Solved

Exchange 2007 Mailbox - Emails just disappear from inbox..

Posted on 2013-12-10
10
345 Views
Last Modified: 2014-03-13
So I get a ticket that a user quit on 12/4 and they want me to archive / preserve all her emails.. I give myself full mailbox access and take a look.. There are zero items in ANY folders..

So, I try to go into Tools > Recover deleted items and nothing shows.. That makes no sense to me..

So I look at the server and the database is set to keep for 14 days and her mailbox is set to use that..

I changed her delivery options to forward to another user AND to deliver to her mailbox.. I send a test email and I do get the email forwarded to the other mailbox, however, nothing in her mailbox..

So I uncheck that box and test again.. This time I get it?? So I check her recover deleted items again and there is a whole ton of email..

I recover it all, over 400 INBOX items.. It recovers zero sent items or any other folders.. WTF??

So here is the strangest part.. As I'm sitting there thinking why no sent items were recovered etc.. I start to see her inbox count go down.. Emails were just being deleted! There was nothing in deleted items or sent items when this happens.. They are just gone! Poof!!

She has no rules or no views setup.. WTF can this be!?

Thanks!!

Running Exchange 2007.. Emails get deleted whether I'm in Outlook or not (OWA same thing happens)..
0
Comment
Question by:TBIRD2340
  • 4
  • 2
  • 2
  • +2
10 Comments
 
LVL 11

Expert Comment

by:BillBondo
ID: 39709716
Are they auto archiving?
0
 
LVL 1

Author Comment

by:TBIRD2340
ID: 39709722
Nope.
0
 
LVL 11

Expert Comment

by:BillBondo
ID: 39709729
Try check, un-check cached mode?
0
 
LVL 22

Expert Comment

by:Nick Rhode
ID: 39709743
Reset the users password and log into OWA?
0
 
LVL 1

Author Comment

by:TBIRD2340
ID: 39709753
Cached mode cant' be checked by policy (runs on terminal server).

Already reset password.

Same thing happens even if Outlook is closed.. I can have OWA open and refresh and watch the item count go down.
0
Top 6 Sources for Identifying Threat Actor TTPs

Understanding your enemy is essential. These six sources will help you identify the most popular threat actor tactics, techniques, and procedures (TTPs).

 
LVL 1

Author Comment

by:TBIRD2340
ID: 39709760
Take that back.. I just changed her password again (this time using a harder one than P@ssword1) and I don't see it going away..

Now my major issue is why is there nothing in the sent items being recovered?
0
 
LVL 10

Expert Comment

by:Vijaya Babu Sekar
ID: 39710510
if you are deleted the mail. you can try to custom message view from outlook. it should work.


Thanks.
0
 
LVL 63

Accepted Solution

by:
Simon Butler (Sembee) earned 500 total points
ID: 39711236
Have you changed the user's password? This is classic POP access, possibly from a phone. Change the user's password to begin with, then attempt to login will not only lock out the account but also be blocked. Then when you can see the external address accessing the email, report it to HR.

Simon.
0
 
LVL 1

Author Comment

by:TBIRD2340
ID: 39711241
I've changed the password.. The emails are not disappearing from the inbox anymore..

The main issue I have is that there are no deleting items being recovered from the recover deleted items option.
0
 
LVL 63

Expert Comment

by:Simon Butler (Sembee)
ID: 39717353
If the user was on POP3 there are probably no sent items to recover.

Simon.
0

Featured Post

Are your corporate email signatures appalling?

Is it scary how unprofessional your email signatures look? Do users create their own terrible designs and give themselves stupid job titles? You can make this a lot easier for yourself by choosing an email signature management solution from Exclaimer today.

Join & Write a Comment

Disabling the Directory Sync Service Account in Office 365 will stop directory synchronization from working.
Marketers need statistics and metrics like everybody else needs oxygen. In this article we explain how to enable marketing campaign statistics for Microsoft Exchange mail.
In this video we show how to create a Distribution Group in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >>…
In this video we show how to create an Accepted Domain in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Mail Flow >> Ac…

746 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now