Windows Explored

I have been out of it for sometime now, often tied up with one thing or the other and have not been able to contribute recently. But here is a quicky on an often overlooked part of Process Monitor, specifically the basic logging it does for Network Activity.

In this particular case, when using the Insert Online Pictures option available in a new Outlook message, after selecting one of the categories in the initial image window, a series of grayed-out tiles are presented instead of the actual image preview tiles:

I fired up Process Monitor and reproduced the issue, filtering for processes only from Outlook.exe. While quickly scrolling through the events, I noticed a couple entries for Network Activity with an obvious clue as to what was blocking the image previews. I further isolated these events by removing activity for File, Registry, and Process Activity, keeping only Network:

You can see that after hitting the initial IP (52.109…) for what looks to be Office.com, a disconnect takes place with path from hit-adault.opendns.com, which is our firewall returning a false-positive for what it suspects to be adult content. To verify this was the case, I changed  Outlook to use a legacy proxy server (this is done via IE > Internet Options > Connection Settings) that we still keep around and was able to see the image preview tiles after performing the process again. The next course of action would be to modify the company firewall to allow the traffic.