Meeting invites being forwarded

[Navishkar Sadheo]

Hi All

Please can someone assist me.

I have an Exchange 2010 SP3 environment. Whenever a meeting request is sent to one of my users it gets forwarded to another user in the org.

I check the affected user's mailbox and there was a resource delegate specified which I removed however the meeting requests are still being forward.

I then went ran the following command on the affected user's mailbox:

Get-CalendarProcessing -Identity "affected user" | Set-CalendarProcessing -ForwardRequestsToDelegates $false

but the requests are still being forwarded. He doesn’t even receive them but the other user does.

There are no rules in his Outlook to forward the meeting requests.

Here is the output from get-calendarprocessing:

AddAdditionalResponse               : False

AdditionalResponse                  :

AddNewRequestsTentatively           : True

AddOrganizerToSubject               : True

AllBookInPolicy                     : True

AllowConflicts                      : False

AllowRecurringMeetings              : True

AllRequestInPolicy                  : False

AllRequestOutOfPolicy               : False

AutomateProcessing                  : AutoUpdate

BookingWindowInDays                 : 180

BookInPolicy                        : {}

ConflictPercentageAllowed           : 0

DeleteAttachments                   : True

DeleteComments                      : True

DeleteNonCalendarItems              : True

DeleteSubject                       : True

EnableResponseDetails               : True

EnforceSchedulingHorizon            : True

ForwardRequestsToDelegates          : False

Identity                            : mycompanyea2.mycompany.com/mycompany site/Site Nairobi/Executive Admin/affecteduser

IsValid                             : True

MailboxOwnerId                      : mycompanyea2.mycompany.com/mycompany site/Site Nairobi/Executive Admin/affecteduser

MaximumConflictInstances            : 0

MaximumDurationInMinutes            : 1440

OrganizerInfo                       : True

ProcessExternalMeetingMessages      : False

RemoveForwardedMeetingNotifications : False

RemoveOldMeetingMessages            : True

RemovePrivateProperty               : True

RequestInPolicy                     : {}

RequestOutOfPolicy                  : {}

ResourceDelegates                   : {}

RunspaceId                          : 2499a4c8-375d-4a68-b596-2a10b99e36bf

ScheduleOnlyDuringWorkHours         : False

TentativePendingApproval            : True

[#2]

Hey @Navishkar Sadheo,

I used to have to deal with situations like this quite often, as I was escalated support in a large exchange provider.

Here is how I would approach this problem, but these are probably right up there with the most annoying to troubleshoot as phantom/random client problems (as they are always ridiculously hard to track down).

1st-  You have done some great first steps, so great job attempting to tackle this, you have done allot of the smart steps to try

1 - My main guess would be there is another client/phone, something setup that is doing this, and there was a user based forward created there. I say this as you have checked/disabled much of the server side settings.

- To check this try to check/temporarily disable all past computers, current phones, tablets, etc that this user may be using, or have used. Use get-logonstatistics for that user to see if there are any connections that you cannot identify  "Get-LogonStatistics -Identity user@domain.com"
Look at that log and see if there are machines that dont look normal/ones you know about.

2. If you see nothing out of the norm, or nothing that you can identify, next I would try disabling certain connection types, so you can again see if any clients are maybe causing this. In essence I would normally go down to just OWA connections (disable POP/Imap, MAPi/Activesync). Once you take out all the clients this should tell you definitively if it is client related to server related.

3. Finally if none of the above works, bite the bullet, export the user data and create a new mailbox using the same parameters. We would do this late at night, to avoid data loss, but since you are onprem, you should be able to export prior to any deletion, so your downtime should be minimal, just make sure you export, delete and purge, rather than restore. I would also point out you will want to do a PW reset here, as if it is a rogue client, if you give it the same logon name it could just re-connect. That should give you all new settings/connections that will hopefully fix your issue.

I KNOW this sucks, trust me i do. Especially if there are any litigation hold issues going on, but 99 times out of 100 this will fix your problem if you cannot identify it.

Goodluck!
Adam

[#3]

Does this happen for *only* meeting requests, or other types of items as well? Have you checked the Delegate settings (those are different from the ResourceDelegate exposed via get-calendarprocessing), Outlook rules, transport rules? In general, running a (detailed) message trace on one such request should give you and idea why it gets forwarded. It might just be a case of "hidden" rule, which you can delete via MFCMAPI or similar.

[#4]

@Adam Ochs Thank you so much for the detailed reply.

Just a question if I start disabling services on the user's mailbox would I need to restart any services on the Exchange server?

[#5]

@Vasil Michev - You mean the delegate settings under account settings in Outlook? Let me take a look there.

There are no Outlook rules.

There are no transport rules.

Will give the message trace and MFCmapi a try if I don't come right.

Thanks a lot man.

[#6]

@Navishkar Sadheo no you should not have too, that should just impact the user not the server.