User unable to open archived item in Outlook ?

[John_Santana]

Hi All,

My users in the whole company suddenly reported to me that they cannot open the archived email in their Outlook 2007 using the EV 8.0 SP4 ?

here's what they've got:

---------------------------

Enterprise Vault

---------------------------

The web server responded with error 403.

Forbidden  

---------------------------

OK   

---------------------------

can anyone please let me know what to do ?

I have asked the user to close the Outlook and then rebooted the EV server

then ask the user to re-open Outlook

But the problem still exist ?

[JesusWept3]

On the Enterprise Vaul Server, it looks like the Default Website has a domain and ip restriction set
Check it to see if its set to deny people access who aren't on that list

[JesusWept3]

It also could be that something like ASP has been set to not run in IIS

can you open up an IIS log on your EV server and do a search for 403 and paste on of the lines here? along with the very very top line of the IIS log that has the headers?

Once you have that line, you will have a substatus code for the 403, you can find the definitions here

http://technet.microsoft.com/en-us/library/cc737788(v=ws.10).aspx

"Typically, 403 errors occur when an operation or request is disallowed because a requirement other than proper authentication credentials is not met. Commonly, this error occurs when a script request is made to a Web directory for which script access is not enabled. In such a case, first verify for which resource the request is being made. If the request is, indeed, for script code, such as ASP or ASP.NET, check the execute permissions for that directory in IIS Manager and ensure that at least Script is selected."

If its 403.6 or 403.8 then its because the IP address or domain name has been blacklisted OR isn't white listed

If its 401.1, 401.2 or 401.3 then its NTFS permissions on the EV install directory

 

[John_Santana]

Well, I'm the domain administrator, but how come this affecting consistently across the whole company ?

[John_Santana]

Jesus, as can be seen from the following screenshot, it is not applicable:

[JesusWept3]

it doesn't matter if you're the domain admin or not
if you have a white list saying only accept requests from 192.168.100.10 and you're accessing from 192.168.100.11, it doesnt matter whether you are domain admin, backup admin etc your IP addresses don't match and therefor you won't be able to access

If something like the ASP ISAPI filter has become Disabled or not allowed to execute then IIS simply won't run any ASP pages at all, and if NET gets disabled then same for .aspx files

[JesusWept3]

expand out Web Service Extensions, make sure Active Server Pages is set to enabled

[John_Santana]

Yes they are all enabled already.. ?

[JesusWept3 · Accepted solution]

Actually i just looked at your first picture
its set to deny access to everyone based on the ip address

[John_Santana]

Yes, I have changed that into Granted Access, but so far it doesn't work ?

[JesusWept3]

find the 403 sub status from the IIS logs
also make sure that you put Granted access on \EnterpriseVault and not juse Default Web Site etc

[Rob_Wilcox1]

I've seen this a ton of times, basically .. compare your production permissions, allows/denies and so on, with a lab setup.  There will be a deny set somewhere.

If you don't have a lab ... well, you should :)  But if you really don't then, check through the ones you think of, and list them all in a post.

[JesusWept3]

Well if you get the IIS logs it will be easy to determine when see the substatus

[John_Santana]

I am wondering if this type of issue should be fixed by rebooting the EV server, but somehow it doesn't ?

[JesusWept3]

no, its an IIS config issue, what is the 403 substatus?

[AndrewB]

hi john, as JW said, we'll be able to get a much better idea of the cause if you post the logs that have been requested.