Messageware AttachView 2007

[LEFT][CODE]http://www.msexchange.org/articles_tutorials/product-reviews/messageware-attachview-2007.html[/CODE]

[IMG]http://www.msexchange.org/img/upl/NWPhoto1184764110116.jpg[/IMG]
[B][B]Nathan Winters[/B][/B]

[B]Introduction[/B]

Messageware AttachView 2007 is a product which enhances the WebReady Document Viewing functionality introduced in Exchange 2007. For those who have not heard of the feature, WebReady Document Viewing allows Outlook Web Access (OWA) users to view attachments to emails in a web browser without downloading them to the client machine. There are various benefits to this including improved security as documents are never downloaded to client machines and also the fact that client machines don't need to have the application associated with the document installed.
So far this sounds great, however, there are a few issues with the feature as implemented in Exchange 2007. It is limited to a very small number of document types (basically office and pdfs), applying different settings to different users is not possible and the poor quality rendering of more complex documents often makes it hard to work with the attachments.
This is where AttachView can help and over the next few sections I will show you how.
[B]Prerequisites and Lab Setup[/B]

In order to test AttachView 2007 I set up my lab as follows as shown in [B]Figure 1[/B]:
[IMG]http://www.msexchange.org/img/upl/image004a1224529305250.JPG[/IMG]
[B]Figure 1: [/B]Lab Setup

[LIST][*] [B]Server 1[/B] - DC.gaots.co.uk - Windows Server 2008 Standard Edition - ADDS - ADCS[*] [B]Server 2[/B] - Exch-MHCU.gaots.co.uk - Windows Server 2008 Standard Edition - IIS7, PowerShell, .Net Framework 2 - Exchange 2007 SP1 Rollup 2 - Mailbox, Client Access and Hub Roles[*] [B]Client1[/B] (not domain member) - Client1.gaots.co.uk - Windows XP - IE7 and Firefox 2[*] [B]User1[/B] - Standard user[*] [B]PrivUser1[/B] - Management user with sensitive documents[/LIST]
So that is the lab setup, what about the specific requirements for AttachView? AttachView 2007 is installed on the Client Access server role and the Exchange Server must be running SP1 or later. It supports access from the same list of browsers as OWA and will work well in Premium and Light versions of OWA.
The only specific additional requirement is when installing AttachView on Windows Server 2008. In that case you will need to disable IPv6. This can be done as follows:

[LIST=1][*] Launch the Network Connections applet by running ncpa.cpl from Start\Run. [*]Open the properties of the LAN connection and Disable TCP\IPv6 and click OK as shown in [B]Figure 2.[/B][/LIST]
[B][IMG]http://www.msexchange.org/img/upl/image0041224529305250.jpg[/IMG]
Figure 2: [/B]IPv6 disabled in the LAN Connection

[LIST=1][*] Open the Registry editor and navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\ Add a new 32bit DWord called DisabledComponents with a value of 0xFF as shown in [B]Figure 3.[/B][/LIST]
[B][IMG]http://www.msexchange.org/img/upl/image0061224529305265.jpg[/IMG]
Figure 3: [/B]The new registry DWORD entry

[LIST=1][*] Restart the Computer.[/LIST]
It should be noted that this will likely be resolved in a future release of the product.
[B]Installation[/B]

The installation is simple enough and is well documented in the manual. It is possible to install using RDP so long as you access the console session. During the install the WWW Publishing service needs restarting as shown in [B]Figure 4, [/B]which means there will be at least a brief period of downtime for the server. On the positive side of things, the install does not require a reboot.
[IMG]http://www.msexchange.org/img/upl/image0081224529622703.jpg[/IMG]
[B]Figure 4: [/B]As part of install you are prompted to stop Web Services
Obviously if installing AttachView on a farm of OWA servers you need to ensure that it is available at the same time on all servers.
Permissions required for installation are those needed to add files to the OWA directories, and also the Exchange View Only Administrator role. Realistically the simplest option would be to use an Exchange Organisation Administrator account which will be a Local Administrator on the server and thus will have relevant permissions.
Overall, the install for a single server takes not more than 10 minutes. On completion of the install you are presented with the admin interface shown in [B]Figure 5.[/B]
[IMG]http://www.msexchange.org/img/upl/image0101224529622703.jpg[/IMG]
[B]Figure 5: [/B]The Global setting page
One of the first things I tried was accessing the help file. Unfortunately I was presented with the error shown in [B]Figure 6[/B].
[IMG]http://www.msexchange.org/img/upl/image0111224529622703.jpg[/IMG]
[B]Figure 6: [/B]Error Accessing help files
It turns out that this was because, in the current version (v1.6) of AttachView, the help files are a separate download. To install them follow the procedure below:

[LIST=1][*] Contact Messageware support to get the download link.[*] Extract the files to a temporary location. [*] Navigate to \Program Files\Messageware\AttachView. [*] Paste the [B]help[/B] folder into this path. [*] Launch the AttachView Management Console and click on the Help button to confirm accessibility. [/LIST]
It is important to note that this issue will be fixed in the next version of the software.
[B]Features[/B]

So, having completed the install what does the product do? Well, helpfully, it works with no further configuration! That is not to say nothing can be configured; there is plenty which can be done to tune things however, we will come to that later. First let's take a look at the features.
When opening an attachment with the traditional OWA before AttachView is installed we get the option for "Open as Web Page". This is the Microsoft WebReady Document Viewing feature as shown in [B]Figure 7.[/B]
[B][IMG]http://www.msexchange.org/img/upl/image0131224529668781.jpg[/IMG]
Figure 7: [/B]The Native OWA attachment view
Once AttachView is installed the user is presented with a new view, a pair of binoculars as shown in [B]Figure 8[/B], which when clicked opens the AttachView viewer.
[IMG]http://www.msexchange.org/img/upl/image0151224529668781.jpg[/IMG]
[B]Figure 8: [/B]The AttachView binoculars
Also seen in [B]Figure 8[/B], are the new options shown when clicking on an attachment. You can see that opening the item is not allowed by the Default Policy (more of which later) and that you can either open just a text view for fastest viewing of the file, or a full rich view with images. Clicking on the binoculars by defaults opens the attachment in Full view, shown in [B]Figure 9[/B], although this can be customized by the administrator.
[IMG]http://www.msexchange.org/img/upl/image0171224529668781.jpg[/IMG]
[B]Figure 9: [/B]The Full Viewer
The Full viewer is made up of several distinct sections. The left hand pane contains in the upper left the control panel, directly below that, the show/hide toggle button (usage shown in [B]Figure 13[/B]) and at the bottom the info pane giving index or property information. The main panel on the right contains the document.
Looking in more detail at the controls the first thing you notice is the index. This is pulled from the document as you can see from the Word example in [B]Figure 10.[/B] Another example is shown in [B]Figure 9[/B] with a PDF document. There you can see that it is simple to be able to zoom into a document, [B]Figure 11,[/B] and also to rotate it, shown in [B]Figure 12, [/B]which can be particularly useful when receiving image or Fax documents.
[IMG]http://www.msexchange.org/img/upl/image0191224529913656.jpg[/IMG]
[B]Figure 10: [/B]Viewing a Word Document with Index
[IMG]http://www.msexchange.org/img/upl/image0211224529913656.jpg[/IMG]
[B]Figure 11: [/B]The Zoom function
[IMG]http://www.msexchange.org/img/upl/image0231224529913671.jpg[/IMG]
[B]Figure 12: [/B]Rotating a document
[IMG]http://www.msexchange.org/img/upl/image0241224529913671.jpg[/IMG]
[B]Figure 13: [/B]Showing how the control panel can be minimised
The key feature of all of them is the fact that AttachView can support so many document types. Currently more than 300 file types are supported and as new file types become common they will likely be added. One example of this is it can even process password protected zip files. [B]Figure 14[/B] shows the user being prompted for a password and [B]Figure 15 [/B]and[B] Figure 16 [/B]both show the files within the Zip file and some of the properties information both about the file and about the files within.
[IMG]http://www.msexchange.org/img/upl/image0261224529959312.jpg[/IMG]
[B]Figure 14: [/B]Entering a password for a password protected zip file
[IMG]http://www.msexchange.org/img/upl/image0281224529959312.jpg[/IMG]
[B]Figure 15: [/B]Showing the properties of the zip file and the files inside it
[IMG]http://www.msexchange.org/img/upl/image0301224529959328.jpg[/IMG]
[B]Figure 16: [/B]Scrolling right shows more details of the files within the zip
Finally before moving on to look at some of the configuration options one more feature which could well be of use is the fact that the AttachView viewer is able to highlight document changes. This is important as it can prevent someone forwarding a word document in which track changes has been used without realising that the changes are still in the document. [B]Figure 17 [/B]shows the ability to view track changes information and [B]Figure 18[/B], is the view given when you click the "Final" button and shows the final version of the document.
[IMG]http://www.msexchange.org/img/upl/image0321224530286343.jpg[/IMG]
[B]Figure 17: [/B]Viewing track changes information in a Word document
[IMG]http://www.msexchange.org/img/upl/image0341224530286343.jpg[/IMG]
[B]Figure 18: [/B]The final version of the document without mark-up
[B]Configuration[/B]

Moving on to configuration, there are two major areas of configuration. Global options are fairly self explanatory and are nicely laid out. It is here that options such as Licensing, Config export (which can be used to ensure the same configuration on multiple servers), RSA, Logging, Cache, Feature override are configured. [B]Figure 19[/B] shows the bypass options where it is possible to specify users or groups who will not be given the use of AttachView. One minor irritation about the interface to add users and groups is that it does not call the familiar AD interface to allow you to view and search for users or groups.
[IMG]http://www.msexchange.org/img/upl/image0361224530286343.jpg[/IMG]
[B]Figure 19: [/B]The AttachView bypass options
[B]Figure 20[/B] shows the options to configure the AttachView server cache. AttachView makes use of the cache to prevent multiple repeated conversions of the same document (a form of single instance storage). This feature not only prevents load on the server but also speeds up document access. For extra security the cache can be encrypted.
[IMG]http://www.msexchange.org/img/upl/image0381224530286359.jpg[/IMG]
[B]Figure 20: [/B]The Cache configuration options
Although I was unable to test it, I was glad that it is possible to use AttachView with RSA security tokens as this could definitely be a show stopper for some deployments.
The second major area of configuration is Rules. Multiple different rules can be created and their application ordered so as to give very flexible control and to give different users different feature experiences. It is essential that for a user to receive the features of AttachView one of the rules must apply to them. By default only the Default Rule is enabled and it applies to everyone. It is this which we shall now look at. Shown in [B]Figure 21[/B] is the Criteria tab. It is here that you select who the rule applies to. There are many options including client IP ranges, lists of AD groups and users, corporate device ID located in browser user agent tag, host lists and OU/UPN suffix.
[IMG]http://www.msexchange.org/img/upl/image0401224530317593.jpg[/IMG]
[B]Figure 21: [/B]The default rule
[B]Figure 22[/B] shows the Client tab where you can set whether a user can save, print or open attachments. Preventing Printing is a particularly useful option when configured in a rule on external clients. It will therefore only allow printing within the organisation so documents cannot be left on an Internet cafe printer! You can also configure whether a user receives a warning on attempting to save the attachment. This is also where the default binocular function is configured.
[IMG]http://www.msexchange.org/img/upl/image0421224530317609.jpg[/IMG]
[B]Figure 22: [/B]The Client tab, showing the options to configure saving and printing
The File Properties tab gives the ability to add or remove certain file properties from those shown in the Properties section of the viewer. The Client Access tab gives a method of further locking down file access so only access by AttachView will work and manually entering URLs will not.
[B]Figure 23[/B] shows the File Access tab which permits detailed control over the attachment types which users can view. You can also use this tab to disable a users' ability to add attachments.
[IMG]http://www.msexchange.org/img/upl/image0441224530317609.jpg[/IMG]
[B]Figure 23: [/B]The File Access tab
The Ext Tuning tab gives you the ability to set up AttachView so as to be able to scale for use in high traffic environments by taking decisions about how to process different types of attachments. Finally, the File Handling Tab allows you to specify how files of certain types are handled. For example maximum file size can be set and certain file types can have AttachView features disabled entirely.
[B]Licensing[/B]

Before making my conclusions, it is only right to mention the licensing methods for the product. Generally, the product is licensed per CPU however for organizations with fewer than 100 employees, or for those using Small Business Server, special arrangements can be made.
[B]Conclusion[/B]

Having reviewed the features of AttachView and investigated it in a lab environment for a few days I have found that it generally achieves what it sets out to! The detail and simplicity of policy settings is good and the product certainly takes the WebReady viewing functionality of Exchange 2007 to a completely different level.
There are a couple of small niggles such as needing to add the help files manually and the fact that, when working with Active Directory groups, you must specify the name of the group without being able to search for it. I also found that the opening of the view window could take a little time however, only a few seconds and, given the test lab based on virtual machines, it is very likely that performance would be a great deal improved on physical hardware

[/LEFT]