5/2/2012 8:50:05 PM [3328,7] ############################################################# 5/2/2012 8:50:05 PM [3328,7] Request processing started 5/2/2012 8:50:05 PM [3328,7] Url: https://webmail.domainllp.com/owa/forms/premium/StartPage.aspx 5/2/2012 8:50:05 PM [3328,7] RawUrl: /owa/default.aspx 5/2/2012 8:50:05 PM [3328,7] Query String parameters: 5/2/2012 8:50:05 PM [3328,7] Cookies 5/2/2012 8:50:05 PM [3328,7] sessionid: 19146937-c049-4660-af1c-9a3eaf85b8ba 5/2/2012 8:50:05 PM [3328,7] cadata: "1+RIzkMNKCMj0YTHLZ+zPx0G4wxOZIDDao92sgwXeX8pOZd0qDlms2Bfjnuw=" 5/2/2012 8:50:05 PM [3328,7] UserContext: 7f0874f9e0194872a8284b0ae1e34f97 5/2/2012 8:50:05 PM [3328,7] Form: 5/2/2012 8:50:05 PM [3328,7] OWA Session details 5/2/2012 8:50:05 PM [3328,7] User agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729) 5/2/2012 8:50:05 PM [3328,7] Authentication type: Basic 5/2/2012 8:50:05 PM [3328,7] Authenticated user: domain\JDoe 5/2/2012 8:50:05 PM [3328,7] Client IP Address: 10.30.51.61 5/2/2012 8:50:05 PM [3328,7] Server IP Address: 10.30.1.186 5/2/2012 8:50:05 PM [3328,7] Host: webmail.domainllp.com 5/2/2012 8:50:05 PM [3328,7] Primary SMTP Address: John.Doe@domainllp.com 5/2/2012 8:50:05 PM [3328,7] Explicit Logon: False 5/2/2012 8:50:05 PM [3328,7] Explicit Logon Address: owa 5/2/2012 8:50:05 PM [3328,7] EV Extensions DLL version: 10.0.0.0 5/2/2012 8:50:05 PM [3328,7] [RequestProcessor::StartImpersonation] Impersonating logged on user 5/2/2012 8:50:05 PM [3328,7] [EVContext::Initialise] Loading EVContext 5/2/2012 8:50:05 PM [3328,7] [Resources::LoadLanguageFile] Trying to opening language file: D:\Program Files\Microsoft\Exchange\ClientAccess\owa\EnterpriseVault\v10.0.0.1316\Languages\en-us.lan 5/2/2012 8:50:05 PM [3328,7] [Resources::LoadLanguageFile] Language file not found 5/2/2012 8:50:05 PM [3328,7] [Resources::LoadLanguageFile] Trying to opening language file: D:\Program Files\Microsoft\Exchange\ClientAccess\owa\EnterpriseVault\v10.0.0.1316\Languages\en.lan 5/2/2012 8:50:05 PM [3328,7] [Resources::LoadLanguageFile] Loaded language: en 5/2/2012 8:50:05 PM [3328,7] [EVContext::ResetHiddenSettings] Resetting hidden settings to defaults 5/2/2012 8:50:05 PM [3328,7] [EVContext::LoadHiddenSettings] Loading hidden settings 5/2/2012 8:50:05 PM [3328,7] [EVContext::LoadHiddenSettings] Getting hidden message entry id using SMTP address: John.Doe@domainllp.com 5/2/2012 8:50:05 PM [3328,7] [WebDAVHelpers::GetEVHiddenMessageId] Mailbox Url: http://exchange/exchange/John.Doe@domainllp.com 5/2/2012 8:50:05 PM [3328,7] [WebDAVRequest::Send] Request url: http://exchange/exchange/John.Doe@domainllp.com 5/2/2012 8:50:05 PM [3328,7] [WebDAVRequest::Send] Request method: PROPFIND 5/2/2012 8:50:05 PM [3328,7] [WebDAVRequest::Send] Request timeout (milliseconds): 30000 5/2/2012 8:50:05 PM [3328,7] [WebDAVRequest::Send] Adding FBA cookies 5/2/2012 8:50:05 PM [3328,7] [WebDAVRequest::Send] Adding Depth header: 0 5/2/2012 8:50:05 PM [3328,7] [WebDAVRequest::Send] Request body: 5/2/2012 8:50:05 PM [3328,7] [WebDAVRequest::Send] Creating XmlDocument 5/2/2012 8:50:05 PM [3328,7] [WebDAVRequest::Send] Loading XmlDocument 5/2/2012 8:50:05 PM [3328,7] [WebDAVRequest::Send] Loaded XmlDocument: http://exchange/exchange/John.Doe@domainllp.com/HTTP/1.1 200 OKhttp://exchange/exchange/John.Doe@domainllp.com/Inbox 5/2/2012 8:50:05 PM [3328,7] [WebDAVHelpers::GetEVHiddenMessageId] Inbox Url: http://exchange/exchange/John.Doe@domainllp.com/Inbox 5/2/2012 8:50:05 PM [3328,7] [WebDAVRequest::Send] Request url: http://exchange/exchange/John.Doe@domainllp.com/Inbox 5/2/2012 8:50:05 PM [3328,7] [WebDAVRequest::Send] Request method: SEARCH 5/2/2012 8:50:05 PM [3328,7] [WebDAVRequest::Send] Request timeout (milliseconds): 30000 5/2/2012 8:50:05 PM [3328,7] [WebDAVRequest::Send] Adding FBA cookies 5/2/2012 8:50:05 PM [3328,7] [WebDAVRequest::Send] Request body: SELECT "http://schemas.microsoft.com/mapi/proptag/x0FFF0102" FROM SCOPE('shallow traversal of "http://exchange/exchange/John.Doe@domainllp.com/Inbox"') WHERE "DAV:ishidden" = true AND "http://schemas.microsoft.com/exchange/outlookmessageclass" = 'IPM.Note.EnterpriseVault.Settings' 5/2/2012 8:50:06 PM [3328,7] [WebDAVRequest::Send] Creating XmlDocument 5/2/2012 8:50:06 PM [3328,7] [WebDAVRequest::Send] Loading XmlDocument 5/2/2012 8:50:06 PM [3328,7] [WebDAVRequest::Send] Loaded XmlDocument: http://exchange/exchange/John.Doe@domainllp.com/Inbox/No%20Subject-9689.EMLHTTP/1.1 200 OKAAAAAFFObMD/j5JIkFu4wmAhJL4HALITzIOJr3pIvTAt3jeakLgAk902v5MAALITzIOJr3pIvTAt3jeakLgAp62kJVQAAA== 5/2/2012 8:50:06 PM [3328,7] [WebDAVHelpers::GetEVHiddenMessageId] ID: AAAAAFFObMD/j5JIkFu4wmAhJL4HALITzIOJr3pIvTAt3jeakLgAk902v5MAALITzIOJr3pIvTAt3jeakLgAp62kJVQAAA== 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] Retrieved hidden message entry id 5/2/2012 8:50:06 PM [3328,7] [Id::EwsId] Converting EntryId to EwsId 5/2/2012 8:50:06 PM [3328,7] [MailboxBase::MailboxBase] Connecting to Exchange Web Services using: https://10.30.1.186/ews/exchange.asmx 5/2/2012 8:50:06 PM [3328,7] [ConvertId::DoConvertId] Converting ID using web services 5/2/2012 8:50:06 PM [3328,7] [Id::EwsId] Converted EntryId to Mailbox EwsId: AAMkAGQ1YmMwZTZkLTZiNjctNGVmYy05NmY3LTk3ODJmNzUwNGEyOQBGAAAAAABRTmzA/4+SSJBbuMJgISS+BwCyE8yDia96SL0wLd43mpC4AJPdNr+TAACyE8yDia96SL0wLd43mpC4AKetpCVUAAA= 5/2/2012 8:50:06 PM [3328,7] [MailboxBase::MailboxBase] Connecting to Exchange Web Services using: https://10.30.1.186/ews/exchange.asmx 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] Retrieved hidden message from web services 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] Settings from hidden message: 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] SiteEntryId=110908EDFE008FF45A045495614D10A991d10000evcl 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] DefaultDoubleClickView=0 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] DefaultWebAppURL=http://evcl.domain.com/EnterpriseVault 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] OWAWebAppURL=http://evcl.domain.com/EVAnon 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] MailboxServer=exchange 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] SystemMailbox=SMTP:EVSysMail@domainllp.com 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] UsersCanDeleteItems=0 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] ServerVersion=10.00 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] MailboxState=1 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] MailboxDN=/o=domain/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=JDoe 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] DefaultArchiveId=192D23990F8B2604586339338FADBA7C11110000evcl 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] UseInactivityPeriod=0 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] UseQuotaLimit=1 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] InactivityPeriodUnits=1 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] InactivityPeriod=4 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] MinAgePeriodUnits=1 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] MinAgePeriod=0 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] UseLargeItemsSize=1 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] LargeItemsSizeKB=51200 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] ArchiveOnlyWithAttach=0 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] ArchiveDelItemsFolder=0 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] PFInactivityPeriodUnits=2 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] PFInactivityPeriod=6 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] PFMinAgePeriodUnits=1 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] PFMinAgePeriod=2 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] PFUseLargeItemsSize=0 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] PFLargeItemsSizeKB=10240 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] PolicyEntryId=15AD3E7931913E843A1C639326EB6325F1s10000evcl 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] PSTPolicyEntryId=12732BF7D7D04834BA3E3ADD7EF4BFC141s10000evcl 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] DefaultRetentionCategoryId=14FEB6954573C9F42BCB49D18A05766E51b10000evcl 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] PSTImportEnabled=0 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] ArchiveManagedFolders=0 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] ManagedFolderHandling=2 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] ArchiveSettingsLocked=1 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] AddServerToIntraNetZone=evcl.domain.com;erisevcluster.domain.com;eris.domain.com;evcl;erisevcluster;eris 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] AllowScriptPublicFolders=1 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] AllowScriptSharedFolders=1 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] ArchiveExplorerBtnVisible=1 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] BrowserSearchLink=0 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] DeleteBtnVisible=0 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] DeployFormsLocally=2 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] LaunchAEInBrowser=1 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] MarkPSTs=1 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] OVEnabled=2 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] OVStartDownloadBtnVisible=1 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] OVStoreSize=30720 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] OVStoreSizePercent=0 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] UseSelfInstallFunct=0 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] VVEnabled=1 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] VVReadingPaneContent=1 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] OWA2003CancelFromToolbar=0 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] OWA2003DeleteFromContextMenu=0 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] OWA2003DeleteFromToolbar=0 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] OWA2003DeleteMode=0 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] OWAClientUseDirectConnection=1 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] EVSERVERS=evcl.domain.com;ERISEVCLUSTER; 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] OVMessageClassInclude=IPM.Post*;IPM.Note*;IPM.Document*; 5/2/2012 8:50:06 PM [3328,7] [EVContext::LoadHiddenSettings] Finished loading hidden settings 5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Mailbox Settings loaded at: Wednesday, May 02, 2012, 8:50:06 PM 5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Enabled for archiving: Enabled 5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Web App Url: http://evcl.domain.com/EVAnon 5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Default Web App Url: http://evcl.domain.com/EnterpriseVault 5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] External Web App Url: /enterprisevault 5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Mailbox DN: /o=domain/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=JDoe 5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Default Archive Id: 192D23990F8B2604586339338FADBA7C11110000evcl 5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Default Ret Cat Id: 14FEB6954573C9F42BCB49D18A05766E51b10000evcl 5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Site Entry Id: 110908EDFE008FF45A045495614D10A991d10000evcl 5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Users Can Delete Items: False 5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] EV Server Version: 10.00 5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] View Mode: OWA 5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Open Mode: ArchivedItem 5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Reply Mode: ArchivedItem 5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Reply to All Mode: ArchivedItem 5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Forward Mode: ArchivedItem 5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Delete Mode: ShortcutOnly 5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Archive on Toolbar: True 5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Restore on Toolbar: True 5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Cancel on Toolbar: False 5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Delete on Toolbar: False 5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Help on Toolbar: True 5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Archive on Context Menu: True 5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Restore on Context Menu: True 5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Cancel on Context Menu: True 5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Delete on Context Menu: False 5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Archive Explorer in Light Client: True 5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Archive Explorer in Premium Client: True 5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Search in Light Client: True 5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Search in Premium Client: True 5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Browser Search Link: False 5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Archive Managed Folders: False 5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Managed Folder Handling: Managed 5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Archive function in Light Client: Basic 5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Archive function in Premium Client: Enhanced 5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Archive Confirmation (basic function): True 5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Archive Sub Folders (basic function): False 5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Restore function in Light Client: Basic 5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Restore function in Premium Client: Enhanced 5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Delete Shortcut on restore (basic function): True 5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Restore confirmation (basic function): True 5/2/2012 8:50:06 PM [3328,7] [EVContext::LogHiddenSettings] Restore to restored items folder (basic function): False 5/2/2012 8:50:06 PM [3328,7] [EVContext::Initialise] EVContext intialised at 5/2/2012 8:50:06 PM 5/2/2012 8:50:06 PM [3328,7] [EVContext::Initialise] Hidden settings loaded at 5/2/2012 8:50:06 PM 5/2/2012 8:50:06 PM [3328,7] [EVContext::IsValidBrowser] Checking browser... 5/2/2012 8:50:06 PM [3328,7] [EVContext::IsValidBrowser] User agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729) 5/2/2012 8:50:06 PM [3328,7] [EVContext::IsValidBrowser] Using premium client - browser valid 5/2/2012 8:50:06 PM [3328,7] [EVContext::IsValidBrowser] Returning: True 5/2/2012 8:50:06 PM [3328,7] [RequestProcessor::ProcessRequest] Setting response filter: Premium.WunderBar 5/2/2012 8:50:06 PM [3328,7] [RequestProcessor:StopImpersonation] Stopped impersonation 5/2/2012 8:50:06 PM [3328,7] Request processing finished 5/2/2012 8:50:06 PM [3328,7] ############################################################# 5/2/2012 8:50:06 PM [3328,7] Request processing started 5/2/2012 8:50:06 PM [3328,7] Url: https://webmail.domainllp.com/owa/forms/premium/StartPage.aspx 5/2/2012 8:50:06 PM [3328,7] RawUrl: /owa/default.aspx 5/2/2012 8:50:06 PM [3328,7] Query String parameters: 5/2/2012 8:50:06 PM [3328,7] Cookies 5/2/2012 8:50:06 PM [3328,7] sessionid: 19146937-c049-4660-af1c-9a3eaf85b8ba 5/2/2012 8:50:06 PM [3328,7] cadata: "1+RIzkMNKCMj0YTHLZ+zPx0G4wxOZIDDao92sgwXeX8pOZd0qDlms2Bfjnuw=" 5/2/2012 8:50:06 PM [3328,7] UserContext: 7f0874f9e0194872a8284b0ae1e34f97 5/2/2012 8:50:06 PM [3328,7] Form: 5/2/2012 8:50:06 PM [3328,7] OWA Session details 5/2/2012 8:50:06 PM [3328,7] User agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729) 5/2/2012 8:50:06 PM [3328,7] Authentication type: Basic 5/2/2012 8:50:06 PM [3328,7] Authenticated user: domain\JDoe 5/2/2012 8:50:06 PM [3328,7] Client IP Address: 10.30.51.61 5/2/2012 8:50:06 PM [3328,7] Server IP Address: 10.30.1.186 5/2/2012 8:50:06 PM [3328,7] Host: webmail.domainllp.com 5/2/2012 8:50:06 PM [3328,7] Primary SMTP Address: John.Doe@domainllp.com 5/2/2012 8:50:06 PM [3328,7] Explicit Logon: False 5/2/2012 8:50:06 PM [3328,7] Explicit Logon Address: owa 5/2/2012 8:50:06 PM [3328,7] EV Extensions DLL version: 10.0.0.0 5/2/2012 8:50:06 PM [3328,7] [RequestProcessor::StartImpersonation] Impersonating logged on user 5/2/2012 8:50:06 PM [3328,7] [EVContext::Initialise] EVContext intialised at 5/2/2012 8:50:06 PM 5/2/2012 8:50:06 PM [3328,7] [EVContext::Initialise] Hidden settings loaded at 5/2/2012 8:50:06 PM 5/2/2012 8:50:06 PM [3328,7] [EVContext::IsValidBrowser] Returning: True 5/2/2012 8:50:06 PM [3328,7] [RequestProcessor::PostProcessRequest] Checking for reply/forward to EV item 5/2/2012 8:50:06 PM [3328,7] [RequestProcessor:StopImpersonation] Stopped impersonation 5/2/2012 8:50:06 PM [3328,7] Request processing finished 5/2/2012 8:50:06 PM [3328,7] ############################################################# 5/2/2012 8:50:06 PM [3328,7] Response filter started 5/2/2012 8:50:06 PM [3328,7] Url: https://webmail.domainllp.com/owa/forms/premium/StartPage.aspx 5/2/2012 8:50:06 PM [3328,7] RawUrl: /owa/default.aspx 5/2/2012 8:50:06 PM [3328,7] Query String parameters: 5/2/2012 8:50:06 PM [3328,7] Form: 5/2/2012 8:50:06 PM [3328,7] EV Extensions Resource version: v10.0.0.1316 5/2/2012 8:50:06 PM [3328,7] [EVContext::Initialise] EVContext intialised at 5/2/2012 8:50:06 PM 5/2/2012 8:50:06 PM [3328,7] [EVContext::Initialise] Hidden settings loaded at 5/2/2012 8:50:06 PM 5/2/2012 8:50:06 PM [3328,7] Response filter invoked: Symantec.EnterpriseVault.Owa.ResponseFilters.Premium.WunderBar 5/2/2012 8:50:06 PM [3328,7] Response filter finished 5/2/2012 8:50:06 PM [3328,7] ############################################################# 5/2/2012 8:50:06 PM [3328,7] Request processing started 5/2/2012 8:50:06 PM [3328,7] Url: https://webmail.domainllp.com/owa/forms/premium/MessageView.aspx?ae=Folder&t=IPF.Note&a= 5/2/2012 8:50:06 PM [3328,7] RawUrl: /owa/default.aspx?ae=Folder&t=IPF.Note&a= 5/2/2012 8:50:06 PM [3328,7] Query String parameters: 5/2/2012 8:50:06 PM [3328,7] ae: Folder 5/2/2012 8:50:06 PM [3328,7] t: IPF.Note 5/2/2012 8:50:06 PM [3328,7] a: 5/2/2012 8:50:06 PM [3328,7] Cookies 5/2/2012 8:50:06 PM [3328,7] sessionid: 19146937-c049-4660-af1c-9a3eaf85b8ba 5/2/2012 8:50:06 PM [3328,7] cadata: "1+RIzkMNKCMj0YTHLZ+zPx0G4wxOZIDDao92sgwXeX8pOZd0qDlms2Bfjnuw=" 5/2/2012 8:50:06 PM [3328,7] UserContext: 7f0874f9e0194872a8284b0ae1e34f97 5/2/2012 8:50:06 PM [3328,7] Form: 5/2/2012 8:50:06 PM [3328,7] OWA Session details 5/2/2012 8:50:06 PM [3328,7] User agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729) 5/2/2012 8:50:06 PM [3328,7] Authentication type: Basic 5/2/2012 8:50:06 PM [3328,7] Authenticated user: domain\JDoe 5/2/2012 8:50:06 PM [3328,7] Client IP Address: 10.30.51.61 5/2/2012 8:50:06 PM [3328,7] Server IP Address: 10.30.1.186 5/2/2012 8:50:06 PM [3328,7] Host: webmail.domainllp.com 5/2/2012 8:50:06 PM [3328,7] Primary SMTP Address: John.Doe@domainllp.com 5/2/2012 8:50:06 PM [3328,7] Explicit Logon: False 5/2/2012 8:50:06 PM [3328,7] Explicit Logon Address: owa 5/2/2012 8:50:06 PM [3328,7] EV Extensions DLL version: 10.0.0.0 5/2/2012 8:50:06 PM [3328,7] [RequestProcessor::StartImpersonation] Impersonating logged on user 5/2/2012 8:50:06 PM [3328,7] [EVContext::Initialise] EVContext intialised at 5/2/2012 8:50:06 PM 5/2/2012 8:50:06 PM [3328,7] [EVContext::Initialise] Hidden settings loaded at 5/2/2012 8:50:06 PM 5/2/2012 8:50:06 PM [3328,7] [EVContext::IsValidBrowser] Returning: True 5/2/2012 8:50:06 PM [3328,7] [RequestProcessor::ProcessRequest] Setting response filter: Premium.Folder 5/2/2012 8:50:06 PM [3328,7] [RequestProcessor:StopImpersonation] Stopped impersonation 5/2/2012 8:50:06 PM [3328,7] Request processing finished 5/2/2012 8:50:06 PM [3328,7] ############################################################# 5/2/2012 8:50:06 PM [3328,7] Request processing started 5/2/2012 8:50:06 PM [3328,7] Url: https://webmail.domainllp.com/owa/forms/premium/MessageView.aspx?ae=Folder&t=IPF.Note&a= 5/2/2012 8:50:06 PM [3328,7] RawUrl: /owa/default.aspx?ae=Folder&t=IPF.Note&a= 5/2/2012 8:50:06 PM [3328,7] Query String parameters: 5/2/2012 8:50:06 PM [3328,7] ae: Folder 5/2/2012 8:50:06 PM [3328,7] t: IPF.Note 5/2/2012 8:50:06 PM [3328,7] a: 5/2/2012 8:50:06 PM [3328,7] Cookies 5/2/2012 8:50:06 PM [3328,7] sessionid: 19146937-c049-4660-af1c-9a3eaf85b8ba 5/2/2012 8:50:06 PM [3328,7] cadata: "1+RIzkMNKCMj0YTHLZ+zPx0G4wxOZIDDao92sgwXeX8pOZd0qDlms2Bfjnuw=" 5/2/2012 8:50:06 PM [3328,7] UserContext: 7f0874f9e0194872a8284b0ae1e34f97 5/2/2012 8:50:06 PM [3328,7] Form: 5/2/2012 8:50:06 PM [3328,7] OWA Session details 5/2/2012 8:50:06 PM [3328,7] User agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729) 5/2/2012 8:50:06 PM [3328,7] Authentication type: Basic 5/2/2012 8:50:06 PM [3328,7] Authenticated user: domain\JDoe 5/2/2012 8:50:06 PM [3328,7] Client IP Address: 10.30.51.61 5/2/2012 8:50:06 PM [3328,7] Server IP Address: 10.30.1.186 5/2/2012 8:50:06 PM [3328,7] Host: webmail.domainllp.com 5/2/2012 8:50:06 PM [3328,7] Primary SMTP Address: John.Doe@domainllp.com 5/2/2012 8:50:06 PM [3328,7] Explicit Logon: False 5/2/2012 8:50:06 PM [3328,7] Explicit Logon Address: owa 5/2/2012 8:50:06 PM [3328,7] EV Extensions DLL version: 10.0.0.0 5/2/2012 8:50:06 PM [3328,7] [RequestProcessor::StartImpersonation] Impersonating logged on user 5/2/2012 8:50:06 PM [3328,7] [EVContext::Initialise] EVContext intialised at 5/2/2012 8:50:06 PM 5/2/2012 8:50:06 PM [3328,7] [EVContext::Initialise] Hidden settings loaded at 5/2/2012 8:50:06 PM 5/2/2012 8:50:06 PM [3328,7] [EVContext::IsValidBrowser] Returning: True 5/2/2012 8:50:06 PM [3328,7] [RequestProcessor::PostProcessRequest] Checking for reply/forward to EV item 5/2/2012 8:50:06 PM [3328,7] [RequestProcessor:StopImpersonation] Stopped impersonation 5/2/2012 8:50:06 PM [3328,7] Request processing finished 5/2/2012 8:50:06 PM [3328,7] ############################################################# 5/2/2012 8:50:06 PM [3328,7] Response filter started 5/2/2012 8:50:06 PM [3328,7] Url: https://webmail.domainllp.com/owa/forms/premium/MessageView.aspx?ae=Folder&t=IPF.Note&a= 5/2/2012 8:50:06 PM [3328,7] RawUrl: /owa/default.aspx?ae=Folder&t=IPF.Note&a= 5/2/2012 8:50:06 PM [3328,7] Query String parameters: 5/2/2012 8:50:06 PM [3328,7] ae: Folder 5/2/2012 8:50:06 PM [3328,7] t: IPF.Note 5/2/2012 8:50:06 PM [3328,7] a: 5/2/2012 8:50:06 PM [3328,7] Form: 5/2/2012 8:50:06 PM [3328,7] EV Extensions Resource version: v10.0.0.1316 5/2/2012 8:50:06 PM [3328,7] [EVContext::Initialise] EVContext intialised at 5/2/2012 8:50:06 PM 5/2/2012 8:50:06 PM [3328,7] [EVContext::Initialise] Hidden settings loaded at 5/2/2012 8:50:06 PM 5/2/2012 8:50:06 PM [3328,7] Response filter invoked: Symantec.EnterpriseVault.Owa.ResponseFilters.Premium.Folder 5/2/2012 8:50:06 PM [3328,7] Response filter finished 5/2/2012 8:50:07 PM [3328,7] ############################################################# 5/2/2012 8:50:07 PM [3328,7] Request processing started 5/2/2012 8:50:07 PM [3328,7] Url: https://webmail.domainllp.com/owa/forms/premium/ReadMessage.aspx?ae=Item&a=Preview&t=IPM.Note&id=RgAAAABRTmzA/4+SSJBbuMJgISS+BwCyE8yDia96SL0wLd43mpC4AJPdNr+TAACyE8yDia96SL0wLd43mpC4AKetpCVTAAAJ 5/2/2012 8:50:07 PM [3328,7] RawUrl: /owa/default.aspx?ae=Item&a=Preview&t=IPM.Note&id=RgAAAABRTmzA%2f4%2bSSJBbuMJgISS%2bBwCyE8yDia96SL0wLd43mpC4AJPdNr%2bTAACyE8yDia96SL0wLd43mpC4AKetpCVTAAAJ 5/2/2012 8:50:07 PM [3328,7] Query String parameters: 5/2/2012 8:50:07 PM [3328,7] ae: Item 5/2/2012 8:50:07 PM [3328,7] a: Preview 5/2/2012 8:50:07 PM [3328,7] t: IPM.Note 5/2/2012 8:50:07 PM [3328,7] id: RgAAAABRTmzA/4+SSJBbuMJgISS+BwCyE8yDia96SL0wLd43mpC4AJPdNr+TAACyE8yDia96SL0wLd43mpC4AKetpCVTAAAJ 5/2/2012 8:50:07 PM [3328,7] Cookies 5/2/2012 8:50:07 PM [3328,7] sessionid: 19146937-c049-4660-af1c-9a3eaf85b8ba 5/2/2012 8:50:07 PM [3328,7] cadata: "1+RIzkMNKCMj0YTHLZ+zPx0G4wxOZIDDao92sgwXeX8pOZd0qDlms2Bfjnuw=" 5/2/2012 8:50:07 PM [3328,7] UserContext: 7f0874f9e0194872a8284b0ae1e34f97 5/2/2012 8:50:07 PM [3328,7] Form: 5/2/2012 8:50:07 PM [3328,7] OWA Session details 5/2/2012 8:50:07 PM [3328,7] User agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729) 5/2/2012 8:50:07 PM [3328,7] Authentication type: Basic 5/2/2012 8:50:07 PM [3328,7] Authenticated user: domain\JDoe 5/2/2012 8:50:07 PM [3328,7] Client IP Address: 10.30.51.61 5/2/2012 8:50:07 PM [3328,7] Server IP Address: 10.30.1.186 5/2/2012 8:50:07 PM [3328,7] Host: webmail.domainllp.com 5/2/2012 8:50:07 PM [3328,7] Primary SMTP Address: John.Doe@domainllp.com 5/2/2012 8:50:07 PM [3328,7] Explicit Logon: False 5/2/2012 8:50:07 PM [3328,7] Explicit Logon Address: owa 5/2/2012 8:50:07 PM [3328,7] EV Extensions DLL version: 10.0.0.0 5/2/2012 8:50:07 PM [3328,7] [RequestProcessor::StartImpersonation] Impersonating logged on user 5/2/2012 8:50:07 PM [3328,7] [EVContext::Initialise] EVContext intialised at 5/2/2012 8:50:06 PM 5/2/2012 8:50:07 PM [3328,7] [EVContext::Initialise] Hidden settings loaded at 5/2/2012 8:50:06 PM 5/2/2012 8:50:07 PM [3328,7] [EVContext::IsValidBrowser] Returning: True 5/2/2012 8:50:07 PM [3328,7] [RequestProcessor::ProcessItem] started 5/2/2012 8:50:07 PM [3328,7] [RequestProcessor::ProcessItem] Finished 5/2/2012 8:50:07 PM [3328,7] [RequestProcessor:StopImpersonation] Stopped impersonation 5/2/2012 8:50:07 PM [3328,7] Request processing finished 5/2/2012 8:50:07 PM [3328,7] ############################################################# 5/2/2012 8:50:07 PM [3328,7] Request processing started 5/2/2012 8:50:07 PM [3328,7] Url: https://webmail.domainllp.com/owa/forms/premium/ReadMessage.aspx?ae=Item&a=Preview&t=IPM.Note&id=RgAAAABRTmzA/4+SSJBbuMJgISS+BwCyE8yDia96SL0wLd43mpC4AJPdNr+TAACyE8yDia96SL0wLd43mpC4AKetpCVTAAAJ 5/2/2012 8:50:07 PM [3328,7] RawUrl: /owa/default.aspx?ae=Item&a=Preview&t=IPM.Note&id=RgAAAABRTmzA%2f4%2bSSJBbuMJgISS%2bBwCyE8yDia96SL0wLd43mpC4AJPdNr%2bTAACyE8yDia96SL0wLd43mpC4AKetpCVTAAAJ 5/2/2012 8:50:07 PM [3328,7] Query String parameters: 5/2/2012 8:50:07 PM [3328,7] ae: Item 5/2/2012 8:50:07 PM [3328,7] a: Preview 5/2/2012 8:50:07 PM [3328,7] t: IPM.Note 5/2/2012 8:50:07 PM [3328,7] id: RgAAAABRTmzA/4+SSJBbuMJgISS+BwCyE8yDia96SL0wLd43mpC4AJPdNr+TAACyE8yDia96SL0wLd43mpC4AKetpCVTAAAJ 5/2/2012 8:50:07 PM [3328,7] Cookies 5/2/2012 8:50:07 PM [3328,7] sessionid: 19146937-c049-4660-af1c-9a3eaf85b8ba 5/2/2012 8:50:07 PM [3328,7] cadata: "1+RIzkMNKCMj0YTHLZ+zPx0G4wxOZIDDao92sgwXeX8pOZd0qDlms2Bfjnuw=" 5/2/2012 8:50:07 PM [3328,7] UserContext: 7f0874f9e0194872a8284b0ae1e34f97 5/2/2012 8:50:07 PM [3328,7] Form: 5/2/2012 8:50:07 PM [3328,7] OWA Session details 5/2/2012 8:50:07 PM [3328,7] User agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729) 5/2/2012 8:50:07 PM [3328,7] Authentication type: Basic 5/2/2012 8:50:07 PM [3328,7] Authenticated user: domain\JDoe 5/2/2012 8:50:07 PM [3328,7] Client IP Address: 10.30.51.61 5/2/2012 8:50:07 PM [3328,7] Server IP Address: 10.30.1.186 5/2/2012 8:50:07 PM [3328,7] Host: webmail.domainllp.com 5/2/2012 8:50:07 PM [3328,7] Primary SMTP Address: John.Doe@domainllp.com 5/2/2012 8:50:07 PM [3328,7] Explicit Logon: False 5/2/2012 8:50:07 PM [3328,7] Explicit Logon Address: owa 5/2/2012 8:50:07 PM [3328,7] EV Extensions DLL version: 10.0.0.0 5/2/2012 8:50:07 PM [3328,7] [RequestProcessor::StartImpersonation] Impersonating logged on user 5/2/2012 8:50:07 PM [3328,7] [EVContext::Initialise] EVContext intialised at 5/2/2012 8:50:06 PM 5/2/2012 8:50:07 PM [3328,7] [EVContext::Initialise] Hidden settings loaded at 5/2/2012 8:50:06 PM 5/2/2012 8:50:07 PM [3328,7] [EVContext::IsValidBrowser] Returning: True 5/2/2012 8:50:07 PM [3328,7] [RequestProcessor::PostProcessRequest] Checking for reply/forward to EV item 5/2/2012 8:50:07 PM [3328,7] [RequestProcessor:StopImpersonation] Stopped impersonation 5/2/2012 8:50:07 PM [3328,7] Request processing finished 5/2/2012 8:50:07 PM [3328,7] ############################################################# 5/2/2012 8:50:07 PM [3328,7] Request processing started 5/2/2012 8:50:07 PM [3328,7] Url: https://webmail.domainllp.com/owa/attachment.ashx?id=RgAAAABRTmzA/4+SSJBbuMJgISS+BwCyE8yDia96SL0wLd43mpC4AJPdNr+TAACyE8yDia96SL0wLd43mpC4AKetpCVTAAAJ&attcnt=1&attid0=EADa6lQeGeuNS7NAOVnaV33C 5/2/2012 8:50:07 PM [3328,7] RawUrl: /owa/attachment.ashx?id=RgAAAABRTmzA%2f4%2bSSJBbuMJgISS%2bBwCyE8yDia96SL0wLd43mpC4AJPdNr%2bTAACyE8yDia96SL0wLd43mpC4AKetpCVTAAAJ&attcnt=1&attid0=EADa6lQeGeuNS7NAOVnaV33C 5/2/2012 8:50:07 PM [3328,7] Query String parameters: 5/2/2012 8:50:07 PM [3328,7] id: RgAAAABRTmzA/4+SSJBbuMJgISS+BwCyE8yDia96SL0wLd43mpC4AJPdNr+TAACyE8yDia96SL0wLd43mpC4AKetpCVTAAAJ 5/2/2012 8:50:07 PM [3328,7] attcnt: 1 5/2/2012 8:50:07 PM [3328,7] attid0: EADa6lQeGeuNS7NAOVnaV33C 5/2/2012 8:50:07 PM [3328,7] Cookies 5/2/2012 8:50:07 PM [3328,7] sessionid: 19146937-c049-4660-af1c-9a3eaf85b8ba 5/2/2012 8:50:07 PM [3328,7] cadata: "1+RIzkMNKCMj0YTHLZ+zPx0G4wxOZIDDao92sgwXeX8pOZd0qDlms2Bfjnuw=" 5/2/2012 8:50:07 PM [3328,7] UserContext: 7f0874f9e0194872a8284b0ae1e34f97 5/2/2012 8:50:07 PM [3328,7] Form: 5/2/2012 8:50:07 PM [3328,7] OWA Session details 5/2/2012 8:50:07 PM [3328,7] User agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729) 5/2/2012 8:50:07 PM [3328,7] Authentication type: Basic 5/2/2012 8:50:07 PM [3328,7] Authenticated user: domain\JDoe 5/2/2012 8:50:07 PM [3328,7] Client IP Address: 10.30.51.61 5/2/2012 8:50:07 PM [3328,7] Server IP Address: 10.30.1.186 5/2/2012 8:50:07 PM [3328,7] Host: webmail.domainllp.com 5/2/2012 8:50:07 PM [3328,7] Primary SMTP Address: John.Doe@domainllp.com 5/2/2012 8:50:07 PM [3328,7] Explicit Logon: False 5/2/2012 8:50:07 PM [3328,7] Explicit Logon Address: owa 5/2/2012 8:50:07 PM [3328,7] EV Extensions DLL version: 10.0.0.0 5/2/2012 8:50:07 PM [3328,7] [RequestProcessor::StartImpersonation] Impersonating logged on user 5/2/2012 8:50:07 PM [3328,7] [EVContext::Initialise] EVContext intialised at 5/2/2012 8:50:06 PM 5/2/2012 8:50:07 PM [3328,7] [EVContext::Initialise] Hidden settings loaded at 5/2/2012 8:50:06 PM 5/2/2012 8:50:07 PM [3328,7] [EVContext::IsValidBrowser] Returning: True 5/2/2012 8:50:07 PM [3328,7] [RequestProcessor:StopImpersonation] Stopped impersonation 5/2/2012 8:50:07 PM [3328,7] Request processing finished 5/2/2012 8:50:07 PM [3328,7] ############################################################# 5/2/2012 8:50:07 PM [3328,7] Request processing started 5/2/2012 8:50:07 PM [3328,7] Url: https://webmail.domainllp.com/owa/attachment.ashx?id=RgAAAABRTmzA/4+SSJBbuMJgISS+BwCyE8yDia96SL0wLd43mpC4AJPdNr+TAACyE8yDia96SL0wLd43mpC4AKetpCVTAAAJ&attcnt=1&attid0=EADa6lQeGeuNS7NAOVnaV33C 5/2/2012 8:50:07 PM [3328,7] RawUrl: /owa/attachment.ashx?id=RgAAAABRTmzA%2f4%2bSSJBbuMJgISS%2bBwCyE8yDia96SL0wLd43mpC4AJPdNr%2bTAACyE8yDia96SL0wLd43mpC4AKetpCVTAAAJ&attcnt=1&attid0=EADa6lQeGeuNS7NAOVnaV33C 5/2/2012 8:50:07 PM [3328,7] Query String parameters: 5/2/2012 8:50:07 PM [3328,7] id: RgAAAABRTmzA/4+SSJBbuMJgISS+BwCyE8yDia96SL0wLd43mpC4AJPdNr+TAACyE8yDia96SL0wLd43mpC4AKetpCVTAAAJ 5/2/2012 8:50:07 PM [3328,7] attcnt: 1 5/2/2012 8:50:07 PM [3328,7] attid0: EADa6lQeGeuNS7NAOVnaV33C 5/2/2012 8:50:07 PM [3328,7] Cookies 5/2/2012 8:50:07 PM [3328,7] sessionid: 19146937-c049-4660-af1c-9a3eaf85b8ba 5/2/2012 8:50:07 PM [3328,7] cadata: "1+RIzkMNKCMj0YTHLZ+zPx0G4wxOZIDDao92sgwXeX8pOZd0qDlms2Bfjnuw=" 5/2/2012 8:50:07 PM [3328,7] UserContext: 7f0874f9e0194872a8284b0ae1e34f97 5/2/2012 8:50:07 PM [3328,7] Form: 5/2/2012 8:50:07 PM [3328,7] OWA Session details 5/2/2012 8:50:07 PM [3328,7] User agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729) 5/2/2012 8:50:07 PM [3328,7] Authentication type: Basic 5/2/2012 8:50:07 PM [3328,7] Authenticated user: domain\JDoe 5/2/2012 8:50:07 PM [3328,7] Client IP Address: 10.30.51.61 5/2/2012 8:50:07 PM [3328,7] Server IP Address: 10.30.1.186 5/2/2012 8:50:07 PM [3328,7] Host: webmail.domainllp.com 5/2/2012 8:50:07 PM [3328,7] Primary SMTP Address: John.Doe@domainllp.com 5/2/2012 8:50:07 PM [3328,7] Explicit Logon: False 5/2/2012 8:50:07 PM [3328,7] Explicit Logon Address: owa 5/2/2012 8:50:07 PM [3328,7] EV Extensions DLL version: 10.0.0.0 5/2/2012 8:50:07 PM [3328,7] [RequestProcessor::StartImpersonation] Impersonating logged on user 5/2/2012 8:50:07 PM [3328,7] [EVContext::Initialise] EVContext intialised at 5/2/2012 8:50:06 PM 5/2/2012 8:50:07 PM [3328,7] [EVContext::Initialise] Hidden settings loaded at 5/2/2012 8:50:06 PM 5/2/2012 8:50:07 PM [3328,7] [EVContext::IsValidBrowser] Returning: True 5/2/2012 8:50:07 PM [3328,7] [RequestProcessor::PostProcessRequest] Checking for reply/forward to EV item 5/2/2012 8:50:07 PM [3328,7] [RequestProcessor:StopImpersonation] Stopped impersonation 5/2/2012 8:50:07 PM [3328,7] Request processing finished 5/2/2012 8:50:07 PM [3328,7] ############################################################# 5/2/2012 8:50:07 PM [3328,7] Request processing started 5/2/2012 8:50:07 PM [3328,7] Url: https://webmail.domainllp.com/owa/attachment.ashx?id=RgAAAABRTmzA/4+SSJBbuMJgISS+BwCyE8yDia96SL0wLd43mpC4AJPdNr+TAACyE8yDia96SL0wLd43mpC4AKetpCVTAAAJ&attcnt=1&attid0=EACuk6g6iNgcR6DAfhAzZrUu 5/2/2012 8:50:07 PM [3328,7] RawUrl: /owa/attachment.ashx?id=RgAAAABRTmzA%2f4%2bSSJBbuMJgISS%2bBwCyE8yDia96SL0wLd43mpC4AJPdNr%2bTAACyE8yDia96SL0wLd43mpC4AKetpCVTAAAJ&attcnt=1&attid0=EACuk6g6iNgcR6DAfhAzZrUu 5/2/2012 8:50:07 PM [3328,7] Query String parameters: 5/2/2012 8:50:07 PM [3328,7] id: RgAAAABRTmzA/4+SSJBbuMJgISS+BwCyE8yDia96SL0wLd43mpC4AJPdNr+TAACyE8yDia96SL0wLd43mpC4AKetpCVTAAAJ 5/2/2012 8:50:07 PM [3328,7] attcnt: 1 5/2/2012 8:50:07 PM [3328,7] attid0: EACuk6g6iNgcR6DAfhAzZrUu 5/2/2012 8:50:07 PM [3328,7] Cookies 5/2/2012 8:50:07 PM [3328,7] sessionid: 19146937-c049-4660-af1c-9a3eaf85b8ba 5/2/2012 8:50:07 PM [3328,7] cadata: "1+RIzkMNKCMj0YTHLZ+zPx0G4wxOZIDDao92sgwXeX8pOZd0qDlms2Bfjnuw=" 5/2/2012 8:50:07 PM [3328,7] UserContext: 7f0874f9e0194872a8284b0ae1e34f97 5/2/2012 8:50:07 PM [3328,7] Form: 5/2/2012 8:50:07 PM [3328,7] OWA Session details 5/2/2012 8:50:07 PM [3328,7] User agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729) 5/2/2012 8:50:07 PM [3328,7] Authentication type: Basic 5/2/2012 8:50:07 PM [3328,7] Authenticated user: domain\JDoe 5/2/2012 8:50:07 PM [3328,7] Client IP Address: 10.30.51.61 5/2/2012 8:50:07 PM [3328,7] Server IP Address: 10.30.1.186 5/2/2012 8:50:07 PM [3328,7] Host: webmail.domainllp.com 5/2/2012 8:50:07 PM [3328,7] Primary SMTP Address: John.Doe@domainllp.com 5/2/2012 8:50:07 PM [3328,7] Explicit Logon: False 5/2/2012 8:50:07 PM [3328,7] Explicit Logon Address: owa 5/2/2012 8:50:07 PM [3328,7] EV Extensions DLL version: 10.0.0.0 5/2/2012 8:50:07 PM [3328,7] [RequestProcessor::StartImpersonation] Impersonating logged on user 5/2/2012 8:50:07 PM [3328,7] [EVContext::Initialise] EVContext intialised at 5/2/2012 8:50:06 PM 5/2/2012 8:50:07 PM [3328,7] [EVContext::Initialise] Hidden settings loaded at 5/2/2012 8:50:06 PM 5/2/2012 8:50:07 PM [3328,7] [EVContext::IsValidBrowser] Returning: True 5/2/2012 8:50:07 PM [3328,7] [RequestProcessor:StopImpersonation] Stopped impersonation 5/2/2012 8:50:07 PM [3328,7] Request processing finished 5/2/2012 8:50:07 PM [3328,7] ############################################################# 5/2/2012 8:50:07 PM [3328,7] Request processing started 5/2/2012 8:50:07 PM [3328,7] Url: https://webmail.domainllp.com/owa/attachment.ashx?id=RgAAAABRTmzA/4+SSJBbuMJgISS+BwCyE8yDia96SL0wLd43mpC4AJPdNr+TAACyE8yDia96SL0wLd43mpC4AKetpCVTAAAJ&attcnt=1&attid0=EACuk6g6iNgcR6DAfhAzZrUu 5/2/2012 8:50:07 PM [3328,7] RawUrl: /owa/attachment.ashx?id=RgAAAABRTmzA%2f4%2bSSJBbuMJgISS%2bBwCyE8yDia96SL0wLd43mpC4AJPdNr%2bTAACyE8yDia96SL0wLd43mpC4AKetpCVTAAAJ&attcnt=1&attid0=EACuk6g6iNgcR6DAfhAzZrUu 5/2/2012 8:50:07 PM [3328,7] Query String parameters: 5/2/2012 8:50:07 PM [3328,7] id: RgAAAABRTmzA/4+SSJBbuMJgISS+BwCyE8yDia96SL0wLd43mpC4AJPdNr+TAACyE8yDia96SL0wLd43mpC4AKetpCVTAAAJ 5/2/2012 8:50:07 PM [3328,7] attcnt: 1 5/2/2012 8:50:07 PM [3328,7] attid0: EACuk6g6iNgcR6DAfhAzZrUu 5/2/2012 8:50:07 PM [3328,7] Cookies 5/2/2012 8:50:07 PM [3328,7] sessionid: 19146937-c049-4660-af1c-9a3eaf85b8ba 5/2/2012 8:50:07 PM [3328,7] cadata: "1+RIzkMNKCMj0YTHLZ+zPx0G4wxOZIDDao92sgwXeX8pOZd0qDlms2Bfjnuw=" 5/2/2012 8:50:07 PM [3328,7] UserContext: 7f0874f9e0194872a8284b0ae1e34f97 5/2/2012 8:50:07 PM [3328,7] Form: 5/2/2012 8:50:07 PM [3328,7] OWA Session details 5/2/2012 8:50:07 PM [3328,7] User agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729) 5/2/2012 8:50:07 PM [3328,7] Authentication type: Basic 5/2/2012 8:50:07 PM [3328,7] Authenticated user: domain\JDoe 5/2/2012 8:50:07 PM [3328,7] Client IP Address: 10.30.51.61 5/2/2012 8:50:07 PM [3328,7] Server IP Address: 10.30.1.186 5/2/2012 8:50:07 PM [3328,7] Host: webmail.domainllp.com 5/2/2012 8:50:07 PM [3328,7] Primary SMTP Address: John.Doe@domainllp.com 5/2/2012 8:50:07 PM [3328,7] Explicit Logon: False 5/2/2012 8:50:07 PM [3328,7] Explicit Logon Address: owa 5/2/2012 8:50:07 PM [3328,7] EV Extensions DLL version: 10.0.0.0 5/2/2012 8:50:07 PM [3328,7] [RequestProcessor::StartImpersonation] Impersonating logged on user 5/2/2012 8:50:07 PM [3328,7] [EVContext::Initialise] EVContext intialised at 5/2/2012 8:50:06 PM 5/2/2012 8:50:07 PM [3328,7] [EVContext::Initialise] Hidden settings loaded at 5/2/2012 8:50:06 PM 5/2/2012 8:50:07 PM [3328,7] [EVContext::IsValidBrowser] Returning: True 5/2/2012 8:50:07 PM [3328,7] [RequestProcessor::PostProcessRequest] Checking for reply/forward to EV item 5/2/2012 8:50:07 PM [3328,7] [RequestProcessor:StopImpersonation] Stopped impersonation 5/2/2012 8:50:07 PM [3328,7] Request processing finished 5/2/2012 8:50:11 PM [3328,7] ############################################################# 5/2/2012 8:50:11 PM [3328,7] Request processing started 5/2/2012 8:50:11 PM [3328,7] Url: https://webmail.domainllp.com/owa/forms/premium/StartPage.aspx?EVAction=IsManagedFolder 5/2/2012 8:50:11 PM [3328,7] RawUrl: /owa/default.aspx?EVAction=IsManagedFolder 5/2/2012 8:50:11 PM [3328,7] Query String parameters: 5/2/2012 8:50:11 PM [3328,7] EVAction: IsManagedFolder 5/2/2012 8:50:11 PM [3328,7] Cookies 5/2/2012 8:50:11 PM [3328,7] sessionid: 19146937-c049-4660-af1c-9a3eaf85b8ba 5/2/2012 8:50:11 PM [3328,7] cadata: "1+RIzkMNKCMj0YTHLZ+zPx0G4wxOZIDDao92sgwXeX8pOZd0qDlms2Bfjnuw=" 5/2/2012 8:50:11 PM [3328,7] UserContext: 7f0874f9e0194872a8284b0ae1e34f97 5/2/2012 8:50:11 PM [3328,7] Form: 5/2/2012 8:50:11 PM [3328,7] OWA Session details 5/2/2012 8:50:11 PM [3328,7] User agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729) 5/2/2012 8:50:11 PM [3328,7] Authentication type: Basic 5/2/2012 8:50:11 PM [3328,7] Authenticated user: domain\JDoe 5/2/2012 8:50:11 PM [3328,7] Client IP Address: 10.30.51.61 5/2/2012 8:50:11 PM [3328,7] Server IP Address: 10.30.1.186 5/2/2012 8:50:11 PM [3328,7] Host: webmail.domainllp.com 5/2/2012 8:50:11 PM [3328,7] Primary SMTP Address: John.Doe@domainllp.com 5/2/2012 8:50:11 PM [3328,7] Explicit Logon: False 5/2/2012 8:50:11 PM [3328,7] Explicit Logon Address: owa 5/2/2012 8:50:11 PM [3328,7] EV Extensions DLL version: 10.0.0.0 5/2/2012 8:50:11 PM [3328,7] [RequestProcessor::StartImpersonation] Impersonating logged on user 5/2/2012 8:50:11 PM [3328,7] [EVContext::Initialise] EVContext intialised at 5/2/2012 8:50:06 PM 5/2/2012 8:50:11 PM [3328,7] [EVContext::Initialise] Hidden settings loaded at 5/2/2012 8:50:06 PM 5/2/2012 8:50:11 PM [3328,7] [EVContext::IsValidBrowser] Returning: True 5/2/2012 8:50:11 PM [3328,7] [RequestProcessor::ProcessEVAction] started 5/2/2012 8:50:11 PM [3328,7] [RequestProcessor::ProcessEVAction] IsManagedFolder action called: 5/2/2012 8:50:11 PM [3328,7] [Id::OwaId] Returning cached OwaId: LgAAAABRTmzA/4+SSJBbuMJgISS+AQCyE8yDia96SL0wLd43mpC4AJPdNr+TAAAB 5/2/2012 8:50:11 PM [3328,7] [RequestProcessor::ProcessEVAction] Folder Id: LgAAAABRTmzA/4+SSJBbuMJgISS+AQCyE8yDia96SL0wLd43mpC4AJPdNr+TAAAB 5/2/2012 8:50:11 PM [3328,7] [Id::EwsId] Converting OwaId to EwsId 5/2/2012 8:50:11 PM [3328,7] [MailboxBase::MailboxBase] Connecting to Exchange Web Services using: https://10.30.1.186/ews/exchange.asmx 5/2/2012 8:50:11 PM [3328,7] [ConvertId::DoConvertId] Converting ID using web services 5/2/2012 8:50:11 PM [3328,7] [Id::EwsId] Converted OwaId to Mailbox EwsId: AQMkAGQ1YmMwZTZkLTZiNjctNGVmYy05NmY3LTk3ODJmNzUwNGEyOQAuAAADUU5swP+PkkiQW7jCYCEkvgEAshPMg4mveki9MC3eN5qQuACT3Ta/kwAAAA== 5/2/2012 8:50:11 PM [3328,7] [MailboxBase::MailboxBase] Connecting to Exchange Web Services using: https://10.30.1.186/ews/exchange.asmx 5/2/2012 8:50:11 PM [3328,7] [MailboxFolder::LoadProperties] Folder name: Inbox 5/2/2012 8:50:11 PM [3328,7] [MailboxFolder::LoadProperties] Folder path: /Inbox 5/2/2012 8:50:11 PM [3328,7] [MailboxFolder::LoadProperties] Non-Deletable: False 5/2/2012 8:50:11 PM [3328,7] [MailboxFolder::IsManaged] {Inbox} Checking if managed folder 5/2/2012 8:50:11 PM [3328,7] [MailboxFolder::IsManaged] {Inbox} Not provisioned, checking parent folder... 5/2/2012 8:50:11 PM [3328,7] [MailboxBase::MailboxBase] Connecting to Exchange Web Services using: https://10.30.1.186/ews/exchange.asmx 5/2/2012 8:50:11 PM [3328,7] [MailboxFolder::LoadProperties] Folder name: Top of Information Store 5/2/2012 8:50:11 PM [3328,7] [MailboxFolder::LoadProperties] Folder path: / 5/2/2012 8:50:11 PM [3328,7] [MailboxFolder::LoadProperties] Non-Deletable: False 5/2/2012 8:50:11 PM [3328,7] [MailboxFolder::IsManaged] {Top of Information Store} Checking if managed folder 5/2/2012 8:50:11 PM [3328,7] [MailboxFolder::IsManaged] {Top of Information Store} Not provisioned, checking parent folder... 5/2/2012 8:50:11 PM [3328,7] [MailboxBase::MailboxBase] Connecting to Exchange Web Services using: https://10.30.1.186/ews/exchange.asmx 5/2/2012 8:50:11 PM [3328,7] [MailboxFolder::LoadProperties] Folder name: 5/2/2012 8:50:11 PM [3328,7] [MailboxFolder::LoadProperties] Folder path: /NON_IPM_SUBTREE 5/2/2012 8:50:11 PM [3328,7] [MailboxFolder::LoadProperties] Non-Deletable: False 5/2/2012 8:50:11 PM [3328,7] [MailboxFolder::IsManaged] {} Checking if managed folder 5/2/2012 8:50:11 PM [3328,7] [MailboxFolder::IsManaged] {} Returning: False 5/2/2012 8:50:11 PM [3328,7] [MailboxFolder::IsManaged] {Top of Information Store} Returning: False 5/2/2012 8:50:11 PM [3328,7] [MailboxFolder::IsManaged] {Inbox} Returning: False 5/2/2012 8:50:11 PM [3328,7] [RequestProcessor::ProcessEVAction] Finished handling EVAction, ending request processing 5/2/2012 8:50:11 PM [3328,7] [RequestProcessor:StopImpersonation] Stopped impersonation 5/2/2012 8:50:11 PM [3328,7] Request processing finished 5/2/2012 8:50:11 PM [3328,7] ############################################################# 5/2/2012 8:50:11 PM [3328,7] Request processing started 5/2/2012 8:50:11 PM [3328,7] Url: https://webmail.domainllp.com/owa/forms/premium/StartPage.aspx?EVAction=ArchiveSettings 5/2/2012 8:50:11 PM [3328,7] RawUrl: /owa/default.aspx?EVAction=ArchiveSettings 5/2/2012 8:50:11 PM [3328,7] Query String parameters: 5/2/2012 8:50:11 PM [3328,7] EVAction: ArchiveSettings 5/2/2012 8:50:11 PM [3328,7] Cookies 5/2/2012 8:50:11 PM [3328,7] sessionid: 19146937-c049-4660-af1c-9a3eaf85b8ba 5/2/2012 8:50:11 PM [3328,7] cadata: "1+RIzkMNKCMj0YTHLZ+zPx0G4wxOZIDDao92sgwXeX8pOZd0qDlms2Bfjnuw=" 5/2/2012 8:50:11 PM [3328,7] UserContext: 7f0874f9e0194872a8284b0ae1e34f97 5/2/2012 8:50:11 PM [3328,7] Form: 5/2/2012 8:50:11 PM [3328,7] OWA Session details 5/2/2012 8:50:11 PM [3328,7] User agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729) 5/2/2012 8:50:11 PM [3328,7] Authentication type: Basic 5/2/2012 8:50:11 PM [3328,7] Authenticated user: domain\JDoe 5/2/2012 8:50:11 PM [3328,7] Client IP Address: 10.30.51.61 5/2/2012 8:50:11 PM [3328,7] Server IP Address: 10.30.1.186 5/2/2012 8:50:11 PM [3328,7] Host: webmail.domainllp.com 5/2/2012 8:50:11 PM [3328,7] Primary SMTP Address: John.Doe@domainllp.com 5/2/2012 8:50:11 PM [3328,7] Explicit Logon: False 5/2/2012 8:50:11 PM [3328,7] Explicit Logon Address: owa 5/2/2012 8:50:11 PM [3328,7] EV Extensions DLL version: 10.0.0.0 5/2/2012 8:50:11 PM [3328,7] [RequestProcessor::StartImpersonation] Impersonating logged on user 5/2/2012 8:50:11 PM [3328,7] [EVContext::Initialise] EVContext intialised at 5/2/2012 8:50:06 PM 5/2/2012 8:50:11 PM [3328,7] [EVContext::Initialise] Hidden settings loaded at 5/2/2012 8:50:06 PM 5/2/2012 8:50:11 PM [3328,7] [EVContext::IsValidBrowser] Returning: True 5/2/2012 8:50:11 PM [3328,7] [RequestProcessor::ProcessEVAction] started 5/2/2012 8:50:11 PM [3328,7] [RequestProcessor::ProcessEVAction] ArchiveSettings action called: 5/2/2012 8:50:11 PM [3328,7] [Id::OwaId] Returning cached OwaId: LgAAAABRTmzA/4+SSJBbuMJgISS+AQCyE8yDia96SL0wLd43mpC4AJPdNr+TAAAB 5/2/2012 8:50:11 PM [3328,7] [RequestProcessor::ProcessEVAction] Folder Id: LgAAAABRTmzA/4+SSJBbuMJgISS+AQCyE8yDia96SL0wLd43mpC4AJPdNr+TAAAB 5/2/2012 8:50:11 PM [3328,7] [Id::OwaId] Returning cached OwaId: LgAAAABRTmzA/4+SSJBbuMJgISS+AQCyE8yDia96SL0wLd43mpC4AJPdNr+TAAAB 5/2/2012 8:50:11 PM [3328,7] [RequestProcessor::ProcessEVAction] Settings not found in cache 5/2/2012 8:50:11 PM [3328,7] [Id::EwsId] Converting OwaId to EwsId 5/2/2012 8:50:11 PM [3328,7] [MailboxBase::MailboxBase] Connecting to Exchange Web Services using: https://10.30.1.186/ews/exchange.asmx 5/2/2012 8:50:11 PM [3328,7] [ConvertId::DoConvertId] Converting ID using web services 5/2/2012 8:50:11 PM [3328,7] [Id::EwsId] Converted OwaId to Mailbox EwsId: AQMkAGQ1YmMwZTZkLTZiNjctNGVmYy05NmY3LTk3ODJmNzUwNGEyOQAuAAADUU5swP+PkkiQW7jCYCEkvgEAshPMg4mveki9MC3eN5qQuACT3Ta/kwAAAA== 5/2/2012 8:50:11 PM [3328,7] [MailboxBase::MailboxBase] Connecting to Exchange Web Services using: https://10.30.1.186/ews/exchange.asmx 5/2/2012 8:50:11 PM [3328,7] [MailboxFolder::LoadProperties] Folder name: Inbox 5/2/2012 8:50:11 PM [3328,7] [MailboxFolder::LoadProperties] Folder path: /Inbox 5/2/2012 8:50:11 PM [3328,7] [MailboxFolder::LoadProperties] Non-Deletable: False 5/2/2012 8:50:11 PM [3328,7] [EVServerRequest::CreateRequest] Sending request to: http://evcl.domain.com/EVAnon/getarchivesettings.asp?dn=%2fo%3ddomain%2fou%3dExchange+Administrative+Group+(FYDIBOHF23SPDLT)%2fcn%3dRecipients%2fcn%3dJDoe&sid=110908EDFE008FF45A045495614D10A991d10000evcl 5/2/2012 8:50:11 PM [3328,7] [EVServerRequest::CreateRequest] Request timeout (milliseconds): 30000 5/2/2012 8:50:11 PM [3328,7] [EVServerRequest::AddHeader] Set header: EV-OWA-2007-Extensions-Version=10.0.0.0 5/2/2012 8:50:11 PM [3328,7] [EVServerRequest::CreateRequest] Making request for user: domain\JDoe 5/2/2012 8:50:11 PM [3328,7] [EVServerRequest::AddHeader] Set header: X-EVOWA-User-Encoded=4D004B004C004C0050005C0069006B006F0065006E0069006700 5/2/2012 8:50:11 PM [3328,7] [ArchiveSettingsRequest::Send] Exception sending request for archive settings: System.Net.WebException: The remote server returned an error: (403) Forbidden. at System.Net.HttpWebRequest.GetResponse() at Symantec.EnterpriseVault.Owa.EVServerRequests.ArchiveSettingsRequest.Send() 5/2/2012 8:50:11 PM [3328,7] [FolderArchiveSettings::GetFolderSettings] No default settings available 5/2/2012 8:50:11 PM [3328,7] [Id::OwaId] Returning cached OwaId: LgAAAABRTmzA/4+SSJBbuMJgISS+AQCyE8yDia96SL0wLd43mpC4AJPdNr+TAAAB 5/2/2012 8:50:11 PM [3328,7] [RequestProcessor::ProcessEVAction] Added settings to cache: 5/2/2012 8:50:11 PM [3328,7] [RequestProcessor::ProcessEVAction] 5/2/2012 8:50:11 PM [3328,7] [RequestProcessor::ProcessEVAction] Finished handling EVAction, ending request processing 5/2/2012 8:50:11 PM [3328,7] [RequestProcessor:StopImpersonation] Stopped impersonation 5/2/2012 8:50:11 PM [3328,7] Request processing finished