Hi All,
I am having some strange issues with one of our users.
Every time User (A) receives an invite, 4 other users (Bs) receive her invites too. 3 of whom have already separated from the company, and don't haven any account on our server anymore.
We use office 365, Online Exchange plans. Here is what I've already looked at:
- Check for any inbox rule and delegates via Online Dashboard - There was none
- Checked for delegation on Calendar and Inbox via powershell, found exact 4 other users (B) delegated to user A inbox.
- Remove all 4 user Bs.
- Check for delegation again, and there is none.
And still invites are being forwarded to other 4 user Bs.
- Checked for Inbox rules via sower-shell, and there is none.
Looking at the header of invite there seems to be some sort of inbox rules taking place, but we can't find it anywhere.
Invite' email header:
***************
Received: from Cy2134897123.namprd04.prod.outlook.com (11.167.9.11) by
BN76491027.namprd04.prod.outlook.com (11.167.2.11) with Microsoft SMTP
Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id
18.1.97.12 via Mailbox Transport; Thu, 16 Mar 2017 20:55:15 +0000
Received: from CY1872391238.namprd04.prod.outlook.com (11.172.136.132) by
CY12397128737.namprd04.prod.outlook.com (11.167.9.11) with Microsoft SMTP
Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id
11.1.91.17; Thu, 16 Mar 2017 20:55:13 +0000
Received: from CY12387912.namprd04.prod.outlook.com ([127.0.0.1]) by
Cy12398761238.namprd04.prod.outlook.com ([1.172.136.15]) with Microsoft
SMTP Server id 15.01.47.020; Thu, 16 Mar 2017 20:55:13 +0000
From: Me <me@company.com>
To: USER_B1
<IMCEAEX-_o=ExchangeLabs_ou=Exchange+20Administrative+20Group+20+28FYDIBOHF23SPDLT+29_cn=Recipients_cn=COMPANY+2Eonmicrosoft+2Ecom-55785-megan+2Egarcia+40COMPANT+2Ecom207@namprd04.prod.outlook.com>,
USER_B2
<IMCEAEX-_o=ExchangeLabs_ou=Exchange+20Administrative+20Group+20+28FYDIBOHF23SPDLT+29_cn=Recipients_cn=7d53ac1abc9d4681a1af16af2dc1385d-bekah+2Einder@namprd04.prod.outlook.com>,
USER_B3
<IMCEAEX-_o=ExchangeLabs_ou=Exchange+20Administrative+20Group+20+28FYDIBOHF23SPDLT+29_cn=Recipients_cn=COMPANY+2Eonmicrosoft+2Ecom-55785-tara+2Emcnabb+40COMPANY+2Ecom792@namprd04.prod.outlook.com>,
USER_B4 <USER_B3@COMPANY.com>
Subject: Test 2
Thread-Topic: Test 2
Thread-Index: AdKel5phP3XMVD0KqVKe2MIWJ3dg==
Date: Thu, 16 Mar 2017 13:55:12 -0700
Message-ID: <940624492c9f4ca79eac031904d122c1@CY4PR04MB0614.namprd04.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Exchange-Organization-AuthAs: Internal
X-MS-Exchange-Organization-AuthMechanism: 04
X-MS-Exchange-Organization-AuthSource: DM2PR0401MB1086.namprd04.prod.outlook.com
X-MS-Has-Attach:
X-Auto-Response-Suppress: All
X-MS-Exchange-Organization-Network-Message-Id: 56df91d8-b401-4b5a-9704-08d46caebe0c
X-MS-Exchange-Organization-SCL: -1
X-MS-Exchange-Inbox-Rules-Loop: USER_A@COMPANY.com
X-MS-Exchange-Inbox-Rules-Loop: USER_B4@COMPANY.com
X-MS-TNEF-Correlator:
x-originating-ip: [12.245.61.98]
authentication-results: COMPANY.com; dkim=none (message not signed)
header.d=none;COMPANY.com; dmarc=none action=none
header.from=COMPANY.com;
auto-submitted: auto-generated
x-forefront-antispam-report: SFV:SKI;SFS:;DIR:INB;SFP:;SCL:-1;SYRH:BN6PR04MB0613;H:DM2PR0401MB1086.namprd04.prod.outlook.com;FPR:;SPF:None;LANG:en;SFV:SKI;SFS:;DIR:INB;SFP:;SCL:-1;SRVR:CY1PR04B2283;H:CY4PR4MB0614.namprd04.prod.outlook.com;FPR:;SPF:None;LANG:en;;SKIP:1;
X-Microsoft-Exchange-Diagnostics: 1;BN3PR04MB2273;27:AjdhrSIDBHzWglfFY7wp8EuEjx0atHy6Ip5ZfPaW/Zi8+FhJ3dCqayUmUlb2cBdFzMNlcF/PC31m1lVMypwwzAFkrld80OchmWY7gYu2VRCr10wSZu3zpd8lJbZ3cHCxTs75rlUe4GeUBrzPuFQ==
Content-Type: multipart/alternativ
boundary="_000_940624492c9f4ca79031904d122c1CY4PR04MB0614namprd04pr_"
MIME-Version: 1
********************
What else should I look into? Any thoughts?