rares_dumitrescu
asked on
OWA 2000 can not be reachable via IE sometimes.
Some of the users can not access OWA 2000 via IE 6.0 and IE 7.0. Same users can access via Firefox without problems. The issue occurs not all the time but sometimes. When the user tries to connect to Exchange Server via Internet Explorer(6,0 or 7.0) OWA with necesarry credentialdomain\username) it is accepted after entering it 3 or 4 times. Then when the user clicks some folders in mailbox the password is being asked again and then the session is being closed(authentication fails)
The issue is same(owa does not work) until i logon to OWA with a user account which does not have any problem. If i logon to OWA with that user name and logoff and try to relogon with the user which have problems it works. After approx. 1 hour it stops to work again.
To make it more clear let me explain this way
User A: No problem with OWA at all. Works with IE 6.0, IE 7.0, Firefox.
User B: Has problems with OWA only with IE 6.0, IE 7.0. Firefox works without problems.
User A tries to logon to OWA, it doesn't work. Then User B tries to logon to OWA, works and loggs off. User A tries again to OWA, it works. It works like that around 1 hour and then again problem occurs.
Issue happens on any workstation. The users are the members of same groups in domain. Hotfix KB911829 is installed on exchange server.
The issue is same(owa does not work) until i logon to OWA with a user account which does not have any problem. If i logon to OWA with that user name and logoff and try to relogon with the user which have problems it works. After approx. 1 hour it stops to work again.
To make it more clear let me explain this way
User A: No problem with OWA at all. Works with IE 6.0, IE 7.0, Firefox.
User B: Has problems with OWA only with IE 6.0, IE 7.0. Firefox works without problems.
User A tries to logon to OWA, it doesn't work. Then User B tries to logon to OWA, works and loggs off. User A tries again to OWA, it works. It works like that around 1 hour and then again problem occurs.
Issue happens on any workstation. The users are the members of same groups in domain. Hotfix KB911829 is installed on exchange server.
It would help to see the IIS log entries that are generated by the unsuccessful login.
Hi,
change the IUSR_SERVERNAME locally on the server to something like 'anonymous' and then set the one in IIS to the same thing. In other words, sync them up. This should fix your issue.
HTH
change the IUSR_SERVERNAME locally on the server to something like 'anonymous' and then set the one in IIS to the same thing. In other words, sync them up. This should fix your issue.
HTH
ASKER
the iusr_servername was sycnhorized. did not help.
How do you know it was syncronized???
Sorry, what I meant to ask is, when you went into allow anonymous users was it checked and what account was it using (local or from Active directory built in)?
Thanks
Thanks
ASKER
Here are the logs.
the user logs on via firefox which is succesfull
#Software: Microsoft Internet Information Services 5.0
#Version: 1.0
#Date: 2009-03-05 12:00:19
#Fields: date time c-ip cs-username s-ip s-port cs-method cs-uri-stem cs-uri-query sc-status sc-bytes cs-bytes cs(User-Agent)
2009-03-05 12:00:19 192.168.1.1 - 192.168.1.2 443 GET /exchange/ - 401 1107 787 Mozilla/5.0+(Windows;+U;+W indows+NT+ 5.1;+en-US ;+rv:1.9.0 .6)+Gecko/ 2009011913 +Firefox/3 .0.6
2009-03-05 12:00:33 192.168.1.1 xxxxx@xxxxxx 192.168.1.2 443 GET /exchange/ - 200 1424 438 Mozilla/5.0+(Windows;+U;+W indows+NT+ 5.1;+en-US ;+rv:1.9.0 .6)+Gecko/ 2009011913 +Firefox/3 .0.6
2009-03-05 12:00:33 192.168.1.1 xxxxx@xxxxxx 192.168.1.2 443 GET /exchange/user.domain/ Cmd=navbar 200 3428 574 Mozilla/5.0+(Windows;+U;+W indows+NT+ 5.1;+en-US ;+rv:1.9.0 .6)+Gecko/ 2009011913 +Firefox/3 .0.6
2009-03-05 12:00:33 192.168.1.1 xxxxx@xxxxxx 192.168.1.2 443 GET /exchange/user.domain/Post eingang/ Cmd=contents 200 15693 588 Mozilla/5.0+(Windows;+U;+W indows+NT+ 5.1;+en-US ;+rv:1.9.0 .6)+Gecko/ 2009011913 +Firefox/3 .0.6
2009-03-05 12:00:33 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/logo-small.gi f - 200 1299 444 Mozilla/5.0+(Windows;+U;+W indows+NT+ 5.1;+en-US ;+rv:1.9.0 .6)+Gecko/ 2009011913 +Firefox/3 .0.6
2009-03-05 12:00:33 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/navbar-inbox. gif - 200 583 446 Mozilla/5.0+(Windows;+U;+W indows+NT+ 5.1;+en-US ;+rv:1.9.0 .6)+Gecko/ 2009011913 +Firefox/3 .0.6
2009-03-05 12:00:33 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/navbar-calend ar.gif - 200 757 449 Mozilla/5.0+(Windows;+U;+W indows+NT+ 5.1;+en-US ;+rv:1.9.0 .6)+Gecko/ 2009011913 +Firefox/3 .0.6
2009-03-05 12:00:33 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/navbar-public .gif - 200 700 447 Mozilla/5.0+(Windows;+U;+W indows+NT+ 5.1;+en-US ;+rv:1.9.0 .6)+Gecko/ 2009011913 +Firefox/3 .0.6
2009-03-05 12:00:33 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/navbar-contac ts.gif - 200 737 449 Mozilla/5.0+(Windows;+U;+W indows+NT+ 5.1;+en-US ;+rv:1.9.0 .6)+Gecko/ 2009011913 +Firefox/3 .0.6
2009-03-05 12:00:33 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/navbar-option s.gif - 200 550 448 Mozilla/5.0+(Windows;+U;+W indows+NT+ 5.1;+en-US ;+rv:1.9.0 .6)+Gecko/ 2009011913 +Firefox/3 .0.6
2009-03-05 12:00:33 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/navbar-logoff .gif - 200 579 447 Mozilla/5.0+(Windows;+U;+W indows+NT+ 5.1;+en-US ;+rv:1.9.0 .6)+Gecko/ 2009011913 +Firefox/3 .0.6
2009-03-05 12:00:33 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/tool-div.gif - 200 343 456 Mozilla/5.0+(Windows;+U;+W indows+NT+ 5.1;+en-US ;+rv:1.9.0 .6)+Gecko/ 2009011913 +Firefox/3 .0.6
2009-03-05 12:00:33 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/tool-upone.gi f - 200 403 458 Mozilla/5.0+(Windows;+U;+W indows+NT+ 5.1;+en-US ;+rv:1.9.0 .6)+Gecko/ 2009011913 +Firefox/3 .0.6
2009-03-05 12:00:33 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/tool-newmail. gif - 200 433 460 Mozilla/5.0+(Windows;+U;+W indows+NT+ 5.1;+en-US ;+rv:1.9.0 .6)+Gecko/ 2009011913 +Firefox/3 .0.6
2009-03-05 12:00:33 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/tool-refresh. gif - 200 439 460 Mozilla/5.0+(Windows;+U;+W indows+NT+ 5.1;+en-US ;+rv:1.9.0 .6)+Gecko/ 2009011913 +Firefox/3 .0.6
2009-03-05 12:00:33 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/tool-empty.gi f - 200 466 458 Mozilla/5.0+(Windows;+U;+W indows+NT+ 5.1;+en-US ;+rv:1.9.0 .6)+Gecko/ 2009011913 +Firefox/3 .0.6
2009-03-05 12:00:34 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/tool-publicfo lders.gif - 200 441 466 Mozilla/5.0+(Windows;+U;+W indows+NT+ 5.1;+en-US ;+rv:1.9.0 .6)+Gecko/ 2009011913 +Firefox/3 .0.6
2009-03-05 12:00:34 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/tool-addressb ook.gif - 200 423 464 Mozilla/5.0+(Windows;+U;+W indows+NT+ 5.1;+en-US ;+rv:1.9.0 .6)+Gecko/ 2009011913 +Firefox/3 .0.6
2009-03-05 12:00:34 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/view-hidefold ers.gif - 200 381 464 Mozilla/5.0+(Windows;+U;+W indows+NT+ 5.1;+en-US ;+rv:1.9.0 .6)+Gecko/ 2009011913 +Firefox/3 .0.6
2009-03-05 12:00:34 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/view-mark.gif - 200 378 457 Mozilla/5.0+(Windows;+U;+W indows+NT+ 5.1;+en-US ;+rv:1.9.0 .6)+Gecko/ 2009011913 +Firefox/3 .0.6
2009-03-05 12:00:34 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/view-importan ce.gif - 200 353 463 Mozilla/5.0+(Windows;+U;+W indows+NT+ 5.1;+en-US ;+rv:1.9.0 .6)+Gecko/ 2009011913 +Firefox/3 .0.6
2009-03-05 12:00:34 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/view-document .gif - 200 360 461 Mozilla/5.0+(Windows;+U;+W indows+NT+ 5.1;+en-US ;+rv:1.9.0 .6)+Gecko/ 2009011913 +Firefox/3 .0.6
2009-03-05 12:00:34 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/view-flag.gif - 200 357 457 Mozilla/5.0+(Windows;+U;+W indows+NT+ 5.1;+en-US ;+rv:1.9.0 .6)+Gecko/ 2009011913 +Firefox/3 .0.6
2009-03-05 12:00:34 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/view-papercli p.gif - 200 359 462 Mozilla/5.0+(Windows;+U;+W indows+NT+ 5.1;+en-US ;+rv:1.9.0 .6)+Gecko/ 2009011913 +Firefox/3 .0.6
2009-03-05 12:00:34 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/view-sortdown .gif - 200 360 461 Mozilla/5.0+(Windows;+U;+W indows+NT+ 5.1;+en-US ;+rv:1.9.0 .6)+Gecko/ 2009011913 +Firefox/3 .0.6
2009-03-05 12:00:34 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/icon-msg-unre ad.gif - 200 423 463 Mozilla/5.0+(Windows;+U;+W indows+NT+ 5.1;+en-US ;+rv:1.9.0 .6)+Gecko/ 2009011913 +Firefox/3 .0.6
2009-03-05 12:00:34 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/icon-papercli p.gif - 200 377 462 Mozilla/5.0+(Windows;+U;+W indows+NT+ 5.1;+en-US ;+rv:1.9.0 .6)+Gecko/ 2009011913 +Firefox/3 .0.6
2009-03-05 12:00:34 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/tool-move.gif - 200 432 457 Mozilla/5.0+(Windows;+U;+W indows+NT+ 5.1;+en-US ;+rv:1.9.0 .6)+Gecko/ 2009011913 +Firefox/3 .0.6
2009-03-05 12:00:34 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/tool-copy.gif - 200 447 457 Mozilla/5.0+(Windows;+U;+W indows+NT+ 5.1;+en-US ;+rv:1.9.0 .6)+Gecko/ 2009011913 +Firefox/3 .0.6
2009-03-05 12:00:34 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/tool-rename.g if - 200 397 459 Mozilla/5.0+(Windows;+U;+W indows+NT+ 5.1;+en-US ;+rv:1.9.0 .6)+Gecko/ 2009011913 +Firefox/3 .0.6
2009-03-05 12:00:34 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/tool-delete.g if - 200 384 459 Mozilla/5.0+(Windows;+U;+W indows+NT+ 5.1;+en-US ;+rv:1.9.0 .6)+Gecko/ 2009011913 +Firefox/3 .0.6
2009-03-05 12:00:34 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/view-nextpage .gif - 200 375 461 Mozilla/5.0+(Windows;+U;+W indows+NT+ 5.1;+en-US ;+rv:1.9.0 .6)+Gecko/ 2009011913 +Firefox/3 .0.6
2009-03-05 12:00:34 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/view-prevpage .gif - 200 378 461 Mozilla/5.0+(Windows;+U;+W indows+NT+ 5.1;+en-US ;+rv:1.9.0 .6)+Gecko/ 2009011913 +Firefox/3 .0.6
2009-03-05 12:00:35 192.168.1.1 - 192.168.1.2 443 GET /favicon.ico - 404 4203 355 Mozilla/5.0+(Windows;+U;+W indows+NT+ 5.1;+en-US ;+rv:1.9.0 .6)+Gecko/ 2009011913 +Firefox/3 .0.6
2009-03-05 12:00:36 192.168.1.1 - 192.168.1.2 443 GET /favicon.ico - 404 4203 385 Mozilla/5.0+(Windows;+U;+W indows+NT+ 5.1;+en-US ;+rv:1.9.0 .6)+Gecko/ 2009011913 +Firefox/3 .0.6
2009-03-05 12:00:42 192.168.1.1 xxxxx@xxxxxx 192.168.1.2 443 POLL /exchange/user.domain/Kale nder - 207 621 591 Mozilla/4.0+(compatible;+M SIE+7.0;+W indows+NT+ 5.1;+.NET+ CLR+1.1.43 22;+.NET+C LR+2.0.507 27;+.NET+C LR+3.0.045 06.30;+.NE T+CLR+3.0. 04506.648)
2009-03-05 12:00:42 192.168.1.1 xxxxx@xxxxxx 192.168.1.2 443 POLL /exchange/user.domain/Post eingang - 207 624 594 Mozilla/4.0+(compatible;+M SIE+7.0;+W indows+NT+ 5.1;+.NET+ CLR+1.1.43 22;+.NET+C LR+2.0.507 27;+.NET+C LR+3.0.045 06.30;+.NE T+CLR+3.0. 04506.648)
2009-03-05 12:00:47 192.168.1.1 xxxxx@xxxxxx 192.168.1.2 443 POLL /exchange/user.domain/Post eingang - 207 624 594 Mozilla/4.0+(compatible;+M SIE+7.0;+W indows+NT+ 5.1;+.NET+ CLR+1.1.43 22;+.NET+C LR+2.0.507 27;+.NET+C LR+3.0.045 06.30;+.NE T+CLR+3.0. 04506.648)
2009-03-05 12:01:18 192.168.1.1 xxxxx@xxxxxx 192.168.1.2 443 GET /exchange/user.domain/ Cmd=logoff 302 257 601 Mozilla/5.0+(Windows;+U;+W indows+NT+ 5.1;+en-US ;+rv:1.9.0 .6)+Gecko/ 2009011913 +Firefox/3 .0.6
2009-03-05 12:01:18 192.168.1.1 - 192.168.1.2 443 GET /exchweb/bin/USA/logoff.as p - 500 490 474 Mozilla/5.0+(Windows;+U;+W indows+NT+ 5.1;+en-US ;+rv:1.9.0 .6)+Gecko/ 2009011913 +Firefox/3 .0.6
and the same user tries with ie 7.0(6.0) which fails
2009-03-05 12:02:31 192.168.1.1 - 192.168.1.2 443 GET /exchange/ - 401 1107 1175 Mozilla/4.0+(compatible;+M SIE+7.0;+W indows+NT+ 5.1;+.NET+ CLR+1.1.43 22;+.NET+C LR+2.0.507 27;+.NET+C LR+3.0.045 06.30;+.NE T+CLR+3.0. 04506.648)
2009-03-05 12:02:42 192.168.1.1 xxxxx@xxxxxx 192.168.1.2 443 POLL /exchange/user.domain/Post eingang - 207 624 594 Mozilla/4.0+(compatible;+M SIE+7.0;+W indows+NT+ 5.1;+.NET+ CLR+1.1.43 22;+.NET+C LR+2.0.507 27;+.NET+C LR+3.0.045 06.30;+.NE T+CLR+3.0. 04506.648)
2009-03-05 12:02:45 192.168.1.1 xxxxx@xxxxxx 192.168.1.2 443 GET /exchange/ - 200 1411 632 Mozilla/4.0+(compatible;+M SIE+7.0;+W indows+NT+ 5.1;+.NET+ CLR+1.1.43 22;+.NET+C LR+2.0.507 27;+.NET+C LR+3.0.045 06.30;+.NE T+CLR+3.0. 04506.648)
2009-03-05 12:02:45 192.168.1.1 xxxxx@xxxxxx 192.168.1.2 443 GET /exchange/user.domain/ Cmd=navbar 200 9449 768 Mozilla/4.0+(compatible;+M SIE+7.0;+W indows+NT+ 5.1;+.NET+ CLR+1.1.43 22;+.NET+C LR+2.0.507 27;+.NET+C LR+3.0.045 06.30;+.NE T+CLR+3.0. 04506.648)
2009-03-05 12:02:45 192.168.1.1 xxxxx@xxxxxx 192.168.1.2 443 GET /exchange/user.domain/Post eingang/ Cmd=contents 200 18359 782 Mozilla/4.0+(compatible;+M SIE+7.0;+W indows+NT+ 5.1;+.NET+ CLR+1.1.43 22;+.NET+C LR+2.0.507 27;+.NET+C LR+3.0.045 06.30;+.NE T+CLR+3.0. 04506.648)
2009-03-05 12:02:45 192.168.1.1 xxxxx@xxxxxx 192.168.1.2 443 SUBSCRIBE /exchange/user.domain/Kale nder - 200 354 625 Mozilla/4.0+(compatible;+M SIE+7.0;+W indows+NT+ 5.1;+.NET+ CLR+1.1.43 22;+.NET+C LR+2.0.507 27;+.NET+C LR+3.0.045 06.30;+.NE T+CLR+3.0. 04506.648)
2009-03-05 12:02:45 192.168.1.1 xxxxx@xxxxxx 192.168.1.2 443 SUBSCRIBE /exchange/user.domain/Post eingang - 200 405 676 Mozilla/4.0+(compatible;+M SIE+7.0;+W indows+NT+ 5.1;+.NET+ CLR+1.1.43 22;+.NET+C LR+2.0.507 27;+.NET+C LR+3.0.045 06.30;+.NE T+CLR+3.0. 04506.648)
2009-03-05 12:02:45 192.168.1.1 xxxxx@xxxxxx 192.168.1.2 443 SEARCH /exchange/user.domain/Kale nder - 401 432 1530 Mozilla/4.0+(compatible;+M SIE+7.0;+W indows+NT+ 5.1;+.NET+ CLR+1.1.43 22;+.NET+C LR+2.0.507 27;+.NET+C LR+3.0.045 06.30;+.NE T+CLR+3.0. 04506.648)
2009-03-05 12:02:45 192.168.1.1 xxxxx@xxxxxx 192.168.1.2 443 SEARCH /exchange/user.domain/Post eingang/ - 401 432 1527 Mozilla/4.0+(compatible;+M SIE+7.0;+W indows+NT+ 5.1;+.NET+ CLR+1.1.43 22;+.NET+C LR+2.0.507 27;+.NET+C LR+3.0.045 06.30;+.NE T+CLR+3.0. 04506.648)
2009-03-05 12:02:47 192.168.1.1 xxxxx@xxxxxx 192.168.1.2 443 POLL /exchange/user.domain/Post eingang - 207 624 594 Mozilla/4.0+(compatible;+M SIE+7.0;+W indows+NT+ 5.1;+.NET+ CLR+1.1.43 22;+.NET+C LR+2.0.507 27;+.NET+C LR+3.0.045 06.30;+.NE T+CLR+3.0. 04506.648)
2009-03-05 12:02:55 192.168.1.1 - 192.168.1.2 443 SEARCH /exchange/user.domain/Post eingang/ - 401 356 660 Mozilla/4.0+(compatible;+M SIE+7.0;+W indows+NT+ 5.1;+.NET+ CLR+1.1.43 22;+.NET+C LR+2.0.507 27;+.NET+C LR+3.0.045 06.30;+.NE T+CLR+3.0. 04506.648)
2009-03-05 12:02:55 192.168.1.1 - 192.168.1.2 443 SEARCH /exchange/user.domain/Kale nder - 401 356 642 Mozilla/4.0+(compatible;+M SIE+7.0;+W indows+NT+ 5.1;+.NET+ CLR+1.1.43 22;+.NET+C LR+2.0.507 27;+.NET+C LR+3.0.045 06.30;+.NE T+CLR+3.0. 04506.648)
2009-03-05 12:04:42 192.168.1.1 xxxxx@xxxxxx 192.168.1.2 443 POLL /exchange/user.domain/Post eingang - 207 624 594 Mozilla/4.0+(compatible;+M SIE+7.0;+W indows+NT+ 5.1;+.NET+ CLR+1.1.43 22;+.NET+C LR+2.0.507 27;+.NET+C LR+3.0.045 06.30;+.NE T+CLR+3.0. 04506.648)
2009-03-05 12:04:47 192.168.1.1 xxxxx@xxxxxx 192.168.1.2 443 POLL /exchange/user.domain/Post eingang - 207 624 594 Mozilla/4.0+(compatible;+M SIE+7.0;+W indows+NT+ 5.1;+.NET+ CLR+1.1.43 22;+.NET+C LR+2.0.507 27;+.NET+C LR+3.0.045 06.30;+.NE T+CLR+3.0. 04506.648)
2009-03-05 12:06:42 192.168.1.1 xxxxx@xxxxxx 192.168.1.2 443 POLL /exchange/user.domain/Post eingang - 207 624 594 Mozilla/4.0+(compatible;+M SIE+7.0;+W indows+NT+ 5.1;+.NET+ CLR+1.1.43 22;+.NET+C LR+2.0.507 27;+.NET+C LR+3.0.045 06.30;+.NE T+CLR+3.0. 04506.648)
2009-03-05 12:06:47 192.168.1.1 xxxxx@xxxxxx 192.168.1.2 443 POLL /exchange/user.domain/Post eingang - 207 624 594 Mozilla/4.0+(compatible;+M SIE+7.0;+W indows+NT+ 5.1;+.NET+ CLR+1.1.43 22;+.NET+C LR+2.0.507 27;+.NET+C LR+3.0.045 06.30;+.NE T+CLR+3.0. 04506.648)
2009-03-05 12:08:42 192.168.1.1 xxxxx@xxxxxx 192.168.1.2 443 POLL /exchange/user.domain/Post eingang - 207 624 594 Mozilla/4.0+(compatible;+M SIE+7.0;+W indows+NT+ 5.1;+.NET+ CLR+1.1.43 22;+.NET+C LR+2.0.507 27;+.NET+C LR+3.0.045 06.30;+.NE T+CLR+3.0. 04506.648)
2009-03-05 12:08:47 192.168.1.1 xxxxx@xxxxxx 192.168.1.2 443 POLL /exchange/user.domain/Post eingang - 207 624 594 Mozilla/4.0+(compatible;+M SIE+7.0;+W indows+NT+ 5.1;+.NET+ CLR+1.1.43 22;+.NET+C LR+2.0.507 27;+.NET+C LR+3.0.045 06.30;+.NE T+CLR+3.0. 04506.648)
the user logs on via firefox which is succesfull
#Software: Microsoft Internet Information Services 5.0
#Version: 1.0
#Date: 2009-03-05 12:00:19
#Fields: date time c-ip cs-username s-ip s-port cs-method cs-uri-stem cs-uri-query sc-status sc-bytes cs-bytes cs(User-Agent)
2009-03-05 12:00:19 192.168.1.1 - 192.168.1.2 443 GET /exchange/ - 401 1107 787 Mozilla/5.0+(Windows;+U;+W
2009-03-05 12:00:33 192.168.1.1 xxxxx@xxxxxx 192.168.1.2 443 GET /exchange/ - 200 1424 438 Mozilla/5.0+(Windows;+U;+W
2009-03-05 12:00:33 192.168.1.1 xxxxx@xxxxxx 192.168.1.2 443 GET /exchange/user.domain/ Cmd=navbar 200 3428 574 Mozilla/5.0+(Windows;+U;+W
2009-03-05 12:00:33 192.168.1.1 xxxxx@xxxxxx 192.168.1.2 443 GET /exchange/user.domain/Post
2009-03-05 12:00:33 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/logo-small.gi
2009-03-05 12:00:33 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/navbar-inbox.
2009-03-05 12:00:33 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/navbar-calend
2009-03-05 12:00:33 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/navbar-public
2009-03-05 12:00:33 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/navbar-contac
2009-03-05 12:00:33 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/navbar-option
2009-03-05 12:00:33 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/navbar-logoff
2009-03-05 12:00:33 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/tool-div.gif - 200 343 456 Mozilla/5.0+(Windows;+U;+W
2009-03-05 12:00:33 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/tool-upone.gi
2009-03-05 12:00:33 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/tool-newmail.
2009-03-05 12:00:33 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/tool-refresh.
2009-03-05 12:00:33 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/tool-empty.gi
2009-03-05 12:00:34 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/tool-publicfo
2009-03-05 12:00:34 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/tool-addressb
2009-03-05 12:00:34 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/view-hidefold
2009-03-05 12:00:34 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/view-mark.gif
2009-03-05 12:00:34 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/view-importan
2009-03-05 12:00:34 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/view-document
2009-03-05 12:00:34 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/view-flag.gif
2009-03-05 12:00:34 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/view-papercli
2009-03-05 12:00:34 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/view-sortdown
2009-03-05 12:00:34 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/icon-msg-unre
2009-03-05 12:00:34 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/icon-papercli
2009-03-05 12:00:34 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/tool-move.gif
2009-03-05 12:00:34 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/tool-copy.gif
2009-03-05 12:00:34 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/tool-rename.g
2009-03-05 12:00:34 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/tool-delete.g
2009-03-05 12:00:34 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/view-nextpage
2009-03-05 12:00:34 192.168.1.1 - 192.168.1.2 443 GET /exchweb/img/view-prevpage
2009-03-05 12:00:35 192.168.1.1 - 192.168.1.2 443 GET /favicon.ico - 404 4203 355 Mozilla/5.0+(Windows;+U;+W
2009-03-05 12:00:36 192.168.1.1 - 192.168.1.2 443 GET /favicon.ico - 404 4203 385 Mozilla/5.0+(Windows;+U;+W
2009-03-05 12:00:42 192.168.1.1 xxxxx@xxxxxx 192.168.1.2 443 POLL /exchange/user.domain/Kale
2009-03-05 12:00:42 192.168.1.1 xxxxx@xxxxxx 192.168.1.2 443 POLL /exchange/user.domain/Post
2009-03-05 12:00:47 192.168.1.1 xxxxx@xxxxxx 192.168.1.2 443 POLL /exchange/user.domain/Post
2009-03-05 12:01:18 192.168.1.1 xxxxx@xxxxxx 192.168.1.2 443 GET /exchange/user.domain/ Cmd=logoff 302 257 601 Mozilla/5.0+(Windows;+U;+W
2009-03-05 12:01:18 192.168.1.1 - 192.168.1.2 443 GET /exchweb/bin/USA/logoff.as
and the same user tries with ie 7.0(6.0) which fails
2009-03-05 12:02:31 192.168.1.1 - 192.168.1.2 443 GET /exchange/ - 401 1107 1175 Mozilla/4.0+(compatible;+M
2009-03-05 12:02:42 192.168.1.1 xxxxx@xxxxxx 192.168.1.2 443 POLL /exchange/user.domain/Post
2009-03-05 12:02:45 192.168.1.1 xxxxx@xxxxxx 192.168.1.2 443 GET /exchange/ - 200 1411 632 Mozilla/4.0+(compatible;+M
2009-03-05 12:02:45 192.168.1.1 xxxxx@xxxxxx 192.168.1.2 443 GET /exchange/user.domain/ Cmd=navbar 200 9449 768 Mozilla/4.0+(compatible;+M
2009-03-05 12:02:45 192.168.1.1 xxxxx@xxxxxx 192.168.1.2 443 GET /exchange/user.domain/Post
2009-03-05 12:02:45 192.168.1.1 xxxxx@xxxxxx 192.168.1.2 443 SUBSCRIBE /exchange/user.domain/Kale
2009-03-05 12:02:45 192.168.1.1 xxxxx@xxxxxx 192.168.1.2 443 SUBSCRIBE /exchange/user.domain/Post
2009-03-05 12:02:45 192.168.1.1 xxxxx@xxxxxx 192.168.1.2 443 SEARCH /exchange/user.domain/Kale
2009-03-05 12:02:45 192.168.1.1 xxxxx@xxxxxx 192.168.1.2 443 SEARCH /exchange/user.domain/Post
2009-03-05 12:02:47 192.168.1.1 xxxxx@xxxxxx 192.168.1.2 443 POLL /exchange/user.domain/Post
2009-03-05 12:02:55 192.168.1.1 - 192.168.1.2 443 SEARCH /exchange/user.domain/Post
2009-03-05 12:02:55 192.168.1.1 - 192.168.1.2 443 SEARCH /exchange/user.domain/Kale
2009-03-05 12:04:42 192.168.1.1 xxxxx@xxxxxx 192.168.1.2 443 POLL /exchange/user.domain/Post
2009-03-05 12:04:47 192.168.1.1 xxxxx@xxxxxx 192.168.1.2 443 POLL /exchange/user.domain/Post
2009-03-05 12:06:42 192.168.1.1 xxxxx@xxxxxx 192.168.1.2 443 POLL /exchange/user.domain/Post
2009-03-05 12:06:47 192.168.1.1 xxxxx@xxxxxx 192.168.1.2 443 POLL /exchange/user.domain/Post
2009-03-05 12:08:42 192.168.1.1 xxxxx@xxxxxx 192.168.1.2 443 POLL /exchange/user.domain/Post
2009-03-05 12:08:47 192.168.1.1 xxxxx@xxxxxx 192.168.1.2 443 POLL /exchange/user.domain/Post
Most of the failed log entries actually look okay. As long as a username xxxxx@xxxxxx has been included in the line, then that means that IIS has accepted the logon, so something else must be wrong. Most of the requests return a success code (200 or 207), but the SEARCH is always rejected. I don't know why that should be, when other requests like POLL are accepted, but it may be because there is an AntiVirus package on the server, that is configured to reject the SEARCH verb. Can you see anything like that on the server?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.