We help IT Professionals succeed at work.

disappearing email outlook 2010

YMartin asked
One of our customers is complaining that email is disappearing. On one occassion he claims that an email that was sent to him was never received. I checked message tracking on Exchange and was able to verify that Exchange Received and delivered that particular email. A few day later he read an email only to have it disappear when he closed it.

No one else has complained so we think that it is on the cllient side. I haven't seen his Outlook, (we are at different sites) but another tech walked him thru checking the settings on his Outlook and it seems clean. The customer uses at various time a ThinkPad laptop, iPhone, iPad and Mac Laptop to access his email.

Any suggestions?
Watch Question


That sort of symptom can occur if one of these mail clients (iPhone, iPad or Mac laptop) is misconfigured. If ont of these clients is configured as a POP or IMAP client then it can remove e-mails from server at each synchronization.

Another case is a bad outlook mail rule that moves the e-mails in another folder.

Have a good day

To add to what was stated above.....

have the user check the following:

 - junk folder
 - trash
 - have EU delete mail rules (if needed as can always recreate them)
 - login to webmail and see if you see the email there

If possible, partner with person, etc that is sending the email that is 'disappearing' - have them copy you on the email to  - this way there are no doubts in what your EU is trying to locate

Hope this helps


Any EMS experts tuned in?
I enabled auditlog on the user's mailbox a few days ago. Now when I try to extract the report I get nothing. this is the command that I'm using to extract the report:
New-MailboxAuditLogSearch  -Mailboxes "User"  -LogonTypes Admin,Delegate -StartDate 12/5/2011 -EndDate 12/8/2011 -StatusMailRecipients "administrator@domain.com"
It takes about 10-20 minutes to get the email. When I open the XML attachment it only has:
<?xml version="1.0" encoding="utf-8"?>
<SearchResults />
No data! How do I get a report? It seems that "StatusMailRecipients" is a required parameter so I can't even run it for a day and have it display in the shell.


There are too many sender involved to have EU ask them to copy the admin. So, I created a shared mailbox and in the delivery options of the user's mailbox have all mail being forwarded to the shared mailbox as well as copied to his. That should provide us with the needed comparisons.

Thanks, Do you know of any way to identify which of the devices is the one causing the problem?


Is there a way to see which devices a user is using to access their mailbox (i.e. iPad, iPhone, etc) in EMC or EMS?
I believe by default there is no option to determine which device user is using to access the mails but there may be some third party tools for it. But we can determine that we service is used by client to access his mails like owa, RPC or active sync you can get the details by simply run this power shell CMD:-
Get-LogonStatistics -Identity Itsupport | fl

Open in new window

hope this will be helpful for you.


Thanks, that gave me something to play with. After running it, I started to play with it a little ran it for an admin assistant and another exec to have references to compare the results - and then googled the command. From what I gather on varous blog, this command was more helpful in earlier versions of exchange - now the ClientMode is always valued with "ExchangeServer", ClientName is the name of the exchagne server and the ClientIPAddress is always blank.
Every logon by the admin assistant , ApplicationId is showing up with values:
Client=WebServices;UserAgent=Microsoft Office/14.0 (Windows NT 6.1; Microsoft Outlook 14.0.6112; Pro), Client=MSExchangeRPC and Client=CI.
The exec both have ApplicationId with Client=CI and Client=MSExchangeRPC;COW=Delegate.

I couldn't find what the "Client=MSExchangeRPC", "Client=CI" and "Client=MSExchangeRPC;COW=Delegate" values actually mean. Any idea?
Madan SharmaConsultant

"Client=MSExchangeRPC" this refers to exchange RPC service ( Outlook anywhere)
Client=CI  this refeers to client which client is connected like outlook /active sync etc


Seems like Exchange stores a lot of data, most of which is unreadable or useless. (I'm growing obsessed on finding out what COW stands for.) But I imagin that if I ran the same query for the Admin assistant that is delegated to access his mailbox , wrote them both to txt or CSV files then cut and pasted - that I'd eventually be able to link the aa to that access..
But if I can refer back to the originaly question. One of the guys who pays the bill around here wasn't receiving emails. I found entries in Exchange Server indicating the email being received by exchange and delivered to the user. He never deletes anything in his email and doesn't use spam filters. Any idea what could have happened and how to prove it?