7] [EVContext::Initialise] Hidden settings loaded at 5/2/2012 8:50:06 PM
5/2/2012 8:50:06 PM [3328,7] Response filter invoked: Symantec.EnterpriseVault.Owa.ResponseFilters.Premium.WunderBar
5/2/2012 8:50:06 PM [3328,7] Response filter finished
5/2/2012 8:50:06 PM [3328,7] #############################################################
5/2/2012 8:50:06 PM [3328,7] Request processing started
5/2/2012 8:50:06 PM [3328,7] Url: https://webmail.domainllp.com/owa/forms/premium/MessageView.aspx?ae=Folder&t=IPF.Note&a=
5/2/2012 8:50:06 PM [3328,7] RawUrl: /owa/default.aspx?ae=Folder&t=IPF.Note&a=
5/2/2012 8:50:06 PM [3328,7] Query String parameters:
5/2/2012 8:50:06 PM [3328,7] ae: Folder
5/2/2012 8:50:06 PM [3328,7] t: IPF.Note
5/2/2012 8:50:06 PM [3328,7] a:
5/2/2012 8:50:06 PM [3328,7] Cookies
5/2/2012 8:50:06 PM [3328,7] sessionid: 19146937-c049-4660-af1c-9a3eaf85b8ba
5/2/2012 8:50:06 PM [3328,7] cadata: "1+RIzkMNKCMj0YTHLZ+zPx0G4wxOZIDDao92sgwXeX8pOZd0qDlms2Bfjnuw="
5/2/2012 8:50:06 PM [3328,7] UserContext: 7f0874f9e0194872a8284b0ae1e34f97
5/2/2012 8:50:06 PM [3328,7] Form:
5/2/2012 8:50:06 PM [3328,7] OWA Session details
5/2/2012 8:50:06 PM [3328,7] User agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729)
5/2/2012 8:50:06 PM [3328,7] Authentication type: Basic
5/2/2012 8:50:06 PM [3328,7] Authenticated user: domain\JDoe
5/2/2012 8:50:06 PM [3328,7] Client IP Address: 10.30.51.61
5/2/2012 8:50:06 PM [3328,7] Server IP Address: 10.30.1.186
5/2/2012 8:50:06 PM [3328,7] Host: webmail.domainllp.com
5/2/2012 8:50:06 PM [3328,7] Primary SMTP Address: John.Doe@domainllp.com
5/2/2012 8:50:06 PM [3328,7] Explicit Logon: False
5/2/2012 8:50:06 PM [3328,7] Explicit Logon Address: owa
5/2/2012 8:50:06 PM [3328,7] EV Extensions DLL version: 10.0.0.0
5/2/2012 8:50:06 PM [3328,7] [RequestProcessor::StartImpersonation] Impersonating logged on user
5/2/2012 8:50:06 PM [3328,7] [EVContext::Initialise] EVContext intialised at 5/2/2012 8:50:06 PM
5/2/2012 8:50:06 PM [3328,7] [EVContext::Initialise] Hidden settings loaded at 5/2/2012 8:50:06 PM
5/2/2012 8:50:06 PM [3328,7] [EVContext::IsValidBrowser] Returning: True
5/2/2012 8:50:06 PM [3328,7] [RequestProcessor::ProcessRequest] Setting response filter: Premium.Folder
5/2/2012 8:50:06 PM [3328,7] [RequestProcessor:StopImpersonation] Stopped impersonation
5/2/2012 8:50:06 PM [3328,7] Request processing finished
5/2/2012 8:50:06 PM [3328,7] #############################################################
5/2/2012 8:50:06 PM [3328,7] Request processing started
5/2/2012 8:50:06 PM [3328,7] Url: https://webmail.domainllp.com/owa/forms/premium/MessageView.aspx?ae=Folder&t=IPF.Note&a=
5/2/2012 8:50:06 PM [3328,7] RawUrl: /owa/default.aspx?ae=Folder&t=IPF.Note&a=
5/2/2012 8:50:06 PM [3328,7] Query String parameters:
5/2/2012 8:50:06 PM [3328,7] ae: Folder
5/2/2012 8:50:06 PM [3328,7] t: IPF.Note
5/2/2012 8:50:06 PM [3328,7] a:
5/2/2012 8:50:06 PM [3328,7] Cookies
5/2/2012 8:50:06 PM [3328,7] sessionid: 19146937-c049-4660-af1c-9a3eaf85b8ba
5/2/2012 8:50:06 PM [3328,7] cadata: "1+RIzkMNKCMj0YTHLZ+zPx0G4wxOZIDDao92sgwXeX8pOZd0qDlms2Bfjnuw="
5/2/2012 8:50:06 PM [3328,7] UserContext: 7f0874f9e0194872a8284b0ae1e34f97
5/2/2012 8:50:06 PM [3328,7] Form:
5/2/2012 8:50:06 PM [3328,7] OWA Session details
5/2/2012 8:50:06 PM [3328,7] User agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729)
5/2/2012 8:50:06 PM [3328,7] Authentication type: Basic
5/2/2012 8:50:06 PM [3328,7] Authenticated user: domain\JDoe
5/2/2012 8:50:06 PM [3328,7] Client IP Address: 10.30.51.61
5/2/2012 8:50:06 PM [3328,7] Server IP Address: 10.30.1.186
5/2/2012 8:50:06 PM [3328,7] Host: webmail.domainllp.com
5/2/2012 8:50:06 PM [3328,7] Primary SMTP Address: John.Doe@domainllp.com
5/2/2012 8:50:06 PM [3328,7] Explicit Logon: False
5/2/2012 8:50:06 PM [3328,7] Explicit Logon Address: owa
5/2/2012 8:50:06 PM [3328,7] EV Extensions DLL version: 10.0.0.0
5/2/2012 8:50:06 PM [3328,7] [RequestProcessor::StartImpersonation] Impersonating logged on user
5/2/2012 8:50:06 PM [3328,7] [EVContext::Initialise] EVContext intialised at 5/2/2012 8:50:06 PM
5/2/2012 8:50:06 PM [3328,7] [EVContext::Initialise] Hidden settings loaded at 5/2/2012 8:50:06 PM
5/2/2012 8:50:06 PM [3328,7] [EVContext::IsValidBrowser] Returning: True
5/2/2012 8:50:06 PM [3328,7] [RequestProcessor::PostProcessRequest] Checking for reply/forward to EV item
5/2/2012 8:50:06 PM [3328,7] [RequestProcessor:StopImpersonation] Stopped impersonation
5/2/2012 8:50:06 PM [3328,7] Request processing finished
5/2/2012 8:50:06 PM [3328,7] #############################################################
5/2/2012 8:50:06 PM [3328,7] Response filter started
5/2/2012 8:50:06 PM [3328,7] Url: https://webmail.domainllp.com/owa/forms/premium/MessageView.aspx?ae=Folder&t=IPF.Note&a=
5/2/2012 8:50:06 PM [3328,7] RawUrl: /owa/default.aspx?ae=Folder&t=IPF.Note&a=
5/2/2012 8:50:06 PM [3328,7] Query String parameters:
5/2/2012 8:50:06 PM [3328,7] ae: Folder
5/2/2012 8:50:06 PM [3328,7] t: IPF.Note
5/2/2012 8:50:06 PM [3328,7] a:
5/2/2012 8:50:06 PM [3328,7] Form:
5/2/2012 8:50:06 PM [3328,7] EV Extensions Resource version: v10.0.0.1316
5/2/2012 8:50:06 PM [3328,7] [EVContext::Initialise] EVContext intialised at 5/2/2012 8:50:06 PM
5/2/2012 8:50:06 PM [3328,7] [EVContext::Initialise] Hidden settings loaded at 5/2/2012 8:50:06 PM
5/2/2012 8:50:06 PM [3328,7] Response filter invoked: Symantec.EnterpriseVault.Owa.ResponseFilters.Premium.Folder
5/2/2012 8:50:06 PM [3328,7] Response filter finished
5/2/2012 8:50:07 PM [3328,7] #############################################################
5/2/2012 8:50:07 PM [3328,7] Request processing started
5/2/2012 8:50:07 PM [3328,7] Url: https://webmail.domainllp.com/owa/forms/premium/ReadMessage.aspx?ae=Item&a=Preview&t=IPM.Note&id=RgAAAABRTmzA/4+SSJBbuMJgISS+BwCyE8yDia96SL0wLd43mpC4AJPdNr+TAACyE8yDia96SL0wLd43mpC4AKetpCVTAAAJ
5/2/2012 8:50:07 PM [3328,7] RawUrl: /owa/default.aspx?ae=Item&a=Preview&t=IPM.Note&id=RgAAAABRTmzA%2f4%2bSSJBbuMJgISS%2bBwCyE8yDia96SL0wLd43mpC4AJPdNr%2bTAACyE8yDia96SL0wLd43mpC4AKetpCVTAAAJ
5/2/2012 8:50:07 PM [3328,7] Query String parameters:
5/2/2012 8:50:07 PM [3328,7] ae: Item
5/2/2012 8:50:07 PM [3328,7] a: Preview
5/2/2012 8:50:07 PM [3328,7] t: IPM.Note
5/2/2012 8:50:07 PM [3328,7] id: RgAAAABRTmzA/4+SSJBbuMJgISS+BwCyE8yDia96SL0wLd43mpC4AJPdNr+TAACyE8yDia96SL0wLd43mpC4AKetpCVTAAAJ
5/2/2012 8:50:07 PM [3328,7] Cookies
5/2/2012 8:50:07 PM [3328,7] sessionid: 19146937-c049-4660-af1c-9a3eaf85b8ba
5/2/2012 8:50:07 PM [3328,7] cadata: "1+RIzkMNKCMj0YTHLZ+zPx0G4wxOZIDDao92sgwXeX8pOZd0qDlms2Bfjnuw="
5/2/2012 8:50:07 PM [3328,7] UserContext: 7f0874f9e0194872a8284b0ae1e34f97
5/2/2012 8:50:07 PM [3328,7] Form:
5/2/2012 8:50:07 PM [3328,7] OWA Session details
5/2/2012 8:50:07 PM [3328,7] User agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729)
5/2/2012 8:50:07 PM [3328,7] Authentication type: Basic
5/2/2012 8:50:07 PM [3328,7] Authenticated user: domain\JDoe
5/2/2012 8:50:07 PM [3328,7] Client IP Address: 10.30.51.61
5/2/2012 8:50:07 PM [3328,7] Server IP Address: 10.30.1.186
5/2/2012 8:50:07 PM [3328,7] Host: webmail.domainllp.com
5/2/2012 8:50:07 PM [3328,7] Primary SMTP Address: John.Doe@domainllp.com
5/2/2012 8:50:07 PM [3328,7] Explicit Logon: False
5/2/2012 8:50:07 PM [3328,7] Explicit Logon Address: owa
5/2/2012 8:50:07 PM [3328,7] EV Extensions DLL version: 10.0.0.0
5/2/2012 8:50:07 PM [3328,7] [RequestProcessor::StartImpersonation] Impersonating logged on user
5/2/2012 8:50:07 PM [3328,7] [EVContext::Initialise] EVContext intialised at 5/2/2012 8:50:06 PM
5/2/2012 8:50:07 PM [3328,7] [EVContext::Initialise] Hidden settings loaded at 5/2/2012 8:50:06 PM
5/2/2012 8:50:07 PM [3328,7] [EVContext::IsValidBrowser] Returning: True
5/2/2012 8:50:07 PM [3328,7] [RequestProcessor::ProcessItem] started
5/2/2012 8:50:07 PM [3328,7] [RequestProcessor::ProcessItem] Finished
5/2/2012 8:50:07 PM [3328,7] [RequestProcessor:StopImpersonation] Stopped impersonation
5/2/2012 8:50:07 PM [3328,7] Request processing finished
5/2/2012 8:50:07 PM [3328,7] #############################################################
5/2/2012 8:50:07 PM [3328,7] Request processing started
5/2/2012 8:50:07 PM [3328,7] Url: https://webmail.domainllp.com/owa/forms/premium/ReadMessage.aspx?ae=Item&a=Preview&t=IPM.Note&id=RgAAAABRTmzA/4+SSJBbuMJgISS+BwCyE8yDia96SL0wLd43mpC4AJPdNr+TAACyE8yDia96SL0wLd43mpC4AKetpCVTAAAJ
5/2/2012 8:50:07 PM [3328,7] RawUrl: /owa/default.aspx?ae=Item&a=Preview&t=IPM.Note&id=RgAAAABRTmzA%2f4%2bSSJBbuMJgISS%2bBwCyE8yDia96SL0wLd43mpC4AJPdNr%2bTAACyE8yDia96SL0wLd43mpC4AKetpCVTAAAJ
5/2/2012 8:50:07 PM [3328,7] Query String parameters:
5/2/2012 8:50:07 PM [3328,7] ae: Item
5/2/2012 8:50:07 PM [3328,7] a: Preview
5/2/2012 8:50:07 PM [3328,7] t: IPM.Note
5/2/2012 8:50:07 PM [3328,7] id: RgAAAABRTmzA/4+SSJBbuMJgISS+BwCyE8yDia96SL0wLd43mpC4AJPdNr+TAACyE8yDia96SL0wLd43mpC4AKetpCVTAAAJ
5/2/2012 8:50:07 PM [3328,7] Cookies
5/2/2012 8:50:07 PM [3328,7] sessionid: 19146937-c049-4660-af1c-9a3eaf85b8ba
5/2/2012 8:50:07 PM [3328,7] cadata: "1+RIzkMNKCMj0YTHLZ+zPx0G4wxOZIDDao92sgwXeX8pOZd0qDlms2Bfjnuw="
5/2/2012 8:50:07 PM [3328,7] UserContext: 7f0874f9e0194872a8284b0ae1e34f97
5/2/2012 8:50:07 PM [3328,7] Form:
5/2/2012 8:50:07 PM [3328,7] OWA Session details
5/2/2012 8:50:07 PM [3328,7] User agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729)
5/2/2012 8:50:07 PM [3328,7] Authentication type: Basic
5/2/2012 8:50:07 PM [3328,7] Authenticated user: domain\JDoe
5/2/2012 8:50:07 PM [3328,7] Client IP Address: 10.30.51.61
5/2/2012 8:50:07 PM [3328,7] Server IP Address: 10.30.1.186
5/2/2012 8:50:07 PM [3328,7] Host: webmail.domainllp.com
5/2/2012 8:50:07 PM [3328,7] Primary SMTP Address: John.Doe@domainllp.com
5/2/2012 8:50:07 PM [3328,7] Explicit Logon: False
5/2/2012 8:50:07 PM [3328,7] Explicit Logon Address: owa
5/2/2012 8:50:07 PM [3328,7] EV Extensions DLL version: 10.0.0.0
5/2/2012 8:50:07 PM [3328,7] [RequestProcessor::StartImpersonation] Impersonating logged on user
5/2/2012 8:50:07 PM [3328,7] [EVContext::Initialise] EVContext intialised at 5/2/2012 8:50:06 PM
5/2/2012 8:50:07 PM [3328,7] [EVContext::Initialise] Hidden settings loaded at 5/2/2012 8:50:06 PM
5/2/2012 8:50:07 PM [3328,7] [EVContext::IsValidBrowser] Returning: True
5/2/2012 8:50:07 PM [3328,7] [RequestProcessor::PostProcessRequest] Checking for reply/forward to EV item
5/2/2012 8:50:07 PM [3328,7] [RequestProcessor:StopImpersonation] Stopped impersonation
5/2/2012 8:50:07 PM [3328,7] Request processing finished
5/2/2012 8:50:07 PM [3328,7] #############################################################
5/2/2012 8:50:07 PM [3328,7] Request processing started
5/2/2012 8:50:07 PM [3328,7] Url: https://webmail.domainllp.com/owa/attachment.ashx?id=RgAAAABRTmzA/4+SSJBbuMJgISS+BwCyE8yDia96SL0wLd43mpC4AJPdNr+TAACyE8yDia96SL0wLd43mpC4AKetpCVTAAAJ&attcnt=1&attid0=EADa6lQeGeuNS7NAOVnaV33C
5/2/2012 8:50:07 PM [3328,7] RawUrl: /owa/attachment.ashx?id=RgAAAABRTmzA%2f4%2bSSJBbuMJgISS%2bBwCyE8yDia96SL0wLd43mpC4AJPdNr%2bTAACyE8yDia96SL0wLd43mpC4AKetpCVTAAAJ&attcnt=1&attid0=EADa6lQeGeuNS7NAOVnaV33C
5/2/2012 8:50:07 PM [3328,7] Query String parameters:
5/2/2012 8:50:07 PM [3328,7] id: RgAAAABRTmzA/4+SSJBbuMJgISS+BwCyE8yDia96SL0wLd43mpC4AJPdNr+TAACyE8yDia96SL0wLd43mpC4AKetpCVTAAAJ
5/2/2012 8:50:07 PM [3328,7] attcnt: 1
5/2/2012 8:50:07 PM [3328,7] attid0: EADa6lQeGeuNS7NAOVnaV33C
5/2/2012 8:50:07 PM [3328,7] Cookies
5/2/2012 8:50:07 PM [3328,7] sessionid: 19146937-c049-4660-af1c-9a3eaf85b8ba
5/2/2012 8:50:07 PM [3328,7] cadata: "1+RIzkMNKCMj0YTHLZ+zPx0G4wxOZIDDao92sgwXeX8pOZd0qDlms2Bfjnuw="
5/2/2012 8:50:07 PM [3328,7] UserContext: 7f0874f9e0194872a8284b0ae1e34f97
5/2/2012 8:50:07 PM [3328,7] Form:
5/2/2012 8:50:07 PM [3328,7] OWA Session details
5/2/2012 8:50:07 PM [3328,7] User agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729)
5/2/2012 8:50:07 PM [3328,7] Authentication type: Basic
5/2/2012 8:50:07 PM [3328,7] Authenticated user: domain\JDoe
5/2/2012 8:50:07 PM [3328,7] Client IP Address: 10.30.51.61
5/2/2012 8:50:07 PM [3328,7] Server IP Address: 10.30.1.186
5/2/2012 8:50:07 PM [3328,7] Host: webmail.domainllp.com
5/2/2012 8:50:07 PM [3328,7] Primary SMTP Address: John.Doe@domainllp.com
5/2/2012 8:50:07 PM [3328,7] Explicit Logon: False
5/2/2012 8:50:07 PM [3328,7] Explicit Logon Address: owa
5/2/2012 8:50:07 PM [3328,7] EV Extensions DLL version: 10.0.0.0
5/2/2012 8:50:07 PM [3328,7] [RequestProcessor::StartImpersonation] Impersonating logged on user
5/2/2012 8:50:07 PM [3328,7] [EVContext::Initialise] EVContext intialised at 5/2/2012 8:50:06 PM
5/2/2012 8:50:07 PM [3328,7] [EVContext::Initialise] Hidden settings loaded at 5/2/2012 8:50:06 PM
5/2/2012 8:50:07 PM [3328,7] [EVContext::IsValidBrowser] Returning: True
5/2/2012 8:50:07 PM [3328,7] [RequestProcessor:StopImpersonation] Stopped impersonation
5/2/2012 8:50:07 PM [3328,7] Request processing finished
5/2/2012 8:50:07 PM [3328,7] #############################################################
5/2/2012 8:50:07 PM [3328,7] Request processing started
5/2/2012 8:50:07 PM [3328,7] Url: https://webmail.domainllp.com/owa/attachment.ashx?id=RgAAAABRTmzA/4+SSJBbuMJgISS+BwCyE8yDia96SL0wLd43mpC4AJPdNr+TAACyE8yDia96SL0wLd43mpC4AKetpCVTAAAJ&attcnt=1&attid0=EADa6lQeGeuNS7NAOVnaV33C
5/2/2012 8:50:07 PM [3328,7] RawUrl: /owa/attachment.ashx?id=RgAAAABRTmzA%2f4%2bSSJBbuMJgISS%2bBwCyE8yDia96SL0wLd43mpC4AJPdNr%2bTAACyE8yDia96SL0wLd43mpC4AKetpCVTAAAJ&attcnt=1&attid0=EADa6lQeGeuNS7NAOVnaV33C
5/2/2012 8:50:07 PM [3328,7] Query String parameters:
5/2/2012 8:50:07 PM [3328,7] id: RgAAAABRTmzA/4+SSJBbuMJgISS+BwCyE8yDia96SL0wLd43mpC4AJPdNr+TAACyE8yDia96SL0wLd43mpC4AKetpCVTAAAJ
5/2/2012 8:50:07 PM [3328,7] attcnt: 1
5/2/2012 8:50:07 PM [3328,7] attid0: EADa6lQeGeuNS7NAOVnaV33C
5/2/2012 8:50:07 PM [3328,7] Cookies
5/2/2012 8:50:07 PM [3328,7] sessionid: 19146937-c049-4660-af1c-9a3eaf85b8ba
5/2/2012 8:50:07 PM [3328,7] cadata: "1+RIzkMNKCMj0YTHLZ+zPx0G4wxOZIDDao92sgwXeX8pOZd0qDlms2Bfjnuw="
5/2/2012 8:50:07 PM [3328,7] UserContext: 7f0874f9e0194872a8284b0ae1e34f97
5/2/2012 8:50:07 PM [3328,7] Form:
5/2/2012 8:50:07 PM [3328,7] OWA Session details
5/2/2012 8:50:07 PM [3328,7] User agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729)
5/2/2012 8:50:07 PM [3328,7] Authentication type: Basic
5/2/2012 8:50:07 PM [3328,7] Authenticated user: domain\JDoe
5/2/2012 8:50:07 PM [3328,7] Client IP Address: 10.30.51.61
5/2/2012 8:50:07 PM [3328,7] Server IP Address: 10.30.1.186
5/2/2012 8:50:07 PM [3328,7] Host: webmail.domainllp.com
5/2/2012 8:50:07 PM [3328,7] Primary SMTP Address: John.Doe@domainllp.com
5/2/2012 8:50:07 PM [3328,7] Explicit Logon: False
5/2/2012 8:50:07 PM [3328,7] Explicit Logon Address: owa
5/2/2012 8:50:07 PM [3328,7] EV Extensions DLL version: 10.0.0.0
5/2/2012 8:50:07 PM [3328,7] [RequestProcessor::StartImpersonation] Impersonating logged on user
5/2/2012 8:50:07 PM [3328,7] [EVContext::Initialise] EVContext intialised at 5/2/2012 8:50:06 PM
5/2/2012 8:50:07 PM [3328,7] [EVContext::Initialise] Hidden settings loaded at 5/2/2012 8:50:06 PM
5/2/2012 8:50:07 PM [3328,7] [EVContext::IsValidBrowser] Returning: True
5/2/2012 8:50:07 PM [3328,7] [RequestProcessor::PostProcessRequest] Checking for reply/forward to EV item
5/2/2012 8:50:07 PM [3328,7] [RequestProcessor:StopImpersonation] Stopped impersonation
5/2/2012 8:50:07 PM [3328,7] Request processing finished
5/2/2012 8:50:07 PM [3328,7] #############################################################
5/2/2012 8:50:07 PM [3328,7] Request processing started
5/2/2012 8:50:07 PM [3328,7] Url: https://webmail.domainllp.com/owa/attachment.ashx?id=RgAAAABRTmzA/4+SSJBbuMJgISS+BwCyE8yDia96SL0wLd43mpC4AJPdNr+TAACyE8yDia96SL0wLd43mpC4AKetpCVTAAAJ&attcnt=1&attid0=EACuk6g6iNgcR6DAfhAzZrUu
5/2/2012 8:50:07 PM [3328,7] RawUrl: /owa/attachment.ashx?id=RgAAAABRTmzA%2f4%2bSSJBbuMJgISS%2bBwCyE8yDia96SL0wLd43mpC4AJPdNr%2bTAACyE8yDia96SL0wLd43mpC4AKetpCVTAAAJ&attcnt=1&attid0=EACuk6g6iNgcR6DAfhAzZrUu
5/2/2012 8:50:07 PM [3328,7] Query String parameters:
5/2/2012 8:50:07 PM [3328,7] id: RgAAAABRTmzA/4+SSJBbuMJgISS+BwCyE8yDia96SL0wLd43mpC4AJPdNr+TAACyE8yDia96SL0wLd43mpC4AKetpCVTAAAJ
5/2/2012 8:50:07 PM [3328,7] attcnt: 1
5/2/2012 8:50:07 PM [3328,7] attid0: EACuk6g6iNgcR6DAfhAzZrUu
5/2/2012 8:50:07 PM [3328,7] Cookies
5/2/2012 8:50:07 PM [3328,7] sessionid: 19146937-c049-4660-af1c-9a3eaf85b8ba
5/2/2012 8:50:07 PM [3328,7] cadata: "1+RIzkMNKCMj0YTHLZ+zPx0G4wxOZIDDao92sgwXeX8pOZd0qDlms2Bfjnuw="
5/2/2012 8:50:07 PM [3328,7] UserContext: 7f0874f9e0194872a8284b0ae1e34f97
5/2/2012 8:50:07 PM [3328,7] Form:
5/2/2012 8:50:07 PM [3328,7] OWA Session details
5/2/2012 8:50:07 PM [3328,7] User agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729)
5/2/2012 8:50:07 PM [3328,7] Authentication type: Basic
5/2/2012 8:50:07 PM [3328,7] Authenticated user: domain\JDoe
5/2/2012 8:50:07 PM [3328,7] Client IP Address: 10.30.51.61
5/2/2012 8:50:07 PM [3328,7] Server IP Address: 10.30.1.186
5/2/2012 8:50:07 PM [3328,7] Host: webmail.domainllp.com
5/2/2012 8:50:07 PM [3328,7] Primary SMTP Address: John.Doe@domainllp.com
5/2/2012 8:50:07 PM [3328,7] Explicit Logon: False
5/2/2012 8:50:07 PM [3328,7] Explicit Logon Address: owa
5/2/2012 8:50:07 PM [3328,7] EV Extensions DLL version: 10.0.0.0
5/2/2012 8:50:07 PM [3328,7] [RequestProcessor::StartImpersonation] Impersonating logged on user
5/2/2012 8:50:07 PM [3328,7] [EVContext::Initialise] EVContext intialised at 5/2/2012 8:50:06 PM
5/2/2012 8:50:07 PM [3328,7] [EVContext::Initialise] Hidden settings loaded at 5/2/2012 8:50:06 PM
5/2/2012 8:50:07 PM [3328,7] [EVContext::IsValidBrowser] Returning: True
5/2/2012 8:50:07 PM [3328,7] [RequestProcessor:StopImpersonation] Stopped impersonation
5/2/2012 8:50:07 PM [3328,7] Request processing finished
5/2/2012 8:50:07 PM [3328,7] #############################################################
5/2/2012 8:50:07 PM [3328,7] Request processing started
5/2/2012 8:50:07 PM [3328,7] Url: https://webmail.domainllp.com/owa/attachment.ashx?id=RgAAAABRTmzA/4+SSJBbuMJgISS+BwCyE8yDia96SL0wLd43mpC4AJPdNr+TAACyE8yDia96SL0wLd43mpC4AKetpCVTAAAJ&attcnt=1&attid0=EACuk6g6iNgcR6DAfhAzZrUu
5/2/2012 8:50:07 PM [3328,7] RawUrl: /owa/attachment.ashx?id=RgAAAABRTmzA%2f4%2bSSJBbuMJgISS%2bBwCyE8yDia96SL0wLd43mpC4AJPdNr%2bTAACyE8yDia96SL0wLd43mpC4AKetpCVTAAAJ&attcnt=1&attid0=EACuk6g6iNgcR6DAfhAzZrUu
5/2/2012 8:50:07 PM [3328,7] Query String parameters:
5/2/2012 8:50:07 PM [3328,7] id: RgAAAABRTmzA/4+SSJBbuMJgISS+BwCyE8yDia96SL0wLd43mpC4AJPdNr+TAACyE8yDia96SL0wLd43mpC4AKetpCVTAAAJ
5/2/2012 8:50:07 PM [3328,7] attcnt: 1
5/2/2012 8:50:07 PM [3328,7] attid0: EACuk6g6iNgcR6DAfhAzZrUu
5/2/2012 8:50:07 PM [3328,7] Cookies
5/2/2012 8:50:07 PM [3328,7] sessionid: 19146937-c049-4660-af1c-9a3eaf85b8ba
5/2/2012 8:50:07 PM [3328,7] cadata: "1+RIzkMNKCMj0YTHLZ+zPx0G4wxOZIDDao92sgwXeX8pOZd0qDlms2Bfjnuw="
5/2/2012 8:50:07 PM [3328,7] UserContext: 7f0874f9e0194872a8284b0ae1e34f97
5/2/2012 8:50:07 PM [3328,7] Form:
5/2/2012 8:50:07 PM [3328,7] OWA Session details
5/2/2012 8:50:07 PM [3328,7] User agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729)
5/2/2012 8:50:07 PM [3328,7] Authentication type: Basic
5/2/2012 8:50:07 PM [3328,7] Authenticated user: domain\JDoe
5/2/2012 8:50:07 PM [3328,7] Client IP Address: 10.30.51.61
5/2/2012 8:50:07 PM [3328,7] Server IP Address: 10.30.1.186
5/2/2012 8:50:07 PM [3328,7] Host: webmail.domainllp.com
5/2/2012 8:50:07 PM [3328,7] Primary SMTP Address: John.Doe@domainllp.com
5/2/2012 8:50:07 PM [3328,7] Explicit Logon: False
5/2/2012 8:50:07 PM [3328,7] Explicit Logon Address: owa
5/2/2012 8:50:07 PM [3328,7] EV Extensions DLL version: 10.0.0.0
5/2/2012 8:50:07 PM [3328,7] [RequestProcessor::StartImpersonation] Impersonating logged on user
5/2/2012 8:50:07 PM [3328,7] [EVContext::Initialise] EVContext intialised at 5/2/2012 8:50:06 PM
5/2/2012 8:50:07 PM [3328,7] [EVContext::Initialise] Hidden settings loaded at 5/2/2012 8:50:06 PM
5/2/2012 8:50:07 PM [3328,7] [EVContext::IsValidBrowser] Returning: True
5/2/2012 8:50:07 PM [3328,7] [RequestProcessor::PostProcessRequest] Checking for reply/forward to EV item
5/2/2012 8:50:07 PM [3328,7] [RequestProcessor:StopImpersonation] Stopped impersonation
5/2/2012 8:50:07 PM [3328,7] Request processing finished
5/2/2012 8:50:11 PM [3328,7] #############################################################
5/2/2012 8:50:11 PM [3328,7] Request processing started
5/2/2012 8:50:11 PM [3328,7] Url: https://webmail.domainllp.com/owa/forms/premium/StartPage.aspx?EVAction=IsManagedFolder
5/2/2012 8:50:11 PM [3328,7] RawUrl: /owa/default.aspx?EVAction=IsManagedFolder
5/2/2012 8:50:11 PM [3328,7] Query String parameters:
5/2/2012 8:50:11 PM [3328,7] EVAction: IsManagedFolder
5/2/2012 8:50:11 PM [3328,7] Cookies
5/2/2012 8:50:11 PM [3328,7] sessionid: 19146937-c049-4660-af1c-9a3eaf85b8ba
5/2/2012 8:50:11 PM [3328,7] cadata: "1+RIzkMNKCMj0YTHLZ+zPx0G4wxOZIDDao92sgwXeX8pOZd0qDlms2Bfjnuw="
5/2/2012 8:50:11 PM [3328,7] UserContext: 7f0874f9e0194872a8284b0ae1e34f97
5/2/2012 8:50:11 PM [3328,7] Form:
5/2/2012 8:50:11 PM [3328,7] OWA Session details
5/2/2012 8:50:11 PM [3328,7] User agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729)
5/2/2012 8:50:11 PM [3328,7] Authentication type: Basic
5/2/2012 8:50:11 PM [3328,7] Authenticated user: domain\JDoe
5/2/2012 8:50:11 PM [3328,7] Client IP Address: 10.30.51.61
5/2/2012 8:50:11 PM [3328,7] Server IP Address: 10.30.1.186
5/2/2012 8:50:11 PM [3328,7] Host: webmail.domainllp.com
5/2/2012 8:50:11 PM [3328,7] Primary SMTP Address: John.Doe@domainllp.com
5/2/2012 8:50:11 PM [3328,7] Explicit Logon: False
5/2/2012 8:50:11 PM [3328,7] Explicit Logon Address: owa
5/2/2012 8:50:11 PM [3328,7] EV Extensions DLL version: 10.0.0.0
5/2/2012 8:50:11 PM [3328,7] [RequestProcessor::StartImpersonation] Impersonating logged on user
5/2/2012 8:50:11 PM [3328,7] [EVContext::Initialise] EVContext intialised at 5/2/2012 8:50:06 PM
5/2/2012 8:50:11 PM [3328,7] [EVContext::Initialise] Hidden settings loaded at 5/2/2012 8:50:06 PM
5/2/2012 8:50:11 PM [3328,7] [EVContext::IsValidBrowser] Returning: True
5/2/2012 8:50:11 PM [3328,7] [RequestProcessor::ProcessEVAction] started
5/2/2012 8:50:11 PM [3328,7] [RequestProcessor::ProcessEVAction] IsManagedFolder action called:
5/2/2012 8:50:11 PM [3328,7] [Id::OwaId] Returning cached OwaId: LgAAAABRTmzA/4+SSJBbuMJgISS+AQCyE8yDia96SL0wLd43mpC4AJPdNr+TAAAB
5/2/2012 8:50:11 PM [3328,7] [RequestProcessor::ProcessEVAction] Folder Id: LgAAAABRTmzA/4+SSJBbuMJgISS+AQCyE8yDia96SL0wLd43mpC4AJPdNr+TAAAB
5/2/2012 8:50:11 PM [3328,7] [Id::EwsId] Converting OwaId to EwsId
5/2/2012 8:50:11 PM [3328,7] [MailboxBase::MailboxBase] Connecting to Exchange Web Services using: https://10.30.1.186/ews/exchange.asmx
5/2/2012 8:50:11 PM [3328,7] [ConvertId::DoConvertId] Converting ID using web services
5/2/2012 8:50:11 PM [3328,7] [Id::EwsId] Converted OwaId to Mailbox EwsId: AQMkAGQ1YmMwZTZkLTZiNjctNGVmYy05NmY3LTk3ODJmNzUwNGEyOQAuAAADUU5swP+PkkiQW7jCYCEkvgEAshPMg4mveki9MC3eN5qQuACT3Ta/kwAAAA==
5/2/2012 8:50:11 PM [3328,7] [MailboxBase::MailboxBase] Connecting to Exchange Web Services using: https://10.30.1.186/ews/exchange.asmx
5/2/2012 8:50:11 PM [3328,7] [MailboxFolder::LoadProperties] Folder name: Inbox
5/2/2012 8:50:11 PM [3328,7] [MailboxFolder::LoadProperties] Folder path: /Inbox
5/2/2012 8:50:11 PM [3328,7] [MailboxFolder::LoadProperties] Non-Deletable: False
5/2/2012 8:50:11 PM [3328,7] [MailboxFolder::IsManaged] {Inbox} Checking if managed folder
5/2/2012 8:50:11 PM [3328,7] [MailboxFolder::IsManaged] {Inbox} Not provisioned, checking parent folder...
5/2/2012 8:50:11 PM [3328,7] [MailboxBase::MailboxBase] Connecting to Exchange Web Services using: https://10.30.1.186/ews/exchange.asmx
5/2/2012 8:50:11 PM [3328,7] [MailboxFolder::LoadProperties] Folder name: Top of Information Store
5/2/2012 8:50:11 PM [3328,7] [MailboxFolder::LoadProperties] Folder path: /
5/2/2012 8:50:11 PM [3328,7] [MailboxFolder::LoadProperties] Non-Deletable: False
5/2/2012 8:50:11 PM [3328,7] [MailboxFolder::IsManaged] {Top of Information Store} Checking if managed folder
5/2/2012 8:50:11 PM [3328,7] [MailboxFolder::IsManaged] {Top of Information Store} Not provisioned, checking parent folder...
5/2/2012 8:50:11 PM [3328,7] [MailboxBase::MailboxBase] Connecting to Exchange Web Services using: https://10.30.1.186/ews/exchange.asmx
5/2/2012 8:50:11 PM [3328,7] [MailboxFolder::LoadProperties] Folder name:
5/2/2012 8:50:11 PM [3328,7] [MailboxFolder::LoadProperties] Folder path: /NON_IPM_SUBTREE
5/2/2012 8:50:11 PM [3328,7] [MailboxFolder::LoadProperties] Non-Deletable: False
5/2/2012 8:50:11 PM [3328,7] [MailboxFolder::IsManaged] {} Checking if managed folder
5/2/2012 8:50:11 PM [3328,7] [MailboxFolder::IsManaged] {} Returning: False
5/2/2012 8:50:11 PM [3328,7] [MailboxFolder::IsManaged] {Top of Information Store} Returning: False
5/2/2012 8:50:11 PM [3328,7] [MailboxFolder::IsManaged] {Inbox} Returning: False
5/2/2012 8:50:11 PM [3328,7] [RequestProcessor::ProcessEVAction] Finished handling EVAction, ending request processing
5/2/2012 8:50:11 PM [3328,7] [RequestProcessor:StopImpersonation] Stopped impersonation
5/2/2012 8:50:11 PM [3328,7] Request processing finished
5/2/2012 8:50:11 PM [3328,7] #############################################################
5/2/2012 8:50:11 PM [3328,7] Request processing started
5/2/2012 8:50:11 PM [3328,7] Url: https://webmail.domainllp.com/owa/forms/premium/StartPage.aspx?EVAction=ArchiveSettings
5/2/2012 8:50:11 PM [3328,7] RawUrl: /owa/default.aspx?EVAction=ArchiveSettings
5/2/2012 8:50:11 PM [3328,7] Query String parameters:
5/2/2012 8:50:11 PM [3328,7] EVAction: ArchiveSettings
5/2/2012 8:50:11 PM [3328,7] Cookies
5/2/2012 8:50:11 PM [3328,7] sessionid: 19146937-c049-4660-af1c-9a3eaf85b8ba
5/2/2012 8:50:11 PM [3328,7] cadata: "1+RIzkMNKCMj0YTHLZ+zPx0G4wxOZIDDao92sgwXeX8pOZd0qDlms2Bfjnuw="
5/2/2012 8:50:11 PM [3328,7] UserContext: 7f0874f9e0194872a8284b0ae1e34f97
5/2/2012 8:50:11 PM [3328,7] Form:
5/2/2012 8:50:11 PM [3328,7] OWA Session details
5/2/2012 8:50:11 PM [3328,7] User agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729)
5/2/2012 8:50:11 PM [3328,7] Authentication type: Basic
5/2/2012 8:50:11 PM [3328,7] Authenticated user: domain\JDoe
5/2/2012 8:50:11 PM [3328,7] Client IP Address: 10.30.51.61
5/2/2012 8:50:11 PM [3328,7] Server IP Address: 10.30.1.186
5/2/2012 8:50:11 PM [3328,7] Host: webmail.domainllp.com
5/2/2012 8:50:11 PM [3328,7] Primary SMTP Address: John.Doe@domainllp.com
5/2/2012 8:50:11 PM [3328,7] Explicit Logon: False
5/2/2012 8:50:11 PM [3328,7] Explicit Logon Address: owa
5/2/2012 8:50:11 PM [3328,7] EV Extensions DLL version: 10.0.0.0
5/2/2012 8:50:11 PM [3328,7] [RequestProcessor::StartImpersonation] Impersonating logged on user
5/2/2012 8:50:11 PM [3328,7] [EVContext::Initialise] EVContext intialised at 5/2/2012 8:50:06 PM
5/2/2012 8:50:11 PM [3328,7] [EVContext::Initialise] Hidden settings loaded at 5/2/2012 8:50:06 PM
5/2/2012 8:50:11 PM [3328,7] [EVContext::IsValidBrowser] Returning: True
5/2/2012 8:50:11 PM [3328,7] [RequestProcessor::ProcessEVAction] started
5/2/2012 8:50:11 PM [3328,7] [RequestProcessor::ProcessEVAction] ArchiveSettings action called:
5/2/2012 8:50:11 PM [3328,7] [Id::OwaId] Returning cached OwaId: LgAAAABRTmzA/4+SSJBbuMJgISS+AQCyE8yDia96SL0wLd43mpC4AJPdNr+TAAAB
5/2/2012 8:50:11 PM [3328,7] [RequestProcessor::ProcessEVAction] Folder Id: LgAAAABRTmzA/4+SSJBbuMJgISS+AQCyE8yDia96SL0wLd43mpC4AJPdNr+TAAAB
5/2/2012 8:50:11 PM [3328,7] [Id::OwaId] Returning cached OwaId: LgAAAABRTmzA/4+SSJBbuMJgISS+AQCyE8yDia96SL0wLd43mpC4AJPdNr+TAAAB
5/2/2012 8:50:11 PM [3328,7] [RequestProcessor::ProcessEVAction] Settings not found in cache
5/2/2012 8:50:11 PM [3328,7] [Id::EwsId] Converting OwaId to EwsId
5/2/2012 8:50:11 PM [3328,7] [MailboxBase::MailboxBase] Connecting to Exchange Web Services using: https://10.30.1.186/ews/exchange.asmx
5/2/2012 8:50:11 PM [3328,7] [ConvertId::DoConvertId] Converting ID using web services
5/2/2012 8:50:11 PM [3328,7] [Id::EwsId] Converted OwaId to Mailbox EwsId: AQMkAGQ1YmMwZTZkLTZiNjctNGVmYy05NmY3LTk3ODJmNzUwNGEyOQAuAAADUU5swP+PkkiQW7jCYCEkvgEAshPMg4mveki9MC3eN5qQuACT3Ta/kwAAAA==
5/2/2012 8:50:11 PM [3328,7] [MailboxBase::MailboxBase] Connecting to Exchange Web Services using: https://10.30.1.186/ews/exchange.asmx
5/2/2012 8:50:11 PM [3328,7] [MailboxFolder::LoadProperties] Folder name: Inbox
5/2/2012 8:50:11 PM [3328,7] [MailboxFolder::LoadProperties] Folder path: /Inbox
5/2/2012 8:50:11 PM [3328,7] [MailboxFolder::LoadProperties] Non-Deletable: False
5/2/2012 8:50:11 PM [3328,7] [EVServerRequest::CreateRequest] Sending request to: http://evcl.domain.com/EVAnon/getarchivesettings.asp?dn=%2fo%3ddomain%2fou%3dExchange+Administrative+Group+(FYDIBOHF23SPDLT)%2fcn%3dRecipients%2fcn%3dJDoe&sid=110908EDFE008FF45A045495614D10A991d10000evcl
5/2/2012 8:50:11 PM [3328,7] [EVServerRequest::CreateRequest] Request timeout (milliseconds): 30000
5/2/2012 8:50:11 PM [3328,7] [EVServerRequest::AddHeader] Set header: EV-OWA-2007-Extensions-Version=10.0.0.0
5/2/2012 8:50:11 PM [3328,7] [EVServerRequest::CreateRequest] Making request for user: domain\JDoe
5/2/2012 8:50:11 PM [3328,7] [EVServerRequest::AddHeader] Set header: X-EVOWA-User-Encoded=4D004B004C004C0050005C0069006B006F0065006E0069006700
5/2/2012 8:50:11 PM [3328,7] [ArchiveSettingsRequest::Send] Exception sending request for archive settings: System.Net.WebException: The remote server returned an error: (403) Forbidden.
at System.Net.HttpWebRequest.GetResponse()
at Symantec.EnterpriseVault.Owa.EVServerRequests.ArchiveSettingsRequest.Send()
5/2/2012 8:50:11 PM [3328,7] [FolderArchiveSettings::GetFolderSettings] No default settings available
5/2/2012 8:50:11 PM [3328,7] [Id::OwaId] Returning cached OwaId: LgAAAABRTmzA/4+SSJBbuMJgISS+AQCyE8yDia96SL0wLd43mpC4AJPdNr+TAAAB
5/2/2012 8:50:11 PM [3328,7] [RequestProcessor::ProcessEVAction] Added settings to cache:
5/2/2012 8:50:11 PM [3328,7] [RequestProcessor::ProcessEVAction]
5/2/2012 8:50:11 PM [3328,7] [RequestProcessor::ProcessEVAction] Finished handling EVAction, ending request processing
5/2/2012 8:50:11 PM [3328,7] [RequestProcessor:StopImpersonation] Stopped impersonation
5/2/2012 8:50:11 PM [3328,7] Request processing finished