ms-office

What are "Microsoft Office Protocol Discovery" and "OfficeLiveConnector" and why do they access invalid URLs?


I monitor 404s on my sites closely which helps me detect broken links and hacking attempts but I've recently been getting log spam from browsers with these strings in the User Agent. They seem to be trying to scan parent directories of valid resources but directories have special meaning to my sites due to SEO rewriting.

Before I decide what to do about it I'd like to know what these UAs are trying to do and why. If it's just "noise" I'd be happy to drop the connection entirely otherwise if they do something useful I could provide an appropriate response.

I believe some of the requests are from my clients so I can't do anything too disruptive, as much as I'd like to.


Solution

  • Microsoft has a kb article (link currently broken, Internet Archive snapshot) that covers Protocol Discovery in fine detail. Essentially, Office is trying to determine if your server supports WebDAV (or something like it) so that changes the user makes to the Office document can be pushed back directly to the server.