Exchange 2013 Cu23 Random users are dropping from random groups

[Reachdp]

Exchange server 2013 cu23, multiple DAG and shared customers, but only one customer is having this problem of dropping user from distribution group.

Here are the attributes of one Distribution group dropped 2 users in last 24 hours, which may help to find the cause or narrow down.

RunspaceId : 0247c713-3368-4708-ae7b-d4a53f02e924
GroupType : Universal, SecurityEnabled
BypassNestedModerationEnabled : False
MemberJoinRestriction : Closed
MemberDepartRestriction : Closed
ExpansionServer :
ReportToManagerEnabled : False
ReportToOriginatorEnabled : True
SendOofMessageToOriginatorEnabled : False
AcceptMessagesOnlyFrom : {}
AcceptMessagesOnlyFromDLMembers : {}
AcceptMessagesOnlyFromSendersOrMembers : {}
BypassModerationFromSendersOrMembers : {}

GrantSendOnBehalfTo : {}
ExternalDirectoryObjectId :
HiddenFromAddressListsEnabled : False
LastExchangeChangedTime :
MaxSendSize : Unlimited
MaxReceiveSize : Unlimited
ModeratedBy : {}
ModerationEnabled : False
PoliciesIncluded : {d5cc06b9-cd20-42ae-b26a-b194365fd71c, {26491cfc-9e50-4857-861b-0cb8df22b5d7}}
PoliciesExcluded : {}
EmailAddressPolicyEnabled : True
RecipientType : MailUniversalSecurityGroup
RecipientTypeDetails : MailUniversalSecurityGroup
RejectMessagesFrom : {}
RejectMessagesFromDLMembers : {}
RejectMessagesFromSendersOrMembers : {}
RequireSenderAuthenticationEnabled : True
SimpleDisplayName :
SendModerationNotifications : Always
UMDtmfMap : {emailAddress:3376878233, lastNameFirstName:286842624373376878233, firstNameLastName:286842624373376878233}
MailTip :
MailTipTranslations : {}
IsValid : True
ExchangeVersion : 0.10 (14.0.100.0)
Guid : 8010e2a7-745b-47e9-9cd2-1e35fe5b9963
ObjectClass : {top, group}
WhenChanged : 25/08/2020 8:26:46 PM
WhenCreated : 21/01/2016 4:51:37 PM
WhenChangedUTC : 25/08/2020 10:26:46 AM
WhenCreatedUTC : 21/01/2016 5:51:37 AM
ObjectState : Changed

[#2]

Hello Reachdp,

Could it maybe be related to DC's incorrectly syncing one another?

You could check the sync status by running repadmin /replsummary on one the Domain Controllers.

Also did you test the behavior by creating a new group to see if it's only applicable to the current groups?

[#3]

Thank you for your time, the replication don't have any errors I will enable logging for groups and see what's happening there.
Let me know if we have some other options to drill down.

[#4]

All of the groups in Exchange rely on Active Directory so that's why this came to mind directly.
Did you also test it out with new groups?
And did you also check the state of your Exchange database? (eseutil /mh on the .edb file, requires unmounting the database).