troubleshooting Question

Hidden or Corrupted inbox rule on office 365! Is that possible?

Avatar of Farnam Shadmani
Farnam Shadmani asked on
ExchangeMicrosoft 365
3 Comments2 Solutions3116 ViewsLast Modified:
Hi All,

I am having some strange issues with one of our users.
Every time  User (A) receives an invite, 4 other users (Bs) receive her invites too.  3 of whom have already separated from the company, and don't haven any account on our server anymore.

We use office 365, Online Exchange plans. Here is what I've already looked at:

- Check for any inbox rule and delegates via Online Dashboard - There was none
- Checked for delegation on Calendar and Inbox via powershell, found exact 4 other users (B) delegated to user A inbox.
- Remove all 4 user Bs.  
- Check for delegation again, and there is none.

And still invites are being forwarded to other 4 user Bs.

- Checked for Inbox rules via sower-shell, and there is none.

Looking at the header of invite there seems to be some sort of inbox rules taking place, but we can't find it anywhere.

Invite' email header:
***************
Received: from Cy2134897123.namprd04.prod.outlook.com (11.167.9.11) by
 BN76491027.namprd04.prod.outlook.com (11.167.2.11) with Microsoft SMTP
 Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id
 18.1.97.12 via Mailbox Transport; Thu, 16 Mar 2017 20:55:15 +0000
Received: from CY1872391238.namprd04.prod.outlook.com (11.172.136.132) by
 CY12397128737.namprd04.prod.outlook.com (11.167.9.11) with Microsoft SMTP
 Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id
 11.1.91.17; Thu, 16 Mar 2017 20:55:13 +0000
Received: from CY12387912.namprd04.prod.outlook.com ([127.0.0.1]) by
 Cy12398761238.namprd04.prod.outlook.com ([1.172.136.15]) with Microsoft
 SMTP Server id 15.01.47.020; Thu, 16 Mar 2017 20:55:13 +0000
From: Me <me@company.com>
To: USER_B1
      <IMCEAEX-_o=ExchangeLabs_ou=Exchange+20Administrative+20Group+20+28FYDIBOHF23SPDLT+29_cn=Recipients_cn=COMPANY+2Eonmicrosoft+2Ecom-55785-megan+2Egarcia+40COMPANT+2Ecom207@namprd04.prod.outlook.com>,
      USER_B2
      <IMCEAEX-_o=ExchangeLabs_ou=Exchange+20Administrative+20Group+20+28FYDIBOHF23SPDLT+29_cn=Recipients_cn=7d53ac1abc9d4681a1af16af2dc1385d-bekah+2Einder@namprd04.prod.outlook.com>,
      USER_B3
      <IMCEAEX-_o=ExchangeLabs_ou=Exchange+20Administrative+20Group+20+28FYDIBOHF23SPDLT+29_cn=Recipients_cn=COMPANY+2Eonmicrosoft+2Ecom-55785-tara+2Emcnabb+40COMPANY+2Ecom792@namprd04.prod.outlook.com>,
      USER_B4 <USER_B3@COMPANY.com>
Subject: Test 2
Thread-Topic: Test 2
Thread-Index: AdKel5phP3XMVD0KqVKe2MIWJ3dg==
Date: Thu, 16 Mar 2017 13:55:12 -0700
Message-ID: <940624492c9f4ca79eac031904d122c1@CY4PR04MB0614.namprd04.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Exchange-Organization-AuthAs: Internal
X-MS-Exchange-Organization-AuthMechanism: 04
X-MS-Exchange-Organization-AuthSource: DM2PR0401MB1086.namprd04.prod.outlook.com
X-MS-Has-Attach:
X-Auto-Response-Suppress: All
X-MS-Exchange-Organization-Network-Message-Id: 56df91d8-b401-4b5a-9704-08d46caebe0c
X-MS-Exchange-Organization-SCL: -1
X-MS-Exchange-Inbox-Rules-Loop: USER_A@COMPANY.com
X-MS-Exchange-Inbox-Rules-Loop: USER_B4@COMPANY.com

X-MS-TNEF-Correlator:
x-originating-ip: [12.245.61.98]
authentication-results: COMPANY.com; dkim=none (message not signed)
 header.d=none;COMPANY.com; dmarc=none action=none
 header.from=COMPANY.com;
auto-submitted: auto-generated
x-forefront-antispam-report: SFV:SKI;SFS:;DIR:INB;SFP:;SCL:-1;SYRH:BN6PR04MB0613;H:DM2PR0401MB1086.namprd04.prod.outlook.com;FPR:;SPF:None;LANG:en;SFV:SKI;SFS:;DIR:INB;SFP:;SCL:-1;SRVR:CY1PR04B2283;H:CY4PR4MB0614.namprd04.prod.outlook.com;FPR:;SPF:None;LANG:en;;SKIP:1;
X-Microsoft-Exchange-Diagnostics: 1;BN3PR04MB2273;27:AjdhrSIDBHzWglfFY7wp8EuEjx0atHy6Ip5ZfPaW/Zi8+FhJ3dCqayUmUlb2cBdFzMNlcF/PC31m1lVMypwwzAFkrld80OchmWY7gYu2VRCr10wSZu3zpd8lJbZ3cHCxTs75rlUe4GeUBrzPuFQ==
Content-Type: multipart/alternativ
      boundary="_000_940624492c9f4ca79031904d122c1CY4PR04MB0614namprd04pr_"
MIME-Version: 1
********************

What else should I look into? Any thoughts?
ASKER CERTIFIED SOLUTION
Join our community to see this answer!
Unlock 2 Answers and 3 Comments.
Start Free Trial
Learn from the best

Network and collaborate with thousands of CTOs, CISOs, and IT Pros rooting for you and your success.

Andrew Hancock - VMware vExpert
See if this solution works for you by signing up for a 7 day free trial.
Unlock 2 Answers and 3 Comments.
Try for 7 days

”The time we save is the biggest benefit of E-E to our team. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange.

-Mike Kapnisakis, Warner Bros