Forum Discussion
Shared mailbox messages going to recoverable deleted items
Hi!
Trying to solve an issue that's plagued me for a couple weeks. We have a shared mailbox hosted in Exchange Online that receives customer orders. We're discovering that many orders are somehow landing in the recoverable items section of deleted items and we've yet to find a root cause. Things I've tried:
1. Disable, then deleted, all mailbox-level rules on the shared mailbox.
2. Tried to get audit logs from protection.office.com - no results available.
3. Eventually stumbled on this article which lets me export logs to a CSV.
https://support.microsoft.com/en-us/help/4021960/how-to-use-mailbox-audit-logs-in-office-365
However the logs are somewhat inconclusive. I see some actions like "SoftDelete" from users (which I think would not move the email to recoverable deleted items). I also see "MoveToDeletedItems" and "HardDelete". However there's only a handful of hard deletes - not enough to account for the hundreds of emails showing in recoverable deleted items.
4. Reset all users passwords.
5. Had their supervisor remind them no emails should be deleted, only moved to a folder called "Completed". Multiple users insist they understand this protocol and are following it.
6. Checked several suspect users in the audit log for Outlook issues, rules, ignore, or other reasons that might be causing it. Rebuilt a suspect user's Outlook profile.
7. Ran Get-InboxRule to see if there were any additional rules
8. Ran outlook.exe /cleanconvongoingactions to remove any ignores
9. Remove all mailbox permissions except for system ones (e.g. NT Authority\SELF, NAMPRD02\Exchange Users, etc.). Re-add to try to identify which users are causing deletes. As we've slowly re-added users we saw deletes stop for a while and thought we had identified a specific user, but today confirmed that is not the case - there's no specific user that appears to be the cause.
Help? Any ideas?
9 Replies
Did you ever find a solution for this? Ive just started having a shared mailbox with this problem.
See this article:
https://learn.microsoft.com/en-us/exchange/collaboration-exo/shared-mailboxes
Specifically this statement:- When users move items from one folder to another in a shared mailbox, a copy of the item is stored in the Recoverable Items folder.
You should find the item in both the folder they moved it to AND the recoverable items.
I did not know that, but im not seeing that actually happen in testing. That would be a very odd thing to design in.
In any case, I could never prove items were being moved through anything other than users deleting things, so weve moved on.
- Anyone have success with this? We are having a similar issue for only 1 shared mailbox.
- Did you find a resolution for this? I have a very similar issue giving me grey hairs!
- I have a similar issue as well. I have a user moving an email from the shared mailbox's Inbox to a sub folder in the shared mailbox by dragging and dropping. It shows up in the recoverable deleted items and in the audit log as a soft-delete.
- I am having the exact same issue with a user in our environment, accessing Shared Mailbox via Outlook Desktop client and randomly when dragging and dropping an email it will sometimes go into the Deleted Items and sometimes as you say go into the Recoverable Deleted Items.
Did you ever find a resolution to this? I'm basically at the point of raising a call with MS but because the issue is so intermittent troubleshooting is a pain in itself as I can't seem to replicate the issue. Very odd behaviour...
Thanks
Mailbox Auditing is the correct method to troubleshoot this, but I'd suggest you also check for any retention policies applied on the mailbox.
Also, Hard-delete corresponds to the message being Purged (moved to the Purges folder is SIR/hold is configured for the mailbox), not to moving messages to the Recoverable Items folder. That last one is still a soft-delete operation. Make sure all of these operations are actually being audited.
