Re: OWA distorted

I have added the domain users, users, Authenticated Users in the securit
list for the Exchsvr folder. It hasn't worked. I will try to go do the same
on the bin folder if that will help in any way.

This issue is becoming a bit frustrated but i'll keep looking and Googling



"Lee Derbyshire [MVP]" <email a@t leederbyshire d.0.t c.0.m> wrote in
message news:OvxTqWhrJHA.1208@xxxxxxxxxxxxxxxxxxxxxxx
You're still getting a 401;3 which means (as we already discussed) 'Denied
due to ACL'. So again, we're looking for NTFS permissions on something.
OWA 2003 is a bit tricky in this respect, since all the output is produced
by an ISAPI application, namely DAVEX.DLL. So, I would look at the folder
that contains it (Exchsrvr/bin, think), and again make sure that your
Users group is able to Read and Execute files in it.

"MSExchangeStudent" <exchangestudent@xxxxxxxxxxxxxx> wrote in message
news:upjjpGerJHA.1208@xxxxxxxxxxxxxxxxxxxxxxx
When i log in with my account it is fine 100%. When using a normal domain
admin account it keeps on giving me the username and password box and
after certain amount of attemps it says "Access denied". The username i'm
using for reference purposes is "domainuser" as you can see in the logs
below. Any advise on how i can resolve this issue please?

2009-03-26 07:00:32 W3SVC1 192.168.150.105 GET /exchange - 80 -
192.168.150.160
Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0;+GTB5;+InfoPath.1;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.4506.2152;+.NET+CLR+3.5.30729)
401 2 2148074254
2009-03-26 07:00:32 W3SVC1 192.168.150.105 GET /exchange - 80 -
192.168.150.160
Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0;+GTB5;+InfoPath.1;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.4506.2152;+.NET+CLR+3.5.30729)
401 1 0
2009-03-26 07:00:32 W3SVC1 192.168.150.105 GET /exchange - 80
cttourism\domainuser 192.168.150.160
Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0;+GTB5;+InfoPath.1;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.4506.2152;+.NET+CLR+3.5.30729)
401 3 5
2009-03-26 07:00:41 W3SVC1 192.168.150.105 GET /exchange - 80 -
192.168.150.160
Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0;+GTB5;+InfoPath.1;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.4506.2152;+.NET+CLR+3.5.30729)
401 1 0
2009-03-26 07:00:41 W3SVC1 192.168.150.105 GET /exchange - 80
cttourism\domainuser 192.168.150.160
Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0;+GTB5;+InfoPath.1;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.4506.2152;+.NET+CLR+3.5.30729)
401 3 5
2009-03-26 07:00:47 W3SVC1 192.168.150.105 GET /exchange - 80 -
192.168.150.160
Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0;+GTB5;+InfoPath.1;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.4506.2152;+.NET+CLR+3.5.30729)
401 1 0
2009-03-26 07:00:47 W3SVC1 192.168.150.105 GET /exchange - 80
CTTOURISM\domainuser 192.168.150.160
Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0;+GTB5;+InfoPath.1;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.4506.2152;+.NET+CLR+3.5.30729)
401 3 5
2009-03-26 07:00:57 W3SVC1 192.168.150.105 GET /exchange - 80 -
192.168.150.160
Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0;+GTB5;+InfoPath.1;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.4506.2152;+.NET+CLR+3.5.30729)
401 1 0
2009-03-26 07:00:57 W3SVC1 192.168.150.105 GET /exchange - 80
CTTOURISM\domainuser 192.168.150.160
Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0;+GTB5;+InfoPath.1;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.4506.2152;+.NET+CLR+3.5.30729)
401 3 5
2009-03-26 07:01:19 W3SVC1 192.168.150.105 OPTIONS /exchange/lolly/ -
80 - 192.168.15.7 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1)
401 2 2148074254


"Lee Derbyshire [MVP]" <email a@t leederbyshire d.0.t c.0.m> wrote in
message news:eX$h$3UrJHA.3856@xxxxxxxxxxxxxxxxxxxxxxx
Again, you will need to look at your IIS logs for requests where the
response status does not begin with 2 or 3.

"MSExchangeStudent" <exchangestudent@xxxxxxxxxxxxxx> wrote in message
news:unRtrzTrJHA.5356@xxxxxxxxxxxxxxxxxxxxxxx
Argggghhhhh... a new problem to the scenario now

The user can only access OWA when they have Domain Admin rights on
either Firefox and IE. Any explanation and fix for this please?

Craig



"Lee Derbyshire [MVP]" <email a@t leederbyshire d.0.t c.0.m> wrote in
message news:%23zQmebIrJHA.6020@xxxxxxxxxxxxxxxxxxxxxxx
The trouble is - it will be difficult to see if it would have worked
if you hadn't changed the account used for Anonymous Access. The IUSR
account that was previously configured is a special account, and IIS
knows that it needs to randomly change its password, and synchronize
it with the value in IIS Manager. Now that you told it to use the
Admin account, you will find that OWA no longer works when you change
the password elsewhere, because IIS won't try to synchronize it any
more. The same will also apply (I think) even if you now go and put
the IUSR account back in, because you will now have to hand-type the
password, and I think that breaks the synchronization mechanism.

This might help, but I've never messed with that setting, so I never
personally had to fix it:
http://support.microsoft.com/default.aspx?scid=kb;en-us;297989#top


"MSExchangeStudent" <exchangestudent@xxxxxxxxxxxxxx> wrote in message
news:OGN60SIrJHA.3792@xxxxxxxxxxxxxxxxxxxxxxx
I'll then have to try the "Users" group and hope that is the default
on my servers also. I will add the group, see that it has the
neccessary groups and see if OWA still works

Thank you for all your time. If this doesn't work for some reason
should i just continue on this thread or open a new one?

Craig

"Lee Derbyshire [MVP]" <email a@t leederbyshire d.0.t c.0.m> wrote in
message news:Oqq5xOIrJHA.4460@xxxxxxxxxxxxxxxxxxxxxxx
Like I say - on mine (which is at default settings) it is 'Users'.
This group contains 'Domain Users', Authenticated Users', and the
special 'INTERACTIVE' user account.

"MSExchangeStudent" <exchangestudent@xxxxxxxxxxxxxx> wrote in
message news:OQRKq7HrJHA.3792@xxxxxxxxxxxxxxxxxxxxxxx
Ok, how do i know which group it is called on my server? Is it
maybe the domain users group? Users group? - is it the group where
all the domain users are in?


"Lee Derbyshire [MVP]" <email a@t leederbyshire d.0.t c.0.m> wrote
in message news:%23hOy6wHrJHA.724@xxxxxxxxxxxxxxxxxxxxxxx
You should add it if it isn't listed. On my server, the group is
called 'Users', and has the rights 'Read and Execute', 'List
Folder Contents', and 'Read'.


"MSExchangeStudent" <exchangestudent@xxxxxxxxxxxxxx> wrote in
message news:OjzwbuHrJHA.3608@xxxxxxxxxxxxxxxxxxxxxxx
If i go to the Security tab of that folder only the
"Administrators" and "System" are listed. Is this the permissions
you are reffering to? Where should i look for authenticated
users?


"Lee Derbyshire [MVP]" <email a@t leederbyshire d.0.t c.0.m>
wrote in message news:OvqCT%23GrJHA.3608@xxxxxxxxxxxxxxxxxxxxxxx
That's actually a rather insecure solution, but it will
certainly work. Your IIS logs show that IIS is returning a 401.3
(access denied by ACL) on lots of the supporting files. Have a
look at your exchweb folder in Explorer, and check the NTFS
permissions. They should allow the Authenticated Users group the
Read and Execute right. I suspect that at the moment, only your
Admin account can access these files.

"MSExchangeStudent" <exchangestudent@xxxxxxxxxxxxxx> wrote in
message news:u1YnG7FrJHA.1748@xxxxxxxxxxxxxxxxxxxxxxx
Wowwww, found the problem.

Change the account under directory security > Authentication
and Access control > Enable Annoymous access from the
IUSR_<srevername> to the domain admin account and OWA is
working!!!!!!!

I assume that is a temp solution - why isn't the IUSR account
working? Anyone that can help?



"Lee Derbyshire [MVP]" <email a@t leederbyshire d.0.t c.0.m>
wrote in message
news:%23ZlLEwBrJHA.5356@xxxxxxxxxxxxxxxxxxxxxxx
Most recent file in C:\Windows\System32\LogFiles\W3SVC1 . Or
\WINNT\ instead of \Windows\ on Win 2000 server.

"MSExchangeStudent" <exchangestudent@xxxxxxxxxxxxxx> wrote in
message news:OrlABM%23qJHA.3584@xxxxxxxxxxxxxxxxxxxxxxx
Where do i get the current IIS log?

I will post the entries yes, if i find the log

"Lee Derbyshire [MVP]" <email a@t leederbyshire d.0.t c.0.m>
wrote in message
news:%23JzHd%238qJHA.1236@xxxxxxxxxxxxxxxxxxxxxxx
Okay, well first thing I would check is to log into OWA (to
generate some new log entries), wait a few minutes (so that
IIS can flush its log entries to disk), and then open the
current IIS log file. Post for us the new entries generated
by your login. Note that the times in the log file are in
GMT.

"MSExchangeStudent" <exchangestudent@xxxxxxxxxxxxxx> wrote
in message news:ugcUmz8qJHA.4980@xxxxxxxxxxxxxxxxxxxxxxx
Lee

I only have 1 exchange 2003 server in my environment

The old (exchange ) server i formatted. There were
exchange on. I didn't uninstall exchange. Now if i go to
the new (current) server it still shows 2 servers under
Admin groups. Thought i just mention this to you. Dont
think it should have an affect as OWA worked all the time
since 3 days ago.


"Lee Derbyshire [MVP]" <email a@t leederbyshire d.0.t
c.0.m> wrote in message
news:%23Kotsg8qJHA.5052@xxxxxxxxxxxxxxxxxxxxxxx
If you get the 'loading' message, some of this might help:
http://support.microsoft.com/kb/910119

"MSExchangeStudent" <exchangestudent@xxxxxxxxxxxxxx> wrote
in message news:eDSW9Z8qJHA.3864@xxxxxxxxxxxxxxxxxxxxxxx
This is how someone else discribed his situation which is
the same as mine

"By distorted I mean the page does not display correctly
and missing alot of links. Plus it seems to get stuck
loading... "


"Lee Derbyshire [MVP]" <email a@t leederbyshire d.0.t
c.0.m> wrote in message
news:ecE4DN7qJHA.1304@xxxxxxxxxxxxxxxxxxxxxxx
Well, if you email it to me, I can put it on my own
site. You should be able to work out my address. I
hope.


"MSExchangeStudent" <exchangestudent@xxxxxxxxxxxxxx>
wrote in message
news:uEMbsv3qJHA.3648@xxxxxxxxxxxxxxxxxxxxxxx
Hi

I tried photobucket but the site does not want to
respond - you know of any other sites that i can use?
Tried to upload it to the NG but it is too big

Craig

"Lee Derbyshire [MVP]" <email a@t leederbyshire d.0.t
c.0.m> wrote in message
news:uogbgV0qJHA.3792@xxxxxxxxxxxxxxxxxxxxxxx
Can you post an image somewhere, maybe on one of those
file sharing web sites? It's just that I'm pretty
sure we've never heard of anything like this before,
and I'm finding it hard to understand just what
'distorted' means in this context.

Lee.


"MSExchangeStudent" <exchangestudent@xxxxxxxxxxxxxx>
wrote in message
news:OqJWItRqJHA.824@xxxxxxxxxxxxxxxxxxxxxxx
Sometimes you see the folder names - sometimes not -
depends how distorted the page is


"Lee Derbyshire [MVP]" <email a@t leederbyshire d.0.t
c.0.m> wrote in message
news:%23bHrGRLqJHA.3840@xxxxxxxxxxxxxxxxxxxxxxx
"MSExchangeStudent" <exchangestudent@xxxxxxxxxxxxxx>
wrote in message
news:%231KcsXHqJHA.1168@xxxxxxxxxxxxxxxxxxxxxxx
Hi all

Since yesterday when logging into OWA the screens
are so distorted you cant read anything or the
pages doesn't even open or the dont load the whole
page. We can access the internet. I have rebooted
but with no luck. Why does this happen?

Exch 2003 SP 2

You can't read anything at all? Not even the folder
names?

Lee.

--
_______________________________________

Outlook Web Access for PDA, OWA For WAP:
www.leederbyshire.com
________________________________________















































.

Relevant Pages

  • Re: OWA distorted
    ... securit list for the Exchsvr folder. ... The user can only access OWA when they have Domain Admin rights ... worked if you hadn't changed the account used for Anonymous ... This group contains 'Domain Users', ...
    (microsoft.public.exchange.admin)
  • Re: Setting Audit Permissions Differently for Each User
    ... Same as with any other account, via one of a few ways; ... Authenticated Users removed from Users (I routinely remove ... was member of Users (or Domain Users), or if you defined a group ... In order to effect control over what is allowed ...
    (microsoft.public.windows.server.security)
  • Re: OWA distorted
    ... group contains 'Domain Users', Authenticated Users', and the special ... 'INTERACTIVE' user account. ... domain users group? ...
    (microsoft.public.exchange.admin)
  • Re: Domain Users v. Authenticated Users
    ... Domain Users are all users in an Active Directory domain. ... Authenticated Users is a builtin local group representing anything that has ... System account could install software at startup without a logged on user. ...
    (microsoft.public.win2000.general)
  • Re: Specific folder permission only?
    ... Create a domain user account and configure security groups instead of using the default ones. ... Also do not use the domain guest group or the guest account. ... guests have the same permissions as the domain users. ... permissions and folder rights that the Domain Users group has or the ...
    (microsoft.public.windows.server.active_directory)