• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 2741
  • Last Modified:

When an email is either replied to or forwarded internally it strips out all the previous content

Exchange 2010
Outlook 2007
Symantec Message labs
Symantec PGP
Trend Micro AV

I have an email issue on our network, it happens only occasionally and to date it has effected 5 users at differing times.

When an email is either replied to or forwarded internally it strips out all the previous content and effectively sends the email blank apart from our internal signatures.

It does not affect all emails sent from any one account, the email will also behave the same if forwarded from the account that received it even if that user has not experienced that problem before.

This is not down to Outlook 2007 message settings as far as I am aware, the settings are set for forwarding and replying to “include original message text”.

If I forward the complete message to myself, it removes the content. If I then forward it to gmail it arrives with everything intact, it also will arrive back into my mailbox complete if forwarded from gmail.

I have disabled Trend on my machine, so effectively this is not the cause.  Also I am not running PGP desktop with any encrypted software, as the email I forward from my own account to my account does not go through the gateway I assume PGP is not the culprit either.

If I track the email with the Microsoft Exchange Troubleshooting Assistant, I see the messages that arrived but the byte count is 18259 as opposed 51782 that is on the full email content.

I really need to get to the bottom of this, our business environment is in pensions and having users not being able to forward messages is getting a pain.

I am sure this explanation is about as clear as mud ¿, let me know if anyone needs more info before providing a possible solution to tracking the path of the email to see what the offending software is that is doing this.

Thanks for any assistance in advance.
0
mercuriousu2
Asked:
mercuriousu2
2 Solutions
 
PostmasterCommented:
Have you checked the Outlook OPTIONS?
"On replies and forwards"

Tools / Options / e-mail options
0
 
mercuriousu2Author Commented:
Hi, thanks for the reply but as previously mentioned "This is not down to Outlook 2007 message settings as far as I am aware, the settings are set for forwarding and replying to “include original message text”.

Thanks
0
 
lucid8Commented:
1. Have you tried repeating these actions via OWA to validate that its not a client/Outlook based issue?

2. Does all mail flows through Message labs before going on to the destination or?
0
Configuration Guide and Best Practices

Read the guide to learn how to orchestrate Data ONTAP, create application-consistent backups and enable fast recovery from NetApp storage snapshots. Version 9.5 also contains performance and scalability enhancements to meet the needs of the largest enterprise environments.

 
lucid8Commented:
Are the messages you are replying or forwarding have attachments?

What Service pack are you running on 2010, i.e. RTM SP1, SP1, RU1, RU2, RU3 etc?

I know SP1 RU1 had some message related patches
0
 
Delphineous SilverwingGood Ol' GeekCommented:
Just a note, though probably not related... the setting for Outlook including the content of the message can be controlled by a group policy.

What format are the messages having the issue?  (HTML, Rich text, Plain Text)  If it is only HTML formatted messages, there may be a script in the base template which is causing the symptom.
0
 
mercuriousu2Author Commented:

Hi Guys
Sorry for the slow response, I am UK based so we have a time difference and also please remember we are also entering into a holiday weekend (happy holidays :-)

I have a new user today getting the same issue, he controls a group of staff and normally just forwards on emails to the relevant people. One today will not go, I can’t see any problem with the email or content but it’s  exactly the same behaviour as previously mentioned.

I have answered the responses below.

Q:. Have you tried repeating these actions via OWA to validate that it’s not a client/Outlook based issue?
A:Yes, using the same problematic emails (as mentioned it only seems to apply to some) it can be forwarded ok from OWM. In my email account the message (forwarded body) is missing, although in the online client it arrives intact.

Q:. Does all mail flows through Message labs before going on to the destination or?
A: No, only when external addresses are used.

Q:Are the messages you are replying or forwarding have attachments?

Sometimes –The attachments arrive with just the text body missing.

Q: What Service pack are you running on 2010
A: SP1


Q: Just a note, though probably not related... the setting for Outlook including the content of the message can be controlled by a group policy.
A: Not sure this is implemented and would not know where to look for this one?

Q: What format are the messages having the issue? (HTML, Rich text, Plain Text) If it is only HTML formatted messages, there may be a script in the base template which is causing the symptom.
A: Normally sent in html although the same happens with plain  text.  

Many thanks
0
 
lucid8Commented:
ok so

1. just for clarification, you are saying that it works without issue IF you are using OWA / The Web Client?

2. If yes to # 1 above then this would definitely seem to be a client/machine based issue or a user account policy based issue but either way its not anything in the back end stripping this.

3. What else do these users have in common at the desktop level, i.e. OS version, AV client version, signature etc?

4. Do the effected users belong to any security group or distribution list that the non-effected users don't belong to?

5. Have you tried logging in as one of the effected users to a machine of a user that is NOT seeing this happen.  This will tell us if this is an account based/ group policy based issue  i.e. if the same effects happen when you log into a machine for a user that has not experienced the issue or is it hardware/software configuration based.  

6. Have you tried sending the same emails that this is happening with to another account that has not experienced it so that you can see if its a content based trigger issue?

7. Are you using cache or non-cached configuration for outlook on the effected and non-effected users?

8. You are using Outlook 2007 across the board correct?  If so is Outlook all at the same patch level?  Could be that one has an extra or missing patch/config...
0
 
mercuriousu2Author Commented:
1.just for clarification, you are saying that it works without issue IF you are using OWA / The Web Client?
A: YES

2. If yes to # 1 above then this would definitely seem to be a client/machine based issue or a user account policy based issue but either way its not anything in the back end stripping this.
A: Not too sure, we also have a automatic disclaimer software that is in the mix.  I am currently having some of the html disclaimer policy’s re-written to ensure the problem is not related.

3. What else do these users have in common at the desktop level, i.e. OS version, AV client version, signature etc?
A: The O/S can differ from XP to Windows 7, AV is the same as is Outlook 2007 and signature disclaimers

4. Do the effected users belong to any security group or distribution list that the non-effected users don't belong to?
A: When this behaviour happens, the message that has been sent will react the same irrespective of who receives it.

5. Have you tried logging in as one of the effected users to a machine of a user that is NOT seeing this happen. This will tell us if this is an account based/ group policy based issue i.e. if the same effects happen when you log into a machine for a user that has not experienced the issue or is it hardware/software configuration based.
A: I logged a user into a machine that both (user/machine) had not experienced this problem.  I sent one of the emails into the user account as an attachment, I then sent the original message to my account and also cc’d my gmail account.  My work account only received a blank email with the attachment that was originally part of the email, my gmail account received the full forwarded content plus the attachment.
I replied from both accounts, the work account only sent my tester text response with no additional content, the gmail account had the full body thread content.


6. Have you tried sending the same emails that this is happening with to another account that has not experienced it so that you can see if its a content based trigger issue?
A: See No:5

7. Are you using cache or non-cached configuration for outlook on the effected and non-effected users?
A: Cached config on all

8. You are using Outlook 2007 across the board correct? If so is Outlook all at the same patch level? Could be that one has an extra or missing patch/config...
A: Although not all machines are at the same patch level, this seems to not be the issue as once this behaviour with an email starts, that email will not arrive in full to any internal account but will arrive to an external one with no issues.

Thanks
0
 
mercuriousu2Author Commented:
UPDATE:

If I send the email to another account I have been testing via html, it arrives with the body copy.
From that account, I reply or forward back to my account and it again arrives complete.

If I do the same by sending with rich text or just text, it arrives with no previous messages and only my email with my signature.
0
 
lucid8Commented:
Where are you sending the HTML, Rich Text and Text based test messages from when you send it to your account for testing?  i.e. Internally from Outlook, externally from Gmail?

Here are a few interesting articles that may help

is a post regarding NOD32 thats stripping the email when its RTF http://www.wilderssecurity.com/showthread.php?t=265421so wondering if Trend is causing this issue?

Another NOD post http://www.networksteve.com/exchange/topic.php/Outlook_2007_strips_text/html_body_from_messages/?TopicId=11958&Posts=3

One on McAfee http://www.experts-exchange.com/Software/Server_Software/Email_Servers/Exchange/Q_26333843.html

So since you say the messages can be reviewed without issue in OWA but When viewing with Outlook 2007 I would say that you either have an AV issue as the others above discovered OR it is an Outlook 2007 SP level issue. OR if you are running any type of SPAM service on the local machine that could be doing this as well, however I assume you are doing all SPAM filtering on the back end only?

Question 1:  After you view via Outlook and the body is blank, is it still viewable in OWA?

Question 2 :  Do you have a test machine that has a different version of Outlook installed on it that you can test from, i.e. 2003 or 2007?   I would also test with AV and any other possible components removed completely  in order to validate the issues, i.e. works fine without AV, breaks when its installed etc.

NOTE: To test the AV or other component issues you need to completely remove them, i.e. disabling them is not always enough.  We had an issue with Trend on our Exchange server some time ago and MS told us to remove trend completely.  We thought this was a bunch of BS but low and behold we removed it and all was well.  So I know its a pain but I would get a test box and start removing suspected products to narrow this down.

0
 
mercuriousu2Author Commented:
I removed AV from the test machines and this made no difference to the results.
When forwarding the rich text messages, they strip out the previous body both in Outlook and when viewed in OWA.

I have worked out that by having users change to html when forwarding or replying to an email works ok, I have sent out details for users to do this until I can work out what the problem is.

I shall do additional testing as advised but proberbly not until after our hoilday weekend.

Thanks
0
 
lucid8Commented:
thanks for the update and interesting information about the forwarding of the messages in that previously I though that you said OWA worked just fine, but now this sounds as though its happening in the back end somewhere.

1. Have you tried  removing outlook from the equation entirely, i.e. open a rich text based message and forwarding it via OWA

2. Then open again via OWA, is it stripped?

0
 
mercuriousu2Author Commented:
Very sorry for the delay in responding, my american express card was delined on my EE account for some reason and it has take a while to get this sorted out and re-activate my account!!!

This problem has now been resolved, the offending software that caused the problems is called "Exclaimer Mail Disclaimers".

Some of our policy signature templates had gone bad (why - dunno), when they were re-written in html (copy/paste will not work even copying from notepad) everything started to flow as normal.

As there were so many packages that could possibly effect the outcome, this was difficult to track down and thanks to lucid8 for staying with it. Point allocated as a result :-)

0
 
lucid8Commented:
Wow, very interesting indeed, and much appreciated for the update and especially the points!
0

Featured Post

New feature and membership benefit!

New feature! Upgrade and increase expert visibility of your issues with Priority Questions.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now