[MacTUG] Message duplication in Exchange related to Outlook 2011 and SEP

[Trevor Bain]

I thought I would pass along this thread from the Windows Higher-Ed list. Although the Microsoft KB article identifies an issue with McAfee, Cornell indicates that they have seen similar issues with SEP. The workaround is to exclude the following directories from scanning:

/Users/<username>/Documents/Microsoft User Data/Office 2011 Identities
/Users/<username>/Library/Caches/Outlook
/Users/<username>/Library/Caches/TemporaryItems/Outlook Temp

Trevor

--
Trevor Bain, IST
University of Waterloo
519-888-4567 x33738
etbain at uwaterloo.ca<mailto:etbain at uwaterloo.ca>
--



From: windows-hied-bounces at mailman.stanford.edu [mailto:windows-hied-bounces at mailman.stanford.edu] On Behalf Of Todd Olson
Sent: Monday, August 27, 2012 5:36 PM
To: windows-hied at mailman.stanford.edu
Subject: Re: [windows-hied]: Message duplication in Exchange related to Outlook 2011 and SEP

Hi

I'm Rick's colleague who has been tasked with dealing with this issue at Cornell.
Microsoft called our attention to:
http://support.microsoft.com/kb/2740145

Microsoft states that Outlook 2011 will not heal itself after AV (or whatever is disabled).
They state the only way out is to create a new Identity for Outlook 2011.
No recipe is currently available for moving local data from the old Identity to the new one.

As for a fix ... my reading is the best we will see is Outlook 2011 behaving less badly when damaged
by 3rd party software.  I believe a large part of the solution is getting AV and data discovery software
vendors to configure to not do the damage in the first place.

Note also it is possible there may be related issues in Apple Mail.app.  These are suspected
but unconfirmed.  We continue to investigate.

Regards,
Todd Olson
Cornell University.

On 2012-Aug-27, at 16:21, Paul Wehner wrote:


Have had a few instances of this. No idea why it was occurring.
For support staff that have to deal with this I've asked them to disable local email av that may be running and then run ODIR against the mailbox to remove duplicates.
Glad to see it's acknowledged and a fix is supposedly coming in September.



From: windows-hied-bounces at mailman.stanford.edu<mailto:windows-hied-bounces at mailman.stanford.edu> [mailto:windows-hied-bounces at mailman.stanford.edu]<mailto:[mailto:windows-hied-bounces at mailman.stanford.edu]> On Behalf Of Rick Cochran
Sent: Monday, August 27, 2012 3:38 PM
To: windows-hied at mailman.stanford.edu<mailto:windows-hied at mailman.stanford.edu>
Subject: [windows-hied]: Message duplication in Exchange related to Outlook 2011 and SEP

Here is a slightly edited notice we have recently sent to our Exchange users.  We are wondering if others have experienced this phenomenon.  If so, what kind of diagnostic and remediation measures are you using?

-Rick


-------- Original Message --------
As noted on August 22, an issue with Outlook 2011 (Mac) duplicating messages, leading to serious usability problems, has been reported at Cornell and confirmed by Microsoft. All versions of Outlook 2011 (Mac) on all supported Mac OS versions are affected.

Microsoft indicates that it will release a fix for this issue in September.

One step IT staff (or users) can take now is to reinstall Symantec Endpoint Protection (SEP) on any Mac where Outlook 2011 is being used. This newly updated installer excludes certain Outlook 2011 paths from SEP's Auto-Protect function. Please note that doing a full scan or manual scan with SEP can still trigger the issue.

Download SEP for Mac:
[URL removed]

Although only 10 cases of this issue have been reported at Cornell so far, the effects can be severe. The duplicate messages in these cases caused the users' 7-GB quotas to be exceeded, preventing their use of email. Our understanding is that this issue could affect any Outlook 2011 user at any point, so being proactive is a good investment of time.

We are continuing to work with Microsoft to understand the best process for cleaning up Outlook 2011 mailboxes that have already been affected by the issue. We hope to have that documentation available early the week of August 27.

Recap of the issue: Microsoft states that a primary known cause is anti-virus software interacting with Outlook 2011. That includes SEP, which is site-licensed at Cornell. When Outlook 2011 creates a local cache of a message, it creates a note to that effect. Apparently anti-virus software (and potentially other types of software) can make these notes disappear. Outlook 2011 will then upload the message back to the Exchange server, resulting in duplicate messages and extremely poor performance. Note that Microsoft has also seen the problem without anti-virus software present on the system.



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.uwaterloo.ca/pipermail/mactug/attachments/20120828/3d0676f0/attachment-0001.html>