locked
Exchange 2007 doesn't index mail body when password protected office 2003 document is attached. RRS feed

  • Question

  • I've got a strange one.. this is Server 2008 (NOT R2) running DC, GC and Exchange 2007 SP3 RU9 all on the same box (I know, it's not best practice, it's something I've inherited)

    The Exchange Search Index is acting up but it's not the typical "stopped indexing after a certain date" or "isn't indexing at all"... it's just missing the odd e-mail here and there and I've got no idea why or how to effectively troubleshoot it. I THINK the problematic e-mails tend to be when someone has opened a document in Word and then used File->Send To but it seems completely random which items don't get indexed. I could cope with "all" or "nothing" but the uncertainty of the search results is driving staff crazy. For now, I've turned off the indexing because at least that returns consistent results and shows the items that were previously missing when using indexing (albeit slower) 

    Steps tried so far: [All this was done over a weekend where the Exchange 2007 Mailbox Database Maintenance Schedule was disabled and confirmed no backups were running during testing (as I know the Search Index won't rebuild during a database backup).]

    * Test-ExchangeSearch WORKS.
    * Confirmed there is no realtime/file level AV running and no defragmentation software installed
    * Was on Exchange 2007 SP3 RU8, upgraded to Exchange 2007 SP3 RU9 regardless. Rebooted.
    * Removed "Symantec Mail Security for Microsoft Exchange 7.0" Rebooted.
    * Re-Registered MapiProtocolHandlerStub.dll
    * Re-Registered msfte.dll 
    * Re-Registered msftepxy.dll 
    * Added 127.0.0.1 crl.microsoft.com to HOSTS and confirmed it's working by pinging crl.microsoft.com and monitoring response from new IP.
    * Stopped and restarted "Microsoft Search (Exchange)" and "Microsoft Exchange Search Indexer." services.
    * Stopped "Microsoft Search (Exchange)", opened an elevated Exchange Management Shell, ran "resetsearchindex -force -all".. monitored the the Event Log for Event ID 110 "Exchange Search Indexer completed a full crawl (indexing) of Mailbox Database First Storage Group\Mailbox Database (GUID = xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx) which occurred roughly an hour later. The catalog size is only 2.15GB for a 206GB Mailbox database and the problem remains.
    * Installed both the Microsoft Office 2007 & 2010 Filter Packs and registered as appropriate. Rebooted. Tried another "resetsearchindex -force -all", still resulted in a 2.15GB catalog.
    * ExBPA is reporting no errors or warnings.

    I HAVEN'T tried un-installing "Microsoft Full Text Indexing Engine for Exchange Setup" by opening the "Installer" folder, finding the appropriate .MSI and un-installing.. mostly because it isn't listed there.

    The search results are CORRECT on machines that are using Outlook 2007 and Cached Mode but the vast majority of our access is via a 2008 Remote Desktop Server with Outlook 2007 so Cached Mode and local indexing isn't really an option.

    Outlook 2007 on the RDS, and Outlook Web Access both have missing results when the Exchange Search Index is enabled.

    If anyone has any further suggestions or has seen this particular scenario before, I'd love any advice!!



    • Edited by vexation Sunday, March 3, 2013 8:25 PM clarification in title
    Saturday, February 2, 2013 3:33 PM

Answers

  • Hi,

    Please try recreating OWA virtual directory, and note: once you recreate OWA virtual directory, the setting of OWA virtual directory will disappear, you need to restore it manually.

    More information:

    Exchange Server 2007 OWA Search feature doesn't work ? 

    http://forums.msexchange.org/m_1800511767/mpage_1/key_/tm.htm#1800528926

    Note: Microsoft is providing this information as a convenience to you. The sites are not controlled by Microsoft. Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or information found there. Please make sure that you completely understand the risk before retrieving any suggestions from the above link.


    Wendy Liu
    TechNet Community Support

    • Proposed as answer by wendy_liu Monday, February 18, 2013 2:22 AM
    • Marked as answer by wendy_liu Monday, February 18, 2013 2:23 AM
    Tuesday, February 5, 2013 2:49 AM
  • Opened a case with Microsoft and got them to look into this.

    The exact problem I was experiencing was if an e-mail had a password protected Office 2003 document attached, the Microsoft Exchange Search Indexer didn't index the e-mail body or subject. This caused missing OWA and Outlook (in Online Mode) search results.

    This is now confirmed to be a bug in Exchange 2007 that won't be fixed. It was recommended we upgrade to Exchange 2010 or better.

    • Marked as answer by vexation Monday, May 27, 2013 6:47 PM
    Monday, May 27, 2013 6:47 PM

All replies

  • Running DC and Exchange not recommended on same server.

    Can you check if performance issue there?


    Thanks Prem P Rana MCSA Messaging 2003 MCSE 2003 Server MCTS MCITP Exchange 2007, 2010 Gurgaon, India

    Sunday, February 3, 2013 2:54 AM
  • No performance issues really. No excessive CPU usage, disk queues or paging. It's rare to have more than 10 people accessing the system at once - if anything the server is overkill for their needs, 2x Xeon E5420s, 32GB of RAM and dedicated spindles for OS, Exchange DB and Exchange Logs.. all with the recommended partition alignment, 64kb cluster size etc.

    Unfortunately moving mailboxes to another database (to bring the current database size down) or upgrading to Exchange 2010 isn't an option at the moment. 

    To be honest, everything else is working perfectly... it's just this baffling Indexing issue causing problems; there aren't even any error messages to work off.

    Actually, I've just upped the logging for Exchange Search Index to Expert and rebuilt the catalog again. I'm now getting plenty of the follow errors.. (I forgot you could change the logging levels)

    Mapi protocol handler encountered an unknown exception obtaining message content from : MDB be16606f-e015-47c0-9539-8140de3fb71d, Mailbox 86e7e2ed-a42d-4964-97bd-c2137cfe7c16, DocumentID 2538, EntryID System.Byte[]. The exception is: System.ComponentModel.Win32Exception: Unknown error (0x80043607)
       at Microsoft.Exchange.Search.PropertyIdCache.InternalGetPropertyIdFromFPS(FullPropSpec fps, Object obj)
       at Microsoft.Exchange.Search.DataCache`2.GetResource(KeyType key, Object mapper)
       at Microsoft.Exchange.Search.MapiChunkSource.GetPidFromPropTag(MapiChunk chunk)
       at Microsoft.Exchange.Search.MapiChunkSource.GetNextChunk(IntPtr chunk).

    ..at least I've got something to work with now.

    Also after reading Chris Veto's post, at http://social.technet.microsoft.com/forums/en-US/exchangesvrgeneral/thread/8064f760-c36d-4faf-b2ea-3735b1f4540f/ I think he's spot on and I can reproduce the problem now.

    If the attached document name (wibble.doc) is also in the subject name of the e-mail, it doesn't get indexed.. now to see whether Microsoft have actually fixed it.. or whether they ignored his call.


    • Edited by vexation Sunday, February 3, 2013 1:10 PM
    Sunday, February 3, 2013 12:49 PM
  • Hi,

    Please try recreating OWA virtual directory, and note: once you recreate OWA virtual directory, the setting of OWA virtual directory will disappear, you need to restore it manually.

    More information:

    Exchange Server 2007 OWA Search feature doesn't work ? 

    http://forums.msexchange.org/m_1800511767/mpage_1/key_/tm.htm#1800528926

    Note: Microsoft is providing this information as a convenience to you. The sites are not controlled by Microsoft. Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or information found there. Please make sure that you completely understand the risk before retrieving any suggestions from the above link.


    Wendy Liu
    TechNet Community Support

    • Proposed as answer by wendy_liu Monday, February 18, 2013 2:22 AM
    • Marked as answer by wendy_liu Monday, February 18, 2013 2:23 AM
    Tuesday, February 5, 2013 2:49 AM
  • Hi Wendy,

    I tried this but sadly it didn't help.

    OWA search is working, it's just that the indexing service is missing certain e-mails. I'm fairly certain it's as described by Chris Veto @ http://social.technet.microsoft.com/forums/en-US/exchangesvrgeneral/thread/8064f760-c36d-4faf-b2ea-3735b1f4540f

    Sadly I've tried everything I can think of now and it looks like the only remaining option is to re-build the Exchange box (which other people have tried and had the same problem); it just isn't feasible in this scenario so I'm leaving it until later in the year when we can hopefully move to E2010/13.

    Thanks for the advice anyway.

    Monday, February 18, 2013 9:23 AM
  • To manually rebuild the full-text index catalog, stop the Microsoft Exchange Search Service, delete the old catalog, and then restart the service. This procedure forces the server to re-create the full-text index catalog.

    Tuesday, February 19, 2013 7:45 PM
  • Hi David,

    Already tried that unfortunately. I get the same results as when I run 'resetsearchindex.ps1 -force -all' - it takes about an hour to re-create the full-text index catalog (I receive the "Exchange Search Indexer completed a full crawl (indexing) of Mailbox Database First Storage Group\Mailbox Database" event) but it's still missing some e-mail items. 

    I could cope with 'nothing' working; but random items not being indexed is pretty frustrating as the only fix seems to be to re-build the index.. something I've tried 10+ times now with the same results. The index is re-created, confirms it's finished a full crawl and returns some but not all results.

    If I disable the indexing on the database and try to search, it does find the un-indexable items! So I've got no idea why the search indexer can't index these items. I had hoped that might be a solution but it also has other side-effects in OWA (doesn't search entire mailbox and a few other limitations) that our users couldn't cope with.

    Frustrating!

    Tuesday, February 19, 2013 8:58 PM
  • I'm having the same problem.  I'm currently rebuilding the indexes but am not optimistic.  In my setup Exchange is not installed on a DC
    Thursday, February 28, 2013 8:51 PM
  • Not that I expected it to help but I've now installed SP3 RU10 and also the SP1 for Office 2010 Filterpack and re-built the indexes again. It still isn't returning all the results. Some, but not all. 

    I've now confirmed that it is e-mails with password protected attachments which do not get indexed. If I create a new word document, call it c012345.01.doc and password protect it, then from Word select File->Send->E-mail and send it, it will have a default subject of c012345.01.doc, I can't search for that e-mail using words in subject or message body.

    If I do the same but the word document isn't password protected, everything is indexed as expected.

    I repeated the same experiment but saved as a .docx file and it WORKS. So it seems to only be password protected .xls and .doc files that cause this problem.

    Please note I OBVIOUSLY DO NOT expect it to index the password protected document but I do expect it to index the content of the e-mail message body which it is not when an Office 2003 password protected document is attached.

    At least I've got a better idea of what's causing it (for me at least!) now.
    • Edited by vexation Sunday, March 3, 2013 8:16 PM clarification
    Sunday, March 3, 2013 4:13 PM
  • Okay, I've now tested this at two completely different Exchange 2007 sites.

    Both exhibit the same behavior, if you attach a password protected Office 2007 (.docx) document, the mail subject/body IS indexed. If you attach a password protected Office 2003 (.doc) document the mail subject/body ISN'T indexed.

    Have also tried this at 2 different SBS2011 sites too (Exchange 2010) I had the opposite behavior at one site (the .doc was indexed and the .docx wasn't) and at the other site everything was indexed properly (both .doc and .docx e-mails).

    Nothing common between any of these sites, there's definitely something fruity going on. Wish it made more sense.

    • Edited by vexation Sunday, March 3, 2013 10:08 PM Further tests on SBS2011.
    Sunday, March 3, 2013 9:20 PM
  • I've been trying to track down a problem with outlook searches in an Exchange 2007 SP3 rollup 10 environment.  Some messages just could not be found via search and no messages were in the event logs related to the search.  Eventually I tracked it down to having Office 2010 files as attachments caused the message to be "invisible" to search.  Such messages just did not appear to exist even when specific search terms were in the title or message body - the entire message did not make it through the indexing process. Though I could search and find messages with Office 2007 attachments.

    I installed Microsoft Filter Pack 2.0 and my search / indexer problems went away (at least as far as 20 minutes of testing has found).  I will have to re-build the indices though. 

    I had Microsoft filter pack 1 installed. Sheesh.  I had better get prepared for Office 2013!

    • Proposed as answer by Richard_Ross Thursday, March 14, 2013 7:56 PM
    Thursday, March 14, 2013 7:42 PM
  • Hi Richard,

    I've already got the MFP1 and 2 Filter Pack's installed, I haven't installed the latest security update (think it was only released yesterday) but there's no mention of a fix for this anyway.

    I've been able to reproduce this on 3 different Exchange 2007 sites so I'll be opening a case with Microsoft as soon as I have some time to myself, fairly sure this is a bug.

    I thought the problem existed in Exchange 2010 too but it just takes a lot longer to index in that scenario.

    Thursday, March 14, 2013 8:20 PM
  • Opened a case with Microsoft and got them to look into this.

    The exact problem I was experiencing was if an e-mail had a password protected Office 2003 document attached, the Microsoft Exchange Search Indexer didn't index the e-mail body or subject. This caused missing OWA and Outlook (in Online Mode) search results.

    This is now confirmed to be a bug in Exchange 2007 that won't be fixed. It was recommended we upgrade to Exchange 2010 or better.

    • Marked as answer by vexation Monday, May 27, 2013 6:47 PM
    Monday, May 27, 2013 6:47 PM
  • On Mon, 27 May 2013 18:47:07 +0000, vexation wrote:
     
    >Opened a case with Microsoft and got them to look into this.
    >
    >The exact problem I was experiencing was if an e-mail had a password protected Office 2003 document attached, the Microsoft Exchange Search Indexer didn't index the e-mail body or subject. This caused missing OWA and Outlook (in Online Mode) search results.
    >
    >This is now confirmed to be a bug in Exchange 2007 that won't be fixed. It was recommended we upgrade to Exchange 2010 or better.
     
    I'm not sure I'd agree that it's a bug. If the file is password
    protected and it can't be opened (so its contents can be indexed) that
    sounds like the correct processing. OTOH, if a password protected file
    can be opened without knowing the password, THAT would be a bug --
    and a security breach!
     
    ---
    Rich Matheisen
    MCSE+I, Exchange MVP
     

    --- Rich Matheisen MCSE+I, Exchange MVP
    Monday, May 27, 2013 9:28 PM