Score:1

I stumbled upon a strange issue where a Exchange Shared mailbox continued moving emails from Inbox to Recoverable Items folder

us flag

we have shared mailbox with full access for many people and someone deleted all items in this shared.

I run the command

Search-MailboxAuditLog -identity BelovedCustomersMailbox -LogonTypes Delegate,Owner -ShowDetails

That gives me no result related to the Soft Delete. No error.

It's Exchange Server 2013. On shared mailbox Audit logging has been enabled.

I checked everywhere including:

  • mailbox settings in Exchange Server admin portal
  • Exchange transport rules
  • Exchange Shared Mailbox Inbox Rules - --- Get-InboxRule -IncludeHidden
  • No any retention policy
  • get-calendarprocessing ---->>> automateprocessing : AutoUpdate

Still with no evidence.


Are there any logs about MoveToDeletedItems? Yes There are 3 records.

Do you added the -Mailbox sharedmailbox when using Get-Inboxrule?

yes

what if you recover these items to the inbox, will them be deleted after a while? No , after recovering items , no any action

Score:1
tr flag

Are there any logs about MoveToDeletedItems? Please also use Get-Mailbox SharedMailbox | FL *Audit* to check what actions could be recorded.

Do you added the -Mailbox sharedmailbox when using Get-Inboxrule?

And what if you recover these items to the inbox, will them be deleted after a while?

You could try repairing the mailbox with New-MailboxRepairRequest.

Sorry that I was meant to add a comment, but it said that the point should be 50 to do so.

us flag
thanks btw I have updated my question
Louisl avatar
tr flag
Thanks for the update. What's the result of Get-Mailbox SharedMailbox | FL *Audit* ? Will the SoftDelete enabled for both owner and delegate?
us flag
AuditDelegate : {Move, MoveToDeletedItems, SoftDelete, HardDelete} AuditOwner : {Move, MoveToDeletedItems, SoftDelete, HardDelete}
Louisl avatar
tr flag
Please also add admin to check if someone delete these items with EMS: Search-MailboxAuditLog -identity BelovedCustomersMailbox -LogonTypes Delegate,Owner,admin -ShowDetails I tried using EMS to delete these items with Search-Mailbox -DeleteContent, and the LogonType is admin.
mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.