emails missing

%3CLINGO-SUB%20id%3D%22lingo-sub-276181%22%20slang%3D%22en-US%22%3Eemails%20missing%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-276181%22%20slang%3D%22en-US%22%3E%3CP%3Eemails%20went%20to%20missing%20from%20folders.%20upon%20further%20checking%2C%20found%20that%20the%20emails%20went%20to%20deleted%20folders.%20i%20have%20to%20do%20recovery.%3CBR%20%2F%3Ei%20did%20the%20recovery%20of%20emails%203%20times%20as%20i%20find%20that%20my%20emails%20went%20missing%20after%20i%20have%20recovered%20them%20.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-276181%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EExchange%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-278976%22%20slang%3D%22en-US%22%3ERe%3A%20emails%20missing%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-278976%22%20slang%3D%22en-US%22%3E%3CP%3Eafter%20monitoring%20closely%20for%20the%20past%203-4%20days%2C%20i%20noticed%20that%20it%20always%20happened%20over%20night.%3C%2FP%3E%3CP%3Eemails%20just%20get%20moved%20to%20the%20deleted%20folders%20as%20i%20checked%20my%26nbsp%3B%20OWA%20each%20morning%20and%20i%20need%20to%20do%20recovery%20of%20deleted%20items.%3C%2FP%3E%3CP%3Ei%20still%20cannot%20figure%20out%20why%20is%20this%20happening%3C%2FP%3E%3CP%3Eemails%20being%20deleted%20consists%20of%20most%20recent%20to%20the%20last%20one%20dates%206%20Oct%202016.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-278749%22%20slang%3D%22en-US%22%3ERe%3A%20emails%20missing%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-278749%22%20slang%3D%22en-US%22%3E%3CP%3Ei%20do%20know%20that%20we%20purchased%20O365%20licences%20through%203rd%20party%20vendor.%3C%2FP%3E%3CP%3Emy%20question%20is%2C%20why%20is%20the%20service%20request%20being%20re-directed%20to%20the%203rd%20party%20vendor%20instead%20of%20directly%20to%20Microsoft%20since%20this%20is%20a%20technical%20question%20not%20related%20to%20me%20O365%20licences.%3C%2FP%3E%3CP%3Ei%20remembered%20in%20August%20this%20year%2C%20i%20did%20managed%20to%20log%20a%20service%20request%20directly%20to%20Microsoft%20to%20solve%20one%20of%20my%20user%20having%20emails%20being%20sent%20to%20junk%20folder.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-278481%22%20slang%3D%22en-US%22%3ERe%3A%20emails%20missing%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-278481%22%20slang%3D%22en-US%22%3E%3CP%3EHey%20Kin%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThat%20just%20means%20you%20likley%20purchased%20O365%20through%20a%20third%20party%20like%20Go-daddy%20or%20someone%20similar.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAs%20such%2C%20they%20essentially%20are%20a%20line%20of%20defense%20between%20you%20and%20Microsoft.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EYou%20can%20follow%20this%20article%20to%20see%20who%20your%20partner%20of%20record%20is%20listed%20as%20-%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fsupport.office.com%2Fen-us%2Farticle%2Fadd-change-or-delete-a-subscription-advisor-partner-f86e8177-936e-491e-9024-44dea2b296ff%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fsupport.office.com%2Fen-us%2Farticle%2Fadd-change-or-delete-a-subscription-advisor-partner-f86e8177-936e-491e-9024-44dea2b296ff%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThey%20will%20likely%20be%20who%20this%20is.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAdam%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-278241%22%20slang%3D%22en-US%22%3ERe%3A%20emails%20missing%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-278241%22%20slang%3D%22en-US%22%3E%3CP%3Ei%20can't%20seems%20to%20log%20a%20case%20with%20Microsoft.%3C%2FP%3E%3CP%3Eeach%20time%20i%20create%20a%20new%20ticket%2C%20it%20will%20ask%20me%20to%20contact%20my%20partner%20instead.%3C%2FP%3E%3CP%3Eis%20there%20a%20limit%20as%20to%20how%20many%20ticket%20i%20can%20logged%20with%20Microsoft%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-277816%22%20slang%3D%22en-US%22%3ERe%3A%20emails%20missing%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-277816%22%20slang%3D%22en-US%22%3EPlease%20log%20a%20ticket%20in%20the%20admin%20portal%20under%20support!%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-277785%22%20slang%3D%22en-US%22%3ERe%3A%20emails%20missing%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-277785%22%20slang%3D%22en-US%22%3E%3CP%3Ei%20have%20re-create%20my%20outlook%20profile.%3CBR%20%2F%3Edisabled%20outlook%20for%20mobile%20device.%20such%20that%20i%20only%20access%20email%20using%20browser%20on%20the%20phone.%3CBR%20%2F%3Eright%20now%20only%20emails%20that%20are%20send%20out%20are%20going%20to%20the%20deleted%20recovery.%3C%2FP%3E%3CP%3Ehow%20do%20i%20logged%20a%20case%20with%20microsoft%20suppport%20to%20help%20with%20this%20case%20%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-277464%22%20slang%3D%22en-US%22%3ERe%3A%20emails%20missing%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-277464%22%20slang%3D%22en-US%22%3E%3CP%3EThis%20could%20be%20a%20rule%20setup%20locally%20on%20the%20outlook%2C%20this%20could%20be%20MRM%20policies%2C%20this%20could%20be%20someones%20iphone%20app%20going%20wonky%20and%20removing%20things%20from%20incorrect%20settings%2C%20honestly%20this%20could%20be%20a%20number%20of%20things.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20would%20recommend%20trying%20to%20eliminate%20some%20of%20the%20variables%20here%20to%20try%20to%20get%20down%20to%20what%20may%20be%20causing%20it.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E1.%20Try%20first%20creating%20new%20profiles%20for%20the%20users%20this%20is%20happening%20too.%20A%20new%20Outlook%20profile%2C%20new%20phone%20profiles%20etc.%20I%20would%20recommend%20YOU%20set%20them%20up%20for%20them%2C%20not%20trust%20them%20to%20do%20it%20correct%20on%20their%20own.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E2.%20If%20that%20continues%20to%20happen%2C%20start%20eliminating%20the%20devices.%20Try%20to%20get%20down%20to%20where%201%20or%20even%20no%20extra%20profiles%2Fdevices%20are%20running.%26nbsp%3B%3C%2FP%3E%3CP%3E-%20If%20you%20eliminate%20the%20phone%20of%20the%20user%20but%20outlook%20is%20still%20running%20and%20the%20issue%20persists%2C%20well%20its%20probably%20outlook%2C%20or%20server%20related.%20Or%20vice%20versa%2C%20if%20you%20eliminate%20the%20phone%20and%20it%20stops%2C%20then%20you%20know%20it%20was%20probably%20something%20on%20the%20phone.%3C%2FP%3E%3CP%3E-%20If%20you%20get%20to%20the%20point%20of%20the%20user%20only%20using%20OWA%2C%20and%20there%20are%20no%20outlook%20or%20mobile%20connections%2C%20then%20you%20know%20for%20sure%20it%20is%20a%20server%20side%20setting%20causing%20the%20issue.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20realize%20these%20types%20of%20steps%20are%20somewhat%20intrusive%20for%20the%20user%2C%20but%20if%20you%20have%20auditing%20enabled%2C%20and%20are%20not%20getting%20any%20specifics%20from%20there%2C%20then%20you%20need%20to%20start%20proactively%20trying%20to%20find%20the%20root%20of%20the%20problem%2C%20but%20right%20now%20you%20likely%20have%20to%20many%20candidates%20to%20do%20that%20confidently.%20As%20such%20you%20need%20to%20start%20eliminating%20variables%20to%20isolate%20down%20the%20problem%20to%20a%20specific%20mechanism.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EGoodluck!%3C%2FP%3E%3CP%3EAdam%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-277342%22%20slang%3D%22en-US%22%3ERe%3A%20emails%20missing%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-277342%22%20slang%3D%22en-US%22%3Emy%20audting%20was%20activated%202%20months%20back%20on%20the%20advice%20of%20microsoft%20support.%3CBR%20%2F%3E%3CBR%20%2F%3Ethe%20auditing%20logs%20still%20do%20not%20shows%20anything%20related%20to%20moving%20my%20mails%20to%20deleted.%3CBR%20%2F%3Ei%20am%20still%20having%20issues%20with%20mails%20going%20to%20the%20deleted%20items%20folders.%20have%20to%20do%20recovery%20to%20get%20them%20back%20to%20my%20inbox%2Ffolders.%20i%20did%20a%20full%20recovery%20yesterday%20to%20recover%20everything%20inside%20the%20recover%20delete%20items%20folders.%20the%20number%20now%20is%20smaller%20at%20about%20less%20than%20400.%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-276736%22%20slang%3D%22en-US%22%3ERe%3A%20emails%20missing%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-276736%22%20slang%3D%22en-US%22%3E%3CP%3EAuditing%20will%20not%20include%20any%20past%20events%2C%20only%20events%20from%20the%20date%20you%20turned%20it%20on%20forward.%20In%20addition%2C%20by%20default%20only%20certain%20types%20of%20activities%20are%20audited%2C%20so%20make%20sure%20you%20follow%20the%20instructions%20in%20the%20article%20I%20linked%20to%20adjust%20the%20parameters%20accordingly.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-276727%22%20slang%3D%22en-US%22%3ERe%3A%20emails%20missing%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-276727%22%20slang%3D%22en-US%22%3E%3CP%3Eonly%20managed%20to%20find%20this.%3C%2FP%3E%3CP%3Edelete%20message%20from%20deleted%20folder%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-276721%22%20slang%3D%22en-US%22%3ERe%3A%20emails%20missing%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-276721%22%20slang%3D%22en-US%22%3Ehave%20found%20the%20audit%20logs.%20found%20nothing%20except%20logins.%3CBR%20%2F%3Enothing%20that%20mentioned%20mails%20being%20moved%2Fdeleted%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-276720%22%20slang%3D%22en-US%22%3ERe%3A%20emails%20missing%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-276720%22%20slang%3D%22en-US%22%3E%3CP%3EPlease%20refer%20to%3A%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fsv-se%2Foffice365%2Fsecuritycompliance%2Fenable-mailbox-auditing%3FredirectSourcePath%3D%25252fen-us%25252farticle%25252fEnable-mailbox-auditing-in-Office-365-aaca8987-5b62-458b-9882-c28476a66918%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fsv-se%2Foffice365%2Fsecuritycompliance%2Fenable-mailbox-auditing%3FredirectSourcePath%3D%25252fen-us%25252farticle%25252fEnable-mailbox-auditing-in-Office-365-aaca8987-5b62-458b-9882-c28476a66918%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAlso%20you%20can%20check%20the%20audit%20log%20search%20in%20security%20and%20compliance%20center!%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Eadam%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-276719%22%20slang%3D%22en-US%22%3ERe%3A%20emails%20missing%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-276719%22%20slang%3D%22en-US%22%3Ei%20have%20already%20turn%20on%20auditing.%3CBR%20%2F%3Ewhat%20commands%20should%20i%20used%20to%20check%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-276419%22%20slang%3D%22en-US%22%3ERe%3A%20emails%20missing%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-276419%22%20slang%3D%22en-US%22%3E%3CP%3EEnable%20auditing%20on%20the%20mailbox%2C%20if%20you%20haven't%20done%20so%20already%2C%20then%20review%20the%20audit%20logs%20to%20find%20out%20who%20performed%20this%20action%3A%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Foffice365%2Fsecuritycompliance%2Fenable-mailbox-auditing%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Foffice365%2Fsecuritycompliance%2Fenable-mailbox-auditing%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-276197%22%20slang%3D%22en-US%22%3ERe%3A%20emails%20missing%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-276197%22%20slang%3D%22en-US%22%3Eit%20was%20deleted%20more%20than%20once.%3CBR%20%2F%3Eif%20i%20remember%20correctly%2C%20emails%20from%20before%20last%20week%20onwards%20were%20deleted%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-276196%22%20slang%3D%22en-US%22%3ERe%3A%20emails%20missing%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-276196%22%20slang%3D%22en-US%22%3EWere%20they%20deleted%20more%20than%20once%3F%20Have%20the%20mails%20something%20in%20common%20or%20just%20random%3F%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-276195%22%20slang%3D%22en-US%22%3ERe%3A%20emails%20missing%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-276195%22%20slang%3D%22en-US%22%3Eit%20all%20started%20when%20i%20decide%20to%20reorganize%20my%20inbox%20folders.%3CBR%20%2F%3Etwo%20days%20after%20i%20created%20a%20vendor%20directory%2C%20i%20found%20emails%20missing%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-276193%22%20slang%3D%22en-US%22%3ERe%3A%20emails%20missing%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-276193%22%20slang%3D%22en-US%22%3E%3CP%3Ewhole%20chunk%20of%20emails%20went%20to%20deleted%20folders.%3C%2FP%3E%3CP%3Ehave%20checked%20for%20rules%2C%20found%20no%20rules%20deleting%20my%20emails.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-276190%22%20slang%3D%22en-US%22%3ERe%3A%20emails%20missing%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-276190%22%20slang%3D%22en-US%22%3EIs%20there%20attachements%20in%20all%20of%20the%20mails%20that%20gets%20deleted%3F%3CBR%20%2F%3ECould%20be%20a%20mail%20policy%20with%20action%20to%20delete%20the%20message%3CBR%20%2F%3EAlso%20check%20the%20rules%20in%20outlook%20for%20any%20rules%20with%20action%20to%20do%20this%3C%2FLINGO-BODY%3E
Highlighted
Occasional Contributor

emails went to missing from folders. upon further checking, found that the emails went to deleted folders. i have to do recovery.
i did the recovery of emails 3 times as i find that my emails went missing after i have recovered them .

19 Replies
Highlighted
Is there attachements in all of the mails that gets deleted?
Could be a mail policy with action to delete the message
Also check the rules in outlook for any rules with action to do this
Highlighted

whole chunk of emails went to deleted folders.

have checked for rules, found no rules deleting my emails.

Highlighted
it all started when i decide to reorganize my inbox folders.
two days after i created a vendor directory, i found emails missing
Highlighted
Were they deleted more than once? Have the mails something in common or just random?
Highlighted
it was deleted more than once.
if i remember correctly, emails from before last week onwards were deleted
Highlighted

Enable auditing on the mailbox, if you haven't done so already, then review the audit logs to find out who performed this action: https://docs.microsoft.com/en-us/office365/securitycompliance/enable-mailbox-auditing

Highlighted
i have already turn on auditing.
what commands should i used to check
Highlighted

Please refer to:

https://docs.microsoft.com/sv-se/office365/securitycompliance/enable-mailbox-auditing?redirectSource...

 

Also you can check the audit log search in security and compliance center!

 

adam

Highlighted
have found the audit logs. found nothing except logins.
nothing that mentioned mails being moved/deleted
Highlighted

only managed to find this.

delete message from deleted folder

Highlighted

Auditing will not include any past events, only events from the date you turned it on forward. In addition, by default only certain types of activities are audited, so make sure you follow the instructions in the article I linked to adjust the parameters accordingly.

Highlighted
my audting was activated 2 months back on the advice of microsoft support.

the auditing logs still do not shows anything related to moving my mails to deleted.
i am still having issues with mails going to the deleted items folders. have to do recovery to get them back to my inbox/folders. i did a full recovery yesterday to recover everything inside the recover delete items folders. the number now is smaller at about less than 400.

Highlighted

This could be a rule setup locally on the outlook, this could be MRM policies, this could be someones iphone app going wonky and removing things from incorrect settings, honestly this could be a number of things.

 

I would recommend trying to eliminate some of the variables here to try to get down to what may be causing it.

 

1. Try first creating new profiles for the users this is happening too. A new Outlook profile, new phone profiles etc. I would recommend YOU set them up for them, not trust them to do it correct on their own.

 

2. If that continues to happen, start eliminating the devices. Try to get down to where 1 or even no extra profiles/devices are running. 

- If you eliminate the phone of the user but outlook is still running and the issue persists, well its probably outlook, or server related. Or vice versa, if you eliminate the phone and it stops, then you know it was probably something on the phone.

- If you get to the point of the user only using OWA, and there are no outlook or mobile connections, then you know for sure it is a server side setting causing the issue.

 

I realize these types of steps are somewhat intrusive for the user, but if you have auditing enabled, and are not getting any specifics from there, then you need to start proactively trying to find the root of the problem, but right now you likely have to many candidates to do that confidently. As such you need to start eliminating variables to isolate down the problem to a specific mechanism.

 

Goodluck!

Adam

Highlighted

i have re-create my outlook profile.
disabled outlook for mobile device. such that i only access email using browser on the phone.
right now only emails that are send out are going to the deleted recovery.

how do i logged a case with microsoft suppport to help with this case ?

Highlighted
Please log a ticket in the admin portal under support!
Highlighted

i can't seems to log a case with Microsoft.

each time i create a new ticket, it will ask me to contact my partner instead.

is there a limit as to how many ticket i can logged with Microsoft?

Highlighted

Hey Kin,

 

That just means you likley purchased O365 through a third party like Go-daddy or someone similar.

 

As such, they essentially are a line of defense between you and Microsoft.

 

You can follow this article to see who your partner of record is listed as - https://support.office.com/en-us/article/add-change-or-delete-a-subscription-advisor-partner-f86e817...

 

They will likely be who this is.

 

Adam

Highlighted

i do know that we purchased O365 licences through 3rd party vendor.

my question is, why is the service request being re-directed to the 3rd party vendor instead of directly to Microsoft since this is a technical question not related to me O365 licences.

i remembered in August this year, i did managed to log a service request directly to Microsoft to solve one of my user having emails being sent to junk folder.

Highlighted

after monitoring closely for the past 3-4 days, i noticed that it always happened over night.

emails just get moved to the deleted folders as i checked my  OWA each morning and i need to do recovery of deleted items.

i still cannot figure out why is this happening

emails being deleted consists of most recent to the last one dates 6 Oct 2016.