Mass Deletion of Emails

Looking for some assistance here. I called MS about this issue, and was told I need root cause analysis which is an extraordinary amount of money that I simply cannot afford.

It was brought to my attention that several days of email had disappeared from the Big Bosses mailbox. Upon review I was able to locate the missing messages in Recover Deleted Items in Outlook 2007. Initially I thought it was due to a missed click or some other user error, but the same problem has reoccurred.

The call to Microsoft was a giant waste of time, there is no way to read exchange logs, which I am very surprised about, and auditing the mailbox will only provide access logging. How can I track the deletion of messages?

We are using Exchange 2003 SP2
Clients include;
Outlook 2007 (2 to 3 instances at a time)
Entourage 2008 (up to 2 instances)
Blackberry (via BES server)
Ipad (via active sync)

If I can provide further information pls let me know
RCroninAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

priyaexchCommented:
Does this issue happen for only you Boss's mailbox? what mobile client does he use in addition to using outlook? (activesync based or blackberry)
nsonbatyManager IT Service DeskCommented:
the user could delete it using the Blackberry, you should enable the windows security log and then look for event
563
endital1097Commented:
are the messages being recovered from the recovery bin of the Inbox
if so, then I would look at a possible POP configuration
easiest way to stop POP is to change the password

i would also look for rules or auto-archive that is moving messages to PST
Your Guide to Achieving IT Business Success

The IT Service Excellence Tool Kit has best practices to keep your clients happy and business booming. Inside, you’ll find everything you need to increase client satisfaction and retention, become more competitive, and increase your overall success.

RackballCommented:
Like the other guys have said, the most common reason would likely be user error.  I would check his Blackberry to make sure the Email Reconciliation isn't set to delete on Mailbox & Handheld.  He could be doing a "delete prior" on his BB's inbox which is tossing all of his Outlook/Exchange stuff.

Are you using Cached Mode in Outlook?  
It could be a local profile issue too...maybe try creating him a new profile in Outlook as see if it happens again.

Does he have any Delegates or anyone in AD that has full control over his mailbox?  It could be another user in there cleaning house.  I know the big-wigs like to use Delegates to their secretaries and stuff.  The Delegates can be assigned via Outlook in the Tools>Options>Delegates tab, and is also set in AD under Exchange General > Delivery Options.  Check his Active Directory account Security / Exchange Advanced tabs (Mailbox Rights), and check the permissions to see who all is able to access his mailbox too.  

Another thing I would point the finger at is an oversized PST.  I know people like to claim that PST sizes are supported up to 20Gb or whatever, but from my experience, anything over 1-2Gb is dangerous territory and Outlook will suffer from weird errors and events while the large PST is attached.  If there's a large PST, I would disconnect it or split it into smaller PSTs by year.

If you're an Exchange admin, I suppose it wouldn't hurt to delete his mailbox (aka disconnect it) from his AD account, then reconnect it in ESM.  Sometimes this can resolve issues that you can't track down...

And like the above mentioned, Rules are another culprit.  On his machine, close Outlook, then run a CMD and type:
"C:\Program Files\Microsoft Office\Office12\outlook.exe" / safe
or
"C:\Program Files\Microsoft Office\Office12\outlook.exe" / cleanrules /

Have you checked the Junk Mail settings?  That could be an issue as well.
RCroninAuthor Commented:
Clients include Outlook 2007, Entourage 2008, BB via BES, and Ipad via active sync

Outlook is a not cached

I suspect the issue occurs when the Entourage 2008 database is rebuilt. I am looking to collect evidence of this, only thing I have to go on is timing.

The issue isn't particular to subject, virus status, or junk filters, the last occurence was 6 whole days of email, we are talkin thousands of messages.

Is there a way to read Exchange log files?
RCroninAuthor Commented:
No help going forward I guess..... /sigh

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
RCroninAuthor Commented:
No working solution found
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Exchange

From novice to tech pro — start learning today.