3 Replies Latest reply on Feb 14, 2011 3:01 PM by Kary Tankink

    HIPS Firewall causing Outlook 2007 lockups

    epo_user_00

      HIPS 7.0.0.1159

      ePO 4.0

      Windows XP SP3

      MS Office 2007 Professional Plus Edition SP2

      Exchange 2003

       

      We have been running the HIPS firewall (managed by ePO) in Adaptive mode with few problems.  When we change the HIPS firewall policy to Regular Protection, a select number of machines start experiencing MS Outlook crashes.  When it is set back to Adaptive mode the crashes stop.

       

      The HIPS firewall Activity Log shows no traffic being blocked that would relate to Outlook.

       

      The Windows application log logs Event ID 1000, with "Microsoft Office 12" as the Source.  The text of the error in the log is: "Faulting application outlook.exe, version 12.0.6550.5003, stamp 4d10fbc4, faulting module emsmdb32.dll, version 12.0.6550.5000, stamp 4ce820dd, debug? 0, fault address 0x00051fd9"  No further information is available.  Researching this error so far has not brought much helpful info.

       

      Some machines have this issue, other machines that are virtually identical in hardware/software/configuration just hum happily along.

       

      Please help me troubleshoot.

        • 1. Re: HIPS Firewall causing Outlook 2007 lockups
          Kary Tankink
          The HIPS firewall Activity Log shows no traffic being blocked that would relate to Outlook.

          Not all required (blocked) traffic is tied to a specific application.  From the Activity log, the blocked traffic may not have any application associated with it, which means it's SYSTEM-based traffic (meaning a firewall rule will be needed to allow the traffic and you cannot associate it to a specific application; the application column will need to be left blank).

           

          1. Does disabling the Firewall resolve this issue?
          2. Add a firewall Allow all rule to the top of the policy.  Does this resolve the issue?
          3. If so, then you'll need to parse the Host IPS Client UI Activity Log and look for any blocked traffic (remote IP address of an Exchange server, or something) needed by Outlook (look through all traffic; not just that associated with Outlook.exe).
          • 2. Re: HIPS Firewall causing Outlook 2007 lockups
            epo_user_00

            First of all, it is so cool to be able to post a question and get an actual response so fast.  Unheard of in the tech support community.  I'm starting to like this board.

             

            Setting the firewall to Adaptive mode is all that's required to make the crashes stop.  You don't even have to disable it.  And I should be clearer--the HIPS firewall activity log doesn't show any traffic being blocked at all, other than some of the normal broadcast stuff that happens all day every day.

             

            Thanks

            • 3. Re: HIPS Firewall causing Outlook 2007 lockups
              Kary Tankink

              I would suggest opening a McAfee Service Request for further investigation.  That does seem quite odd.