emails missing

VasilMichev
MVP
Oct 22, 2018
Auditing will not include any past events, only events from the date you turned it on forward. In addition, by default only certain types of activities are audited, so make sure you follow the instructions in the article I linked to adjust the parameters accordingly.
- Kin Mun Yeow
  Copper Contributor
  Oct 24, 2018
  my audting was activated 2 months back on the advice of microsoft support.
  
  the auditing logs still do not shows anything related to moving my mails to deleted.
  i am still having issues with mails going to the deleted items folders. have to do recovery to get them back to my inbox/folders. i did a full recovery yesterday to recover everything inside the recover delete items folders. the number now is smaller at about less than 400.
  - Adam Ochs
    Steel Contributor
    Oct 24, 2018
    This could be a rule setup locally on the outlook, this could be MRM policies, this could be someones iphone app going wonky and removing things from incorrect settings, honestly this could be a number of things.
    
    I would recommend trying to eliminate some of the variables here to try to get down to what may be causing it.
    
    1. Try first creating new profiles for the users this is happening too. A new Outlook profile, new phone profiles etc. I would recommend YOU set them up for them, not trust them to do it correct on their own.
    
    2. If that continues to happen, start eliminating the devices. Try to get down to where 1 or even no extra profiles/devices are running.
    - If you eliminate the phone of the user but outlook is still running and the issue persists, well its probably outlook, or server related. Or vice versa, if you eliminate the phone and it stops, then you know it was probably something on the phone.
    - If you get to the point of the user only using OWA, and there are no outlook or mobile connections, then you know for sure it is a server side setting causing the issue.
    
    I realize these types of steps are somewhat intrusive for the user, but if you have auditing enabled, and are not getting any specifics from there, then you need to start proactively trying to find the root of the problem, but right now you likely have to many candidates to do that confidently. As such you need to start eliminating variables to isolate down the problem to a specific mechanism.
    
    Goodluck!
    Adam

Forum Discussion