Error message when an Outlook Web Access user tries to access a mailbox in Exchange Server 2003: �HTTP 400 Bad Request (Request header too long)�

A Microsoft Office Outlook Web Access for Exchange Server 2003 user tries to access a mailbox on a computer that is running Microsoft Exchange Server 2003. When this occurs, the user receives an error message that resembles the following error message:

This issue may occur when the Outlook Web Access user is a member of many Microsoft Windows user groups. For example, the issue occurs when the user is a member of over a hundred Windows user groups.

Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall the operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.

To resolve this issue, you must configure three registry entries on the following computers:

• The front-end Exchange Server 2003-based computer that provides Outlook Web Access access
• The back-end Exchange Server 2003-based computer that hosts the mailbox

For Microsoft Internet Information Services (IIS) 5.0 (Microsoft Windows 2000), the MaxClientRequestBuffer entry is found under the following registry subkey. Configure it as shown in the following table.For IIS 6.0 (Microsoft Windows Server 2003), the MaxFieldLength entry and the MaxRequestBytes entry are found under the following registry subkey. Configure them as shown in the following table.

The MaxClientRequestBuffer registry entry

The data that is limited by MaxClientRequestBuffer (the response line and headers) consists of all data from the first byte of the request through the last byte before the entity body. This includes the method, the URL, any additional path information, the query string, the HTTP version, all the headers, and the characters that delimit all parts of the request. In other words, this includes all data that is not part of the body of the request.

Because IIS 5.0 reads the blocks of the request data into buffers, the limit that is set by MaxClientRequestBuffer is not very precise. Therefore, after you use MaxClientRequestBuffer, you may have to test to verify that the actual limit on the size of the client request and of the header fields is what you expect.

You may want to use the POST method instead of the GET method to send lots of data in the request. GET requests use the URL part of the request line to send information to IIS. However, the POST method sends the information in the body of the request.

The MaxFieldLength and the MaxRequestBytes registry entries

By default, the MaxFieldLength registry entry is not present. This registry entry specifies the maximum size limit of each HTTP request header. The MaxRequestBytes registry entry specifies the upper limit for the total size of the Request line and the headers. Typically, this registry entry is configured together with the MaxRequestBytes registry entry. If the MaxRequestBytes value is lower than the MaxFieldLength value, the MaxFieldLength value is adjusted.

In large environments, Outlook Web Access users may experience logon failures if the values for both these entries are not set to 32768. To enable users who are members of many Windows user groups to log on to Outlook Web Access, the MaxRequestBytes value must be configured to a larger value.

For more information about the MaxClientRequestBuffer registry entry, click the following article number to view the article in the Microsoft Knowledge Base: For more information about the MaxFieldLength registry entry, visit the following Microsoft Web site: