emails deleted

Question

Hi All,

I am using exchange 2016 hybrid environment, we create users in onprem and migrate to online. I am facing two issues. I have a shared mailbox, and emails are getting deleted. When I check the audit logs, I see that there is a delegation, i.e., LogonType: Delegate. Four users have access to this shared mailbox. I asked the users to check if there is a delegate, and they confirmed that there isn't any delegation. How can I check from the backend to see if emails are being deleted? how do i check the delegation. shared mailbox doesn't have any outlook rule. Please guide me.

One of my other user is facing issue, the emails are getting deleted and they are going directly to recoverable items folder. I dont see any outlook rule on the users mailbox. Please guide me.

Answer 1

Hi @Glenn Maxwell,

Welcome to the Microsoft Q&A platform!

According to your description, it sounds like you're dealing with a couple of complex issues in your Exchange 2016 hybrid environment. Let’s tackle each issue one by one:

Issue 1: Shared Mailbox Emails Getting Deleted

1.Check Mailbox Audit Logs:

You can use the Search-MailboxAuditLog cmdlet to check who is deleting the emails. For example:

Search-MailboxAuditLog -Identity "SharedMailbox" -LogonTypes Delegate -ShowDetails -StartDate "2024-08-01" -EndDate "2024-08-29" | Where-Object {$_.Operation -eq "SoftDelete"}

This command will show you the details of the delegate actions, including deletions.

2.Verify Delegation:

To check if there are any delegates, you can use the Get-MailboxPermission cmdlet:

Get-MailboxPermission -Identity "SharedMailbox" | Where-Object {($.AccessRights -eq "FullAccess") -and ($.IsInherited -eq $false)}

This will list all users who have full access to the shared mailbox1.

Issue 2: Emails Going Directly to Recoverable Items Folder

1.Check for Hidden Rules:

Sometimes, rules might not be visible in the Outlook client but can still exist. You can use the Get-InboxRule cmdlet to check for any hidden rules:

Get-InboxRule -Mailbox "UserMailbox"

2.Mailbox Audit Logs:

Similar to the shared mailbox, you can use the Search-MailboxAuditLog cmdlet to check for deletions:

Search-MailboxAuditLog -Identity "UserMailbox" -LogonTypes Owner -ShowDetails -StartDate "2024-08-01" -EndDate "2024-08-29" | Where-Object {$.Operation -eq "MoveToDeletedItems" -or $.Operation -eq "SoftDelete"}

3.Check for Mobile Device Rules:

Sometimes, rules set up on mobile devices can cause emails to be deleted or moved. Ensure the user checks their mobile email app settings.

By following these steps, you should be able to identify the cause of the email deletions and address the issues.

---

Please feel free to contact me for any updates. And if this helps, don't forget to mark it as an answer.

Best,

Jake Zhang