Mass Deletion of Emails
Looking for some assistance here. I called MS about this issue, and was told I need root cause analysis which is an extraordinary amount of money that I simply cannot afford.
It was brought to my attention that several days of email had disappeared from the Big Bosses mailbox. Upon review I was able to locate the missing messages in Recover Deleted Items in Outlook 2007. Initially I thought it was due to a missed click or some other user error, but the same problem has reoccurred.
The call to Microsoft was a giant waste of time, there is no way to read exchange logs, which I am very surprised about, and auditing the mailbox will only provide access logging. How can I track the deletion of messages?
We are using Exchange 2003 SP2
Clients include;
Outlook 2007 (2 to 3 instances at a time)
Entourage 2008 (up to 2 instances)
Blackberry (via BES server)
Ipad (via active sync)
If I can provide further information pls let me know
It was brought to my attention that several days of email had disappeared from the Big Bosses mailbox. Upon review I was able to locate the missing messages in Recover Deleted Items in Outlook 2007. Initially I thought it was due to a missed click or some other user error, but the same problem has reoccurred.
The call to Microsoft was a giant waste of time, there is no way to read exchange logs, which I am very surprised about, and auditing the mailbox will only provide access logging. How can I track the deletion of messages?
We are using Exchange 2003 SP2
Clients include;
Outlook 2007 (2 to 3 instances at a time)
Entourage 2008 (up to 2 instances)
Blackberry (via BES server)
Ipad (via active sync)
If I can provide further information pls let me know
priyaexch
Does this issue happen for only you Boss's mailbox? what mobile client does he use in addition to using outlook? (activesync based or blackberry)
the user could delete it using the Blackberry, you should enable the windows security log and then look for event
563
563
are the messages being recovered from the recovery bin of the Inbox
if so, then I would look at a possible POP configuration
easiest way to stop POP is to change the password
i would also look for rules or auto-archive that is moving messages to PST
if so, then I would look at a possible POP configuration
easiest way to stop POP is to change the password
i would also look for rules or auto-archive that is moving messages to PST
Like the other guys have said, the most common reason would likely be user error. I would check his Blackberry to make sure the Email Reconciliation isn't set to delete on Mailbox & Handheld. He could be doing a "delete prior" on his BB's inbox which is tossing all of his Outlook/Exchange stuff.
Are you using Cached Mode in Outlook?
It could be a local profile issue too...maybe try creating him a new profile in Outlook as see if it happens again.
Does he have any Delegates or anyone in AD that has full control over his mailbox? It could be another user in there cleaning house. I know the big-wigs like to use Delegates to their secretaries and stuff. The Delegates can be assigned via Outlook in the Tools>Options>Delegates tab, and is also set in AD under Exchange General > Delivery Options. Check his Active Directory account Security / Exchange Advanced tabs (Mailbox Rights), and check the permissions to see who all is able to access his mailbox too.
Another thing I would point the finger at is an oversized PST. I know people like to claim that PST sizes are supported up to 20Gb or whatever, but from my experience, anything over 1-2Gb is dangerous territory and Outlook will suffer from weird errors and events while the large PST is attached. If there's a large PST, I would disconnect it or split it into smaller PSTs by year.
If you're an Exchange admin, I suppose it wouldn't hurt to delete his mailbox (aka disconnect it) from his AD account, then reconnect it in ESM. Sometimes this can resolve issues that you can't track down...
And like the above mentioned, Rules are another culprit. On his machine, close Outlook, then run a CMD and type:
"C:\Program Files\Microsoft Office\Office12\outlook.ex
or
"C:\Program Files\Microsoft Office\Office12\outlook.ex
Have you checked the Junk Mail settings? That could be an issue as well.
Are you using Cached Mode in Outlook?
It could be a local profile issue too...maybe try creating him a new profile in Outlook as see if it happens again.
Does he have any Delegates or anyone in AD that has full control over his mailbox? It could be another user in there cleaning house. I know the big-wigs like to use Delegates to their secretaries and stuff. The Delegates can be assigned via Outlook in the Tools>Options>Delegates tab, and is also set in AD under Exchange General > Delivery Options. Check his Active Directory account Security / Exchange Advanced tabs (Mailbox Rights), and check the permissions to see who all is able to access his mailbox too.
Another thing I would point the finger at is an oversized PST. I know people like to claim that PST sizes are supported up to 20Gb or whatever, but from my experience, anything over 1-2Gb is dangerous territory and Outlook will suffer from weird errors and events while the large PST is attached. If there's a large PST, I would disconnect it or split it into smaller PSTs by year.
If you're an Exchange admin, I suppose it wouldn't hurt to delete his mailbox (aka disconnect it) from his AD account, then reconnect it in ESM. Sometimes this can resolve issues that you can't track down...
And like the above mentioned, Rules are another culprit. On his machine, close Outlook, then run a CMD and type:
"C:\Program Files\Microsoft Office\Office12\outlook.ex
or
"C:\Program Files\Microsoft Office\Office12\outlook.ex
Have you checked the Junk Mail settings? That could be an issue as well.
ASKER
Clients include Outlook 2007, Entourage 2008, BB via BES, and Ipad via active sync
Outlook is a not cached
I suspect the issue occurs when the Entourage 2008 database is rebuilt. I am looking to collect evidence of this, only thing I have to go on is timing.
The issue isn't particular to subject, virus status, or junk filters, the last occurence was 6 whole days of email, we are talkin thousands of messages.
Is there a way to read Exchange log files?
Outlook is a not cached
I suspect the issue occurs when the Entourage 2008 database is rebuilt. I am looking to collect evidence of this, only thing I have to go on is timing.
The issue isn't particular to subject, virus status, or junk filters, the last occurence was 6 whole days of email, we are talkin thousands of messages.
Is there a way to read Exchange log files?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
No working solution found