Microsoft Knowledge Base Archive

Important This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows Registry

↑ Back to the top

Summary

If you use Microsoft Office Outlook in Cached Exchange Mode, the Offline Address Book is used for common address book operations, such as name lookups or browsing the Global Address List. In Outlook in Cached Exchange Mode, more users use the Offline Address Book compared to users who use earlier versions of Microsoft Outlook.

The full set of .oab files is the single largest file that is downloaded from the Microsoft Exchange server apart from the synchronization of your mailbox. Excessive downloading of the full .oab files can occur in Outlook because of known conditions or because of conditions that are unique to an organizations' deployment.

Microsoft Office has client-side logging for the full .oab file download available. The client-side logging provides information that you can use to determine whether the full .oab file download was expected (in the specific context), or whether it occurred because of a problem (known or unknown) in either Microsoft Outlook or Microsoft Exchange. If the full .oab file download occurred because of an unknown problem in Outlook or Exchange, the client-side logging information might be useful in the determination of a possible resolution.

Note The client-side logging information will not tell you how to resolve the problem. The client-side logging information will tell you the general cause for the full .oab file download. You may have to perform additional advanced troubleshooting or open a support case with Microsoft Product Support Services to find a resolution to the problem.

↑ Back to the top

INTRODUCTION

This article describes the Offline Address Book log details in Microsoft Office Outlook. Offline Address Book log details can be obtained for both Outlook client-side and Exchange server-side.

This article discusses the following topics:

Application Event ID 27
Analyzing Offline Address Book log entries
OAB sequence number
Server-side Address List Name
OAB GUID
Administration
Privacy issues

↑ Back to the top

Application Event ID 27

By default, Outlook always generates an application event whenever Microsoft Outlook performs a full .oab file download from the Microsoft Exchange server. If you have the OAB logging feature enabled (the default setting), Outlook uses the application event log to track full .oab file downloads. To identify the Offline Address Book downloads, look for items with the following criteria in the application event log:

Event Source: Outlook
Event ID: 27

Event Type:
Description:

Depending on the type of application event, the information that is in the Event Type line will be error messages, warnings, or information. The following sequence of events is an example of the descriptions that might appear in the Description line for this application event in the application event log (in chronological order):

Error Event ID 27 event with a description that is similar to "OAB ModDif failed. (Details record in event data)." or "OAB (Offline Address Book) files are invalid. Replaced with stub. (Last errors in event data)."
Information Event ID 27 with a description of "Starting OAB Download." This kind of application event contains most of the information for the download cause, and it is the most important application event. This application event signals the beginning of a full .oab file download by Outlook.
Information Event ID 27 with a description of "OAB Download Succeeded." This application event signals a successful full .oab file download by Outlook.

Note If the full .oab file download failed, a warning Event ID 27 with a description of "OAB Download Failed" appears instead of "OAB Download Succeeded."

back to top

↑ Back to the top

Analyzing Offline Address Book log entries

You can analyze the application event log file information by using the following techniques:

Sort the log by Event ID line.
Locate events with the following criteria:
Event ID: 27

Source: Outlook
If the first Event 27 is an "error" type application event, you can expect that the next Event 27 will be an "information" application event. This informs you that a full .oab file download will be started.
Open the Event 27 whose description starts with the following text:
"Starting OAB download (See event data)"
Note You do not have to have an "error" type application event in to trigger a full .oab file download. For example, if you manually force a full .oab file download, the first Event 27 in the application event log will be the "Information" Event 27 (with a description that contains the "Starting OAB download …" description).

After you have identified the application event that triggered the full .oab file download, you can use the data from the "information" Event 27 to determine the cause of the full .oab file download.

The following sample data is from an application event log entry where Outlook downloaded the Offline Address Book because the user started Outlook for the first time in Cached Exchange Mode:


0000: 01 00 00 00 00 00 00 00   ........
0008: 00 00 00 00 75 00 00 00   ....u...
0010: 75 00 00 00 00 00 00 00   u.......
0018: 00 00 00 00 00 00 00 00   ........
0020: e9 fd 00 00 02 a3 48 9b   éý...£H?
0028: ba 12 c4 01 00 00 00 00   º.Ä.....
0030: 00 00 00 00 00 00 00 00   ........
0038: 00 00 00 00 00 00 00 00   ........
0040: 00 00 00 00 00 00 00 00   ........
0048: 00 00 00 00 00 00 00 00   ........
0050: 00 00 00 00 00 00 00 00   ........
0058: 00 00 00 00 00 00 00 00   ........
0060: 00 00 00 00 00 00 00 00   ........
0068: 00 00 00 00 00 00 00 00   ........
0070: 00 00 00 00 00 00 00 00   ........
0078: 00 00 00 00 00 00 00 00   ........
0080: 00 00 00 00 00 00 00 00   ........
0088: 00 00 00 00 00 00 00 00   ........
0090: 5c 00 47 00 6c 00 6f 00   \.G.l.o.
0098: 62 00 61 00 6c 00 20 00   b.a.l. .
00a0: 41 00 64 00 64 00 72 00   A.d.d.r.
00a8: 65 00 73 00 73 00 20 00   e.s.s. .
00b0: 4c 00 69 00 73 00 74 00   L.i.s.t.
00b8: 00 00 00 00 65 38 31 30   ....e810
00c0: 35 35 61 38 2d 62 64 38   55a8-bd8
00c8: 38 2d 34 33 34 62 2d 39   8-434b-9
00d0: 37 31 37 2d 64 34 33 37   717-d437
00d8: 61 62 34 35 31 35 36 39   ab451569
00e0: 00 65 38 31 30 35 35 61   .e81055a
00e8: 38 2d 62 64 38 38 2d 34   8-bd88-4
00f0: 33 34 62 2d 39 37 31 37   34b-9717
00f8: 2d 64 34 33 37 61 62 34   -d437ab4
0100: 35 31 35 36 39 00         51569

In any Offline Address Book application event entry, the first byte of data contains the error code in hexadecimal. It is the error code that tells you the cause of the full .oab file download. The following data is extracted from the complete data set from the previous application event log:


0000: 01 00 00 00 00 00 00 00   ........

In this sample data, the first byte is 01. To interpret the 01 code or another code in Offline Address Book application event logs, use the following table to make the correlation between the code number and the cause for the full .oab file download:

Result code	Description
1	You do not have any Offline Address Book files on your computer, or the Offline Address Book files could not be opened for some other reason.
2	You forced a full .oab file download manually.
3	The name of the Offline Address Book could not be obtained on the client. This behavior occurs when you create a new profile.
4	The GUID of the Offline Address Book could not be obtained on the client.
5	The name of the Offline Address Book was missing from the server. In this case, a full .oab file download is not expected to start or succeed, but it is logged anyway.
6	The GUID of the Offline Address Book was missing from the server. In this case, the full .oab file download is not expected to start or succeed, but it is logged anyway.
7	The server's Offline Address Book name and the client's Offline Address Book name are different.
8	The server's GUID and the client's GUID are different. This behavior can occur if the server had to regenerate a whole new Offline Address Book with the same name and then discarded the old set. Or, the client was moved between different forests.
9	The client's sequence number is bigger than the server.
0a (10)	You want detailed information in the Offline Address Book, but there is no detailed .oab file on your client. This behavior may occur if you manually force a download of the Offline Address Book, and then you click to clear the Download changes since last Send/Receive check box.
0b (11)	At least one .diff file was missing from the server.
0c (12)	The sum total of the .diff files to download may not be greater than 1/8 of the full .oab file.
0d (13)	You have the Allow SRS Full OAB Download registry key set to 1, and your Send/Receive setting was set to always do a full download.
0e (14)	You do not have the locale of the Offline Address Book installed on your system, and you did a manual full .oab file download. Typically, Outlook updates the address book either once a month, when a conditions hits for such users, or when you download manually. Outlook uses these three methods to update the address book to avoid a condition that would cause a full download every day.
0f (15)	Applying the .diff file to the .oab file failed for some reason. Sometimes, Event #4 is triggered in this situation.

The following list contains three other pieces of information that you can gather from the application event log data:

the OAB sequence number
the server-side address list name that is being used to populate the Offline Address List
the GUID for the full .oab file download

You can use error values to determine why an 0f error occurred. To do this, follow these steps:

Locate Event ID 27 in the Application Event Log with Starting OAB Download (see event data). in the Description: section.
Locate the reason codes in the Description: section of the event that may contain some or all the following asserts:
- 0050: 7a 65 61 7a 61 74 61 7a zeazataz
- 0058: 70 69 61 7a 7a 65 61 7a piazzeaz
- 0060: 61 74 61 7a 70 69 61 7a atazpiaz
Interpret these reason codes by using the following:
- "zaez" is an assert for "signature mismatch."
- "zata" is an assert for MAPI_E_UNEXPECTED_ID.
- "zaip" means "HrApplyOABDiffs failed. Must download full."
Depending on the data in the event log, you might need to install the Exchange hotfix that is mentioned in the following Microsoft Knowledge Base article:
895476 Outlook may receive a full download instead of an incremental download when Outlook downloads the offline address book in Exchange Server 2003

back to top

↑ Back to the top

OAB sequence number

Both Outlook and Exchange use the OAB sequence number to determine the collection of the .oab files from the server to download to the client. Depending on the sequence number that is found on the client and on the cumulative size of the .diff files, either a differential download or a full download of the Offline Address Book occurs. You can verify the sequence numbers by using the following data.

Client application event log

Starting at offset 0008, you can see that the OAB sequence numbers for the client and the server (in hexadecimal). Offset 0008 is the second line in the following log example:


0000: 09 00 00 00 00 00 00 00   ........
0008: 9b 00 00 00 9a 00 00 00   ........

The client sequence number is that is contained in the first four bytes (9b in this example) and the server sequence number is in the second four bytes (9a in this example).

In the previous sample data, the client's sequence number is bigger than the server's sequence number, and the generated Offline Address Book error code is 9 (this is obtained from the first byte at offset 0000).

back to top

↑ Back to the top

Server-side Address List Name

In the scenario where the client and the server Offline Address Book (address list) names are mismatched or missing, a full .oab file download will occur. The generated Offline Address Book error code is 3, 5, or 7. You can verify the Offline Address Book (address list) name by using the following data.

Client application event log

Starting at offset 0090 in the following event log example, you can see the name of the server-side address list used to populate the Offline Address List on the server. Additionally, the name that is stored client-side can be found starting at offset 00b8.


0090: 5c 00 47 00 6c 00 6f 00   \.G.l.o.
0098: 62 00 61 00 6c 00 20 00   b.a.l. .
00a0: 41 00 64 00 64 00 72 00   A.d.d.r.
00a8: 65 00 73 00 73 00 20 00   e.s.s. .
00b0: 4c 00 69 00 73 00 74 00   L.i.s.t.
00b8: 00 00 5c 00 47 00 6c 00   .\.G.l.
00c0: 6f 00 62 00 61 00 6c 00    o.b.a.l.
00c8: 20 00 41 00 64 00 64 00   .A.d.d.
00d0: 72 00 65 00 73 00 73 00   r.e.s.s.
00d8: 20 00 4c 00 69 00 73 00   .L.i.s.
00e0: 74 00 00 00 38 62 32 61   t...e810

In this sample data, the default Global Address List is being used for the Offline Address List. To confirm this is the correct address list, follow these steps in Exchange System Manager:

Locate the name of the Offline Address List for your mailbox store on the General tab in the Properties dialog box for the store.
Expand the Offline Address Lists container, and then right-click the Offline Address List to view the properties.
On the General tab, note the list of address lists that are under Address Lists.

back to top

↑ Back to the top

OAB GUID

Both the Exchange server and Outlook use a matching GUID to make sure that they stay synchronized. In the scenario where the client and the server OAB GUIDs are mismatched or missing, a full .oab file download will occur. The generated Offline Address Book error code is 4, 6, or 8. You can verify the OAB GUID using the following data.

Client application event log

The GUIDs can be found in the Offline Address Book log data starting at offset 00b8.Offset 00b8 is the first line in the following log example:


00b8: 00 00 00 00 65 38 31 30   ....e810
00c0: 35 35 61 38 2d 62 64 38   55a8-bd8
00c8: 38 2d 34 33 34 62 2d 39   8-434b-9
00d0: 37 31 37 2d 64 34 33 37   717-d437
00d8: 61 62 34 35 31 35 36 39   ab451569
00e0: 00 65 38 31 30 35 35 61   .e81055a
00e8: 38 2d 62 64 38 38 2d 34   8-bd88-4
00f0: 33 34 62 2d 39 37 31 37   34b-9717
00f8: 2d 64 34 33 37 61 62 34   -d437ab4
0100: 35 31 35 36 39 00            51569

The first GUID is for the server and the second GUID (starting at offset 00e0) is for the client.back to top

↑ Back to the top

Administration

Warning If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

The following system policy (registry key) can be used to turn off the OAB logging feature if it is not required:

HKEY_CURRENT_USER\Software\Policies\Microsoft\Exchange\Exchange Provider

Setting	Value
Registry Value	DisableLogging
Registry Type	REG_DWORD
Registry Data	1: Disable the OAB logging feature 0: (default) If not present or set to 0, Outlook will generate Offline Address Book logs

If you have both the OAB logging feature and the Allow Full OAB prompt registry key enabled, Outlook will still create the Offline Address Book log entries, even if you click No to the prompt to download the full Offline Address Book.

For more information about the "Allow Full OAB prompt" registry key, click the following article number to view the article in the Microsoft Knowledge Base:

841273 Administering the Offline Address Book in Outlook 2003

back to top

↑ Back to the top

Privacy issues

The Offline Address Book ModDif failed event contains the complete .diff record that caused a failure. The ModDif event failure occurs when Outlook encounters a failure when it tries to apply a .diff to a file. The details of the .diff record are output to the event data. The ModDif event data might contain phone numbers, e-mail addresses, proxy addresses, and aliases for a particular user. Therefore, you must take this under consideration before you share this data or upload this data to Microsoft Product Support Services.

back to top

↑ Back to the top

Article ID	:	843483
Revision	:	2
Created on	:	5/20/2019
Published on	:	5/20/2019
Exists online	:	False
Views	:	223

Microsoft KB Archive Search

Description of Offline Address Book logging in Outlook

Summary

INTRODUCTION

Application Event ID 27

Analyzing Offline Address Book log entries

OAB sequence number

Client application event log

Server-side Address List Name

Client application event log

OAB GUID

Client application event log

Administration

Privacy issues

Applies to: