Forum Discussion
Shared mailbox messages going to recoverable deleted items
Hi!
Trying to solve an issue that's plagued me for a couple weeks. We have a shared mailbox hosted in Exchange Online that receives customer orders. We're discovering that many orders are somehow landing in the recoverable items section of deleted items and we've yet to find a root cause. Things I've tried:
1. Disable, then deleted, all mailbox-level rules on the shared mailbox.
2. Tried to get audit logs from protection.office.com - no results available.
3. Eventually stumbled on this article which lets me export logs to a CSV.
https://support.microsoft.com/en-us/help/4021960/how-to-use-mailbox-audit-logs-in-office-365
However the logs are somewhat inconclusive. I see some actions like "SoftDelete" from users (which I think would not move the email to recoverable deleted items). I also see "MoveToDeletedItems" and "HardDelete". However there's only a handful of hard deletes - not enough to account for the hundreds of emails showing in recoverable deleted items.
4. Reset all users passwords.
5. Had their supervisor remind them no emails should be deleted, only moved to a folder called "Completed". Multiple users insist they understand this protocol and are following it.
6. Checked several suspect users in the audit log for Outlook issues, rules, ignore, or other reasons that might be causing it. Rebuilt a suspect user's Outlook profile.
7. Ran Get-InboxRule to see if there were any additional rules
8. Ran outlook.exe /cleanconvongoingactions to remove any ignores
9. Remove all mailbox permissions except for system ones (e.g. NT Authority\SELF, NAMPRD02\Exchange Users, etc.). Re-add to try to identify which users are causing deletes. As we've slowly re-added users we saw deletes stop for a while and thought we had identified a specific user, but today confirmed that is not the case - there's no specific user that appears to be the cause.
Help? Any ideas?
Mailbox Auditing is the correct method to troubleshoot this, but I'd suggest you also check for any retention policies applied on the mailbox.
Also, Hard-delete corresponds to the message being Purged (moved to the Purges folder is SIR/hold is configured for the mailbox), not to moving messages to the Recoverable Items folder. That last one is still a soft-delete operation. Make sure all of these operations are actually being audited.
- Did you find a resolution for this? I have a very similar issue giving me grey hairs!
- I have a similar issue as well. I have a user moving an email from the shared mailbox's Inbox to a sub folder in the shared mailbox by dragging and dropping. It shows up in the recoverable deleted items and in the audit log as a soft-delete.
Hi Guys, there's a registry change I found which fixed for me:
If the user has at least author rights to the shared mailbox's Deleted Items folder, the deleted items can go into the shared mailbox's deleted items folder. You (or the administrator) need to add this key to the registry.
Outlook 2016 and Outlook 2019
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Options\General DWORD: DelegateWastebasketStyle Value: 4 (use shared mailbox's Deleted items) 8 (use the default (or user's) deleted items folder)
I can't see this working however with OWA or o365 online
- Anyone have success with this? We are having a similar issue for only 1 shared mailbox.
