Microsoft KB Archive/325965

Knowledge Base

The URLScan tool may cause problems in Outlook Web Access

Article ID: 325965

Article Last Modified on 10/25/2007

---

APPLIES TO

• Microsoft Exchange Server 2003 Standard Edition
• Microsoft Exchange Server 2003 Enterprise Edition
• Microsoft Exchange 2000 Server Standard Edition
• Microsoft Exchange Server 5.5 Standard Edition

---

This article was previously published under Q325965

SYMPTOMS

When you use Microsoft Outlook Web Access (OWA), you may experience one or more of the following symptoms:

• The Inbox opens and all the icons appear, but a "Loading..." message appears where you expect to see your message list. If you try to view public folders, the screen is blank. If you use OWA with Netscape Navigator to view your Inbox and Public Folders, all your messages are listed.
• When you try to log on, you receive the following error message:

  The item could not be found. It may have been deleted.

• When you try to open messages that include certain characters in the Subject box, you receive the following error message in your browser:

  
  The page cannot be found
  
  The page you are looking for might have been removed, had its name changed, or is temporarily unavailable.
  
  Please try the following:
  
  - If you typed the page address in the Address bar, make sure that it is spelled correctly.
  
  - Open the <server> home page, and then look for links to the information you want.
  
  - Click the Back button to try another link.
  
  HTTP 404 - File not found
  
  

  
  

You have determined that there are no network devices, such as firewalls or routers, that are blocking communication between your client and the OWA Web server.

CAUSE

These symptoms occur if you have installed the URLScan tool on the Web server where OWA is installed, and you have not changed the default settings.

For more information about the URLScan tool, visit the following Microsoft Web site:

URLScan Security Tool version 2.0
http://www.microsoft.com/technet/security/tools/urlscan.mspx

RESOLUTION

To resolve this issue, use one of the following methods.

Method 1: Modify URLScan settings

To modify the URLScan settings to permit additional Web Distributed Authoring and Versioning (WebDAV) verbs and Hypertext Transfer Protocol (HTTP) verbs through URLScan, modify the Urlscan.ini file. For additional information about how to modify the Urlscan.ini file, click the following article number to view the article in the Microsoft Knowledge Base:

309508 IIS Lockdown and URLScan configurations in an Exchange environment

Method 2: Remove the URLScan tool

To remove the URLScan tool, follow these steps:

1. Click Start, point to Settings, and then click Control Panel.
2. Double-click Add or Remove Programs.
3. Click IIS UrlScan Tool 2.0 (Uninstall), and then click Change/Remove.
4. Click Yes to restart Internet Information Services (IIS).
5. Click OK to confirm the location of the URLScan log file, and then click Close.

MORE INFORMATION

By default, the URLScan utility blocks access to messages that contain the following characters in the Subject box for the following reasons:

   ..  ; Does not allow directory traversals
   ./  ; Does not allow trailing dot on a directory name
   \   ; Does not allow backslashes in URL
   :   ; Does not allow alternate stream access
   %   ; Does not allow escaping after normalization
   &   ; Does not allow multiple CGI processes to run on a single request
                

Note If you change " .." to " ../", requests are protected from the traversal, and e-mail messages that have ellipsis (...) in the subject are allowed. For additional information about the URLScan utility, click the following article number to view the article in the Microsoft Knowledge Base:

309508 IIS lockdown and URLscan configurations in an Exchange environment

Additional query words: inbox mailbox empty blank calendar ISAPI filter URL Scan

Keywords: kbprb KB325965

---

Send feedback to Microsoft

© Microsoft Corporation. All rights reserved.