?
Solved

Outlook 2010, NTDLL.DLL, & Exchange 2003

Posted on 2010-08-31
13
Medium Priority
?
3,067 Views
Last Modified: 2012-05-10
We're an Exchange 2003 (in a 2008 R2 schema AD forest) shop. We have Exchange running on a single cluster composed of two nodes.

We have random instances where there are users who, when using Outlook 2010 to connect to their mailbox, Outlook crashes as soon as it completes loading. This occurs regardless of:

Office location/proximity to the cluster
With or without Cached Exchange Mode
With Outlook 2010 in regular or safe mode
Regardless of Outlook Authentication or Encryption Setting
From any system in our organization - built from scratch or from a corporate deployment
With out any other connections in the profile (ie, IMAP to another server, or a MAPI Livemeeting plugin)

However, with Outlook 2007, there are no issues at all, and the user can work without issue.

I haven't seen any authentication issues for that user logged in our exchange server, and the error logged in the local application event log is as follows:

Log Name:      Application
Source:        Application Error
Date:          8/31/2010 1:55:44 PM
Event ID:      1000
Task Category: (100)
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      A11911.americas.research.global.loc
Description:
Faulting application name: OUTLOOK.EXE, version: 14.0.4760.1000, time stamp: 0x4ba8fefd
Faulting module name: ntdll.dll, version: 6.1.7600.16385, time stamp: 0x4a5bdadb
Exception code: 0xc0000374
Fault offset: 0x000c283b
Faulting process id: 0x12e8
Faulting application start time: 0x01cb494ed8061f9e
Faulting application path: C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: 1ef19a24-b542-11df-a34a-001c25160ed8
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Application Error" />
    <EventID Qualifiers="0">1000</EventID>
    <Level>2</Level>
    <Task>100</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2010-08-31T20:55:44.000000000Z" />
    <EventRecordID>17498</EventRecordID>
    <Channel>Application</Channel>
    <Computer>A11911.americas.research.global.loc</Computer>
    <Security />
  </System>
  <EventData>
    <Data>OUTLOOK.EXE</Data>
    <Data>14.0.4760.1000</Data>
    <Data>4ba8fefd</Data>
    <Data>ntdll.dll</Data>
    <Data>6.1.7600.16385</Data>
    <Data>4a5bdadb</Data>
    <Data>c0000374</Data>
    <Data>000c283b</Data>
    <Data>12e8</Data>
    <Data>01cb494ed8061f9e</Data>
    <Data>C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE</Data>
    <Data>C:\Windows\SYSTEM32\ntdll.dll</Data>
    <Data>1ef19a24-b542-11df-a34a-001c25160ed8</Data>
  </EventData>
</Event>

We're at the point where we're about to export the users' mailbox to a PST file, delete the mailbox, and re-create it. However, I don't see this as a feasible option for tens, or hundreds of users (we're just beginning to push out Win7 and Outlook 2010).
0
Comment
Question by:synovatech
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 8
  • 5
13 Comments
 

Author Comment

by:synovatech
ID: 33571827
Additional point of data:

We use McAfee VirusScan Enterprise 8.7, Patch 3, in our environment - I haven't seen anything to indicate this is a McAfee issue, especially as we have disabled all plug-ins via Outlook safe mode.
0
 
LVL 28

Expert Comment

by:sunnyc7
ID: 33572019
I am not sure if this is a fix - but check this
http://www.vssbusinesssolutions.com/KBArticles.aspx?KbArticleID=60

Points to corrupt helvetica font as a problem
-
try this after eliminating the usual suspects
Disable antivirus
remove addins
start outlook in safe mode
start > run > outlook /safe

There are multiple instances of this
http://social.technet.microsoft.com/Forums/en-US/office2010/thread/69e064a4-bd97-43a7-8a27-23c4e36c9f38
http://www.techsupportforum.com/microsoft-support/microsoft-office-support/494774-solved-outlook-2010-crashes-usp10-dll-when-trying-display-particular-messages.html
0
 

Author Comment

by:synovatech
ID: 33572061
That's definitely good info (and thank you!) - unfortunately, not the culprit. It follows the user to any machine in the organization running 2010, but any other user can log into the same machine and access their Exchange mailbox via Outlook 2010 without issue.
0
Prepare for your VMware VCP6-DCV exam.

Josh Coen and Jason Langer have prepared the latest edition of VCP study guide. Both authors have been working in the IT field for more than a decade, and both hold VMware certifications. This 163-page guide covers all 10 of the exam blueprint sections.

 
LVL 28

Expert Comment

by:sunnyc7
ID: 33572079
It follows the user to any machine in the organization running 2010
>> Corrupted mail item ?
Anything with weird fonts / large attachments / funny attachments / ActiveX in message ?

If you can track down the message and delete it - lets see if that works.

What happens when you do outlook /safe
0
 

Author Comment

by:synovatech
ID: 33572247
We've moved the mailbox between message stores, and haven't encountered any corrupted items. She's archived the majority of her e-mail to a PST file, and doesn't have any strange fonts set as a default.

As mentioned above, outlook in safe mode yields the same results.
0
 
LVL 28

Expert Comment

by:sunnyc7
ID: 33572258
Will post back if i figure out something.
Can you get the bucket ID of the faulting application

Download and run this from the workstation where her outlook is crashing.
http://www.nirsoft.net/utils/shexview.html
0
 

Author Comment

by:synovatech
ID: 33572742
I'll have to get back to you on the ShellExView results - it's being flagged as a trojan. Once I verify everything's safe I'll proceed. Thanks :)
0
 
LVL 28

Expert Comment

by:sunnyc7
ID: 33572756
This is from Nirsoft.
http://www.nirsoft.net/
Some of the best utilities after SystInternals - which was acquired by Microsoft.
0
 

Author Comment

by:synovatech
ID: 33592201
Here's the Faultbucket info - Sorry for the delay (life happened):


Fault bucket 1058594327, type 5
Event Name: FaultTolerantHeap
Response: Not available
Cab Id: 0

Problem signature:
P1: OUTLOOK.EXE
P2: 14.0.4760.1000
P3: 4BA8FEFD
P4: ffffbaad
P5:
P6:
P7:
P8:
P9:
P10:
0
 

Author Comment

by:synovatech
ID: 33592270
Also, to add - I moved all of her messages around into different folders, as in the past this has always revealed any corrupted messages. I didn't come across any.
0
 
LVL 28

Expert Comment

by:sunnyc7
ID: 33592367
Did you try creating a new ad username and then configuring outlook using that ?

I will check the fault bucket and post back
0
 

Author Comment

by:synovatech
ID: 33596867
That is the next step - but we've already got many other users with Outlook 2010 working on our exchange system. So we already know that this is specific to this user and that combination. The overall concern here is that we don't know why this is happening, and as such, as we continue to roll out Outlook 2010, deleting and re-creating users would become onerous.
0
 

Accepted Solution

by:
synovatech earned 0 total points
ID: 33667478
We've only been able to replicate this issue with the one user - and we reached the point where Outlook 2010 had to work. As such, her mailbox was deleted and re-created. This resolved the issue - even after importing all of her mail back in, the issue did not occur.

As much as I would like to leave this request open in case it occurs again, it is not repeatable at this time. As such, we're going with deleting and re-creating as the answer.
0

Featured Post

Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In-place Upgrading Dirsync to Azure AD Connect
You need to know the location of the Office templates folder, so that when you create new templates, they are saved to that location, and thus are available for selection when creating new documents.  The steps to find the Templates folder path are …
This video shows how to remove a single email address from the Outlook 2010 Auto Suggestion memory. NOTE: For Outlook 2016 and 2013 perform the exact same steps. Open a new email: Click the New email button in Outlook. Start typing the address: …
This video shows how to quickly and easily add an email signature for all users on Exchange 2016. The resulting signature is applied on a server level by Exchange Online. The email signature template has been downloaded from: www.mail-signatures…
Suggested Courses
Course of the Month14 days, 13 hours left to enroll

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question