ActiveSync - Mapping a Collection ID to a Mailbox Folder
Whenever you troubleshoot an ActiveSync issue, the logs do not provide the actual folder name that is being processed. Instead you will see CollectionID in the ActiveSync mailbox log and Fid in the IIS logs.
DeviceType=WindowsMail&Cmd=Ping&Log=V141_HH:e15mbx1.contoso.local%3a444_SmtpAdrs:jmartin%40contoso.com_NMS1_Fc6_Fid:3_Fid:5_Fid:12_Fid:19_Fid:1_Fid:2 |
In most cases you will not capture the initial FolderSync request that includes the response where these folders are added to the device. This FolderSync response will provide the name of the folder and corresponding CollectionId value.
So how do you determine which folder the device is attempting a request against if all you have is a numeric ID. The answer is using a tool like MfcMapi to open the mailbox and locate these hidden folders. The following steps show how to use MfcMapi to accomplish this task:
1. Open MfcMapi
2. Go to the Session menu and Logon to the Outlook profile for the mailbox
3. Double-click on the mailbox to open (should be the email address of the mailbox
4. Expand the Root Container and ExchangeSyncData
5. Here you will find a list of associated ActiveSync devices for this mailbox. Expand the device experiencing the issue and you will see containers for each CollectionId
6. Select the CollectionId number you identified in the ActiveSync log (The CollectionID of 2 will be used in this example) and highlight the property 0x7C030102
7. Go to the Property menu, select Selected property, and select Open as entry ID or object
8. Modify the selected value by removing the first and last bytes. Example: 2E00000000757F911EB748EA45B7F28E4A640430C601006209883B90F0E246B480218E131EAA1E000000000010000003
9. The folder associated with the ID should open and in this example it is the Contacts folder
Now when you troubleshoot and ActiveSync issue can begin searching/parsing the logs for a specific CollectionID value which should improve your efficiency. It is also important to note that when you are parsing the IIS logs the request includes the type of folder being synchronized. Most mailboxes only have a single Calendar and Contacts folder which would allow you to use this type element to quickly determine the CollectionId/Fid value. Here is an example where Fid:2 is of type Contacts:
Cmd=Sync&DeviceId=203AF68169FE&DeviceType=WP8&Log=V141_HH:e15mbx1.contoso.local%3a444_SmtpAdrs:jmartin%40contoso.com_NMS1_Fc6_Fid:2_Ty:Co_Filt3_St:S_Sk:84349403 |
Update 12/4/2013 - Glen wrote a Powershell script using the EWS API to retrieve this information for all devices associated with a mailbox. Check out his blog to download the script and get this information even quicker.
Comments
Anonymous
July 03, 2013
very helpful, thanks!Anonymous
December 15, 2013
Pingback from Under The Hood: Exchange ActiveSync Mailbox Log Analysis | Office 365 Singapore for Business - Win-ProAnonymous
January 03, 2014
Note: Part 2 of this series can be found here . One of best troubleshooting tools for Exchange ActiveSyncAnonymous
December 16, 2014
Exchange ActiveSync (EAS) mailbox logs are protocol-level logs that show the traffic between ExchangeAnonymous
October 12, 2015
Wonderful Blog Jim, Thanks a lot for sharing these useful information