EV 11.0.1 Search - Session Expired Problem

[O_Schmidt]

Hi @all,

we´ve updated our test environment to 11.0.1. 

Now we have a big problem.

When you open the search page in outlook or browser we´ve got the message: "Session Expired"

Symantec has published a techarticle http://www.symantec.com/business/support/index?page=content&id=TECH227564, but the article no longer exists.

There is a workaround described on this article, but we cannot use this workaround because of our security configuration for IE Cookies.

Is there a fix planned for the future?

Where is the techarticle TECH227564?

[GertjanA · Accepted solution]

Technote: http://www.symantec.com/docs/TECH227564

[it-info1220]

I did log a case with the result that the issue was unknown and "the IIS guy is out of office until next week".

The hint with the Internet Explorer 1A10 registry for restricted sites was the solution. We had an old user group policy which was created with IE9 and now those settings are invisible if you have IE10 or greater. Manually editing the corresponding GPO-file (InternetSettings.xml) did the trick.

Anyway, thanks for the help...!

[eggbert]

I have had a call open with Symantec since beginning of March regarding this issue. 

The orginal article was pulled, as I pointed out that it was incorrect technically, and insecure.

Setting the relevant zone 1A10 to a value of 3 actually sets it to block cookies, and not allow them.  Without cookies you get the error experienced.

The value of 1A10 actually needs to be '0' to allow ALL cookies.

From Microsofts site:-

Privacy Settings (1A10) is used by the Privacy tab slider. The DWORD values are as follows:

Block All Cookies: 00000003
High: 00000001
Medium High: 00000001
Medium: 00000001
Low: 00000001
Accept all Cookies: 00000000

The issue I had was that it would only work if Zone 4 1A10 was set to 0. This means allowing all cookies from the restricted zone, which is insecure if you have other sites which are meant to be restricted....

Unfortunately for us, when setting zone 4 1A10 to 3 as the article now states, we would still get the issue.  Configuring UseRestrictedSecurity to 0 has allowed this to work.

As a side note, whilst the UseRestrictedSecurity is set to its default of 1, IE would place the site in the 'unknown "mixed zone" '.  This shows that even though the address was set as an intranet zone via GPO, it was being flagged in the restricted zone at the same time, hence why zone 4 needed to allow cookies to allow it to work.  With UseRestrictedSecurity set to 0, IE now correctly displays the site in the Intranet Zone, and thus uses the 1A10 setting from zone 1, which is allow all cookies.... thus the site works as it should, without having to allow cookies in the restricted zone.

[eggbert]

As per my post above, I thought Id place at the end also to make chronological sense....

:)

I have had a call open with Symantec since beginning of March regarding this issue. 

The orginal article was pulled, as I pointed out that it was incorrect technically, and insecure.

Setting the relevant zone 1A10 to a value of 3 actually sets it to block cookies, and not allow them.  Without cookies you get the error experienced.

The value of 1A10 actually needs to be '0' to allow ALL cookies.

From Microsofts site:-

Privacy Settings (1A10) is used by the Privacy tab slider. The DWORD values are as follows:

Block All Cookies: 00000003
High: 00000001
Medium High: 00000001
Medium: 00000001
Low: 00000001
Accept all Cookies: 00000000

The issue I had was that it would only work if Zone 4 1A10 was set to 0. This means allowing all cookies from the restricted zone, which is insecure if you have other sites which are meant to be restricted....

Unfortunately for us, when setting zone 4 1A10 to 3 as the article now states, we would still get the issue.  Configuring UseRestrictedSecurity to 0 has allowed this to work.

As a side note, whilst the UseRestrictedSecurity is set to its default of 1, IE would place the site in the 'unknown "mixed zone" '.  This shows that even though the address was set as an intranet zone via GPO, it was being flagged in the restricted zone at the same time, hence why zone 4 needed to allow cookies to allow it to work.  With UseRestrictedSecurity set to 0, IE now correctly displays the site in the Intranet Zone, and thus uses the 1A10 setting from zone 1, which is allow all cookies.... thus the site works as it should, without having to allow cookies in the restricted zone.

[O_Schmidt]

Now, i´ve got an answer from symantec support.

The support referred to the updated TECH article (http://www.symantec.com/docs/TECH227564)

This works for me.