Why Experts Exchange?

Experts Exchange always has the answer, or at the least points me in the correct direction! It is like having another employee that is extremely experienced.

Jim Murphy
Programmer at Smart IT Solutions

When asked, what has been your best career decision?

Deciding to stick with EE.

Mohamed Asif
Technical Department Head

Being involved with EE helped me to grow personally and professionally.

Carl Webster
CTP, Sr Infrastructure Consultant
Ask ANY Question

Connect with Certified Experts to gain insight and support on specific technology challenges including:

Troubleshooting
Research
Professional Opinions
Ask a Question
Did You Know?

We've partnered with two important charities to provide clean water and computer science education to those who need it most. READ MORE

troubleshooting Question

Hidden or Corrupted inbox rule on office 365! Is that possible?

Avatar of Farnam Shadmani
Farnam Shadmani asked on
ExchangeMicrosoft 365
3 Comments1 Solution3114 ViewsLast Modified:
Hi All,

I am having some strange issues with one of our users.
Every time  User (A) receives an invite, 4 other users (Bs) receive her invites too.  3 of whom have already separated from the company, and don't haven any account on our server anymore.

We use office 365, Online Exchange plans. Here is what I've already looked at:

- Check for any inbox rule and delegates via Online Dashboard - There was none
- Checked for delegation on Calendar and Inbox via powershell, found exact 4 other users (B) delegated to user A inbox.
- Remove all 4 user Bs.  
- Check for delegation again, and there is none.

And still invites are being forwarded to other 4 user Bs.

- Checked for Inbox rules via sower-shell, and there is none.

Looking at the header of invite there seems to be some sort of inbox rules taking place, but we can't find it anywhere.

Invite' email header:
***************
Received: from Cy2134897123.namprd04.prod.outlook.com (11.167.9.11) by
 BN76491027.namprd04.prod.outlook.com (11.167.2.11) with Microsoft SMTP
 Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id
 18.1.97.12 via Mailbox Transport; Thu, 16 Mar 2017 20:55:15 +0000
Received: from CY1872391238.namprd04.prod.outlook.com (11.172.136.132) by
 CY12397128737.namprd04.prod.outlook.com (11.167.9.11) with Microsoft SMTP
 Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id
 11.1.91.17; Thu, 16 Mar 2017 20:55:13 +0000
Received: from CY12387912.namprd04.prod.outlook.com ([127.0.0.1]) by
 Cy12398761238.namprd04.prod.outlook.com ([1.172.136.15]) with Microsoft
 SMTP Server id 15.01.47.020; Thu, 16 Mar 2017 20:55:13 +0000
From: Me <me@company.com>
To: USER_B1
      <IMCEAEX-_o=ExchangeLabs_ou=Exchange+20Administrative+20Group+20+28FYDIBOHF23SPDLT+29_cn=Recipients_cn=COMPANY+2Eonmicrosoft+2Ecom-55785-megan+2Egarcia+40COMPANT+2Ecom207@namprd04.prod.outlook.com>,
      USER_B2
      <IMCEAEX-_o=ExchangeLabs_ou=Exchange+20Administrative+20Group+20+28FYDIBOHF23SPDLT+29_cn=Recipients_cn=7d53ac1abc9d4681a1af16af2dc1385d-bekah+2Einder@namprd04.prod.outlook.com>,
      USER_B3
      <IMCEAEX-_o=ExchangeLabs_ou=Exchange+20Administrative+20Group+20+28FYDIBOHF23SPDLT+29_cn=Recipients_cn=COMPANY+2Eonmicrosoft+2Ecom-55785-tara+2Emcnabb+40COMPANY+2Ecom792@namprd04.prod.outlook.com>,
      USER_B4 <USER_B3@COMPANY.com>
Subject: Test 2
Thread-Topic: Test 2
Thread-Index: AdKel5phP3XMVD0KqVKe2MIWJ3dg==
Date: Thu, 16 Mar 2017 13:55:12 -0700
Message-ID: <940624492c9f4ca79eac031904d122c1@CY4PR04MB0614.namprd04.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Exchange-Organization-AuthAs: Internal
X-MS-Exchange-Organization-AuthMechanism: 04
X-MS-Exchange-Organization-AuthSource: DM2PR0401MB1086.namprd04.prod.outlook.com
X-MS-Has-Attach:
X-Auto-Response-Suppress: All
X-MS-Exchange-Organization-Network-Message-Id: 56df91d8-b401-4b5a-9704-08d46caebe0c
X-MS-Exchange-Organization-SCL: -1
X-MS-Exchange-Inbox-Rules-Loop: USER_A@COMPANY.com
X-MS-Exchange-Inbox-Rules-Loop: USER_B4@COMPANY.com

X-MS-TNEF-Correlator:
x-originating-ip: [12.245.61.98]
authentication-results: COMPANY.com; dkim=none (message not signed)
 header.d=none;COMPANY.com; dmarc=none action=none
 header.from=COMPANY.com;
auto-submitted: auto-generated
x-forefront-antispam-report: SFV:SKI;SFS:;DIR:INB;SFP:;SCL:-1;SYRH:BN6PR04MB0613;H:DM2PR0401MB1086.namprd04.prod.outlook.com;FPR:;SPF:None;LANG:en;SFV:SKI;SFS:;DIR:INB;SFP:;SCL:-1;SRVR:CY1PR04B2283;H:CY4PR4MB0614.namprd04.prod.outlook.com;FPR:;SPF:None;LANG:en;;SKIP:1;
X-Microsoft-Exchange-Diagnostics: 1;BN3PR04MB2273;27:AjdhrSIDBHzWglfFY7wp8EuEjx0atHy6Ip5ZfPaW/Zi8+FhJ3dCqayUmUlb2cBdFzMNlcF/PC31m1lVMypwwzAFkrld80OchmWY7gYu2VRCr10wSZu3zpd8lJbZ3cHCxTs75rlUe4GeUBrzPuFQ==
Content-Type: multipart/alternativ
      boundary="_000_940624492c9f4ca79031904d122c1CY4PR04MB0614namprd04pr_"
MIME-Version: 1
********************

What else should I look into? Any thoughts?