troubleshooting Question
Hidden or Corrupted inbox rule on office 365! Is that possible?
Farnam Shadmani asked on
Hi All,
I am having some strange issues with one of our users.
Every time User (A) receives an invite, 4 other users (Bs) receive her invites too. 3 of whom have already separated from the company, and don't haven any account on our server anymore.
We use office 365, Online Exchange plans. Here is what I've already looked at:
- Check for any inbox rule and delegates via Online Dashboard - There was none
- Checked for delegation on Calendar and Inbox via powershell, found exact 4 other users (B) delegated to user A inbox.
- Remove all 4 user Bs.
- Check for delegation again, and there is none.
And still invites are being forwarded to other 4 user Bs.
- Checked for Inbox rules via sower-shell, and there is none.
Looking at the header of invite there seems to be some sort of inbox rules taking place, but we can't find it anywhere.
Invite' email header:
***************
Received: from Cy2134897123.namprd04.prod
BN76491027.namprd04.prod.o
Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_
18.1.97.12 via Mailbox Transport; Thu, 16 Mar 2017 20:55:15 +0000
Received: from CY1872391238.namprd04.prod
CY12397128737.namprd04.pro
Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_
11.1.91.17; Thu, 16 Mar 2017 20:55:13 +0000
Received: from CY12387912.namprd04.prod.o
Cy12398761238.namprd04.pro
SMTP Server id 15.01.47.020; Thu, 16 Mar 2017 20:55:13 +0000
From: Me <me@company.com>
To: USER_B1
<IMCEAEX-_o=ExchangeLabs_o
USER_B2
<IMCEAEX-_o=ExchangeLabs_o
USER_B3
<IMCEAEX-_o=ExchangeLabs_o
USER_B4 <USER_B3@COMPANY.com>
Subject: Test 2
Thread-Topic: Test 2
Thread-Index: AdKel5phP3XMVD0KqVKe2MIWJ3
Date: Thu, 16 Mar 2017 13:55:12 -0700
Message-ID: <940624492c9f4ca79eac03190
Accept-Language: en-US
Content-Language: en-US
X-MS-Exchange-Organization
X-MS-Exchange-Organization
X-MS-Exchange-Organization
X-MS-Has-Attach:
X-Auto-Response-Suppress: All
X-MS-Exchange-Organization
X-MS-Exchange-Organization
X-MS-Exchange-Inbox-Rules-
X-MS-Exchange-Inbox-Rules-
X-MS-TNEF-Correlator:
x-originating-ip: [12.245.61.98]
authentication-results: COMPANY.com; dkim=none (message not signed)
header.d=none;COMPANY.com;
header.from=COMPANY.com;
auto-submitted: auto-generated
x-forefront-antispam-repor
X-Microsoft-Exchange-Diagn
Content-Type: multipart/alternativ
boundary="_000_940624492c9
MIME-Version: 1
********************
What else should I look into? Any thoughts?
I am having some strange issues with one of our users.
Every time User (A) receives an invite, 4 other users (Bs) receive her invites too. 3 of whom have already separated from the company, and don't haven any account on our server anymore.
We use office 365, Online Exchange plans. Here is what I've already looked at:
- Check for any inbox rule and delegates via Online Dashboard - There was none
- Checked for delegation on Calendar and Inbox via powershell, found exact 4 other users (B) delegated to user A inbox.
- Remove all 4 user Bs.
- Check for delegation again, and there is none.
And still invites are being forwarded to other 4 user Bs.
- Checked for Inbox rules via sower-shell, and there is none.
Looking at the header of invite there seems to be some sort of inbox rules taking place, but we can't find it anywhere.
Invite' email header:
***************
Received: from Cy2134897123.namprd04.prod
BN76491027.namprd04.prod.o
Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_
18.1.97.12 via Mailbox Transport; Thu, 16 Mar 2017 20:55:15 +0000
Received: from CY1872391238.namprd04.prod
CY12397128737.namprd04.pro
Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_
11.1.91.17; Thu, 16 Mar 2017 20:55:13 +0000
Received: from CY12387912.namprd04.prod.o
Cy12398761238.namprd04.pro
SMTP Server id 15.01.47.020; Thu, 16 Mar 2017 20:55:13 +0000
From: Me <me@company.com>
To: USER_B1
<IMCEAEX-_o=ExchangeLabs_o
USER_B2
<IMCEAEX-_o=ExchangeLabs_o
USER_B3
<IMCEAEX-_o=ExchangeLabs_o
USER_B4 <USER_B3@COMPANY.com>
Subject: Test 2
Thread-Topic: Test 2
Thread-Index: AdKel5phP3XMVD0KqVKe2MIWJ3
Date: Thu, 16 Mar 2017 13:55:12 -0700
Message-ID: <940624492c9f4ca79eac03190
Accept-Language: en-US
Content-Language: en-US
X-MS-Exchange-Organization
X-MS-Exchange-Organization
X-MS-Exchange-Organization
X-MS-Has-Attach:
X-Auto-Response-Suppress: All
X-MS-Exchange-Organization
X-MS-Exchange-Organization
X-MS-Exchange-Inbox-Rules-
X-MS-Exchange-Inbox-Rules-
X-MS-TNEF-Correlator:
x-originating-ip: [12.245.61.98]
authentication-results: COMPANY.com; dkim=none (message not signed)
header.d=none;COMPANY.com;
header.from=COMPANY.com;
auto-submitted: auto-generated
x-forefront-antispam-repor
X-Microsoft-Exchange-Diagn
Content-Type: multipart/alternativ
boundary="_000_940624492c9
MIME-Version: 1
********************
What else should I look into? Any thoughts?
Learn from the best
Network and collaborate with thousands of CTOs, CISOs, and IT Pros rooting for you and your success.
Andrew Hancock - VMware vExpert
See if this solution works for you by signing up for a 7 day free trial.
Unlock 2 Answers and 3 Comments.
Try for 7 days”The time we save is the biggest benefit of E-E to our team. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange.
Our community of experts have been thoroughly vetted for their expertise and industry experience.
The Most Valuable Expert award recognizes technology experts who passionately share their knowledge with the community, demonstrate the core values of this platform, and go the extra mile in all aspects of their contributions. This award is based off of nominations by EE users and experts. Multiple MVEs may be awarded each year.
The Distinguished Expert awards are presented to the top veteran and rookie experts to earn the most points in the top 50 topics.