email security plug-in error

[daniel.wheeler]

My organization just deployed Outlook 2016, and after downloading the latest version of the e-mail security plug-in, I get an error when I try to submit a message to Cisco as spam/phishing/etc. The first error that pops up is Attachment 1 (work order 2.png). I click "ok" and then get the second error, attachment 2 (work order.png).

I find the error odd, because when I look in the registry and control panel Outlook 2016 is set as the default mail client.

Any advice/suggestions?

[dmccabej]

Hello Daniel,

Which version of the plugin are you using and what steps did you use to deploy it? Are you seeing this error on all machines you performed the install on? Also, are you able to provide us with the diagnostic log? You can obtain this by running Cisco.EmailSecurity.Diagnostic.exe under C:\Program Files (x86)\Cisco\Cisco IronPort Email Security Plug-In\.

Thanks!

-Dennis M. 

[daniel.wheeler]

I'm using version 7.6

We only deploy it to a few admins, and both of us are getting the error.

Log attached

[dmccabej]

Hello Daniel,

Thanks for the info. How did you go about deploying the plugin? Installation steps/etc? 

After reviewing the logs, we can see some pretty interesting errors in the CiscoEmailSecurity.log file. 

I tried performing a search on our internal database but found no mention of the Redemption.IRDOSession.set_MAPIOBJECT error. On the same note, I did a quick Google search as well and found some topics regarding some sort of MAPI issues, which I'm not sure if it might be related.

Have you tried re-creating your Outlook profile? or possibly using different machines with different versions of Outlook for comparison?

Another option would be to remove/disable any additional Outlook plugins and only enable the Cisco Email Plugin, and then test.

Thanks!

-Dennis M.

+++

10/10/2016 11:12:36 AM -04 WARN [EmailSecurity.Framework.CoreUtils ] GetAssociatedAccountWithRDO: Received mail or mail.account is null.
10/10/2016 11:12:36 AM -04 WARN [EmailSecurity.Framework.CoreUtils ] GetAssociatedAccountWithRDO: It is impossible to get associated account by any known way. So taking the first Outlook account 'daniel.wheeler@******.***'.
10/10/2016 11:13:05 AM -04 ERROR [Reporting.MsOutlook.OutlookComponent ] OnDoWork: Error during reporting
System.Runtime.InteropServices.COMException (0x8000FFFF): Interface not supported
at Redemption.IRDOSession.set_MAPIOBJECT(Object Value)
at Cisco.EmailSecurity.Framework.MsOutlook.OutlookApplication.GetCurrentOutlookRdoSession()
at Cisco.EmailSecurity.Reporting.MsOutlook.SpamReporter.OnDoWork()

+++

[daniel.wheeler]

Dennis,

I uninstalled O 365 (2016) and re-installed Office 2010 and the plugin works, looks like the problem is with the installer files/this particular installation.

Now, I don't suppose you'd have any insight on using group policy to limit what users can see the plugin? I found this article, but there doesn't seem to be a corresponding registry value for the Cisco Email Security Plugin.

[dmccabej]

Hello Daniel,

Thanks for the update and I'm glad you were able to find a workaround.

To which pieces are you not wanting the user to 'see'? Certain buttons? Make changes? Etc? Etc? I do have some GPO experience but a lot of those types of things we can do by modifying the plugin installer files.

Thanks!

-Dennis M.

[daniel.wheeler]

I found it, apparently Cisco puts their plugins in a slightly different place than the author of that article was expecting:

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Outlook\Addins\Cisco.EmailSecurity.Framework.MSOutlook.Connect

I was trying to search the registry with keyword "Cisco" and had gone trhough about a hundred false positives when I realized I should probably search on "LoadBehavior" instead. So we got it nailed down so that plugin will only load if you're in an admin group.

Thanks again for your help.

[dmccabej]

Gotcha. Thanks for the info! :)

...and you're welcome! Have a great day!

-Dennis M.