Exchange 2010h

[autumn]

G day all

I have a SBS 2011 server with 2 issues for the same mailbox/user. I don't think they are related however...

The first issue is with their Mobile/cell phone, they can receive emails and send new emails however when they forward or reply it says they don't have permission to do that. This happens when they change phones as it has happen previously with another phone and I found the fix, which I can't find my documented about it and can't find the fix again.

The second is this seems to be for a single sender email. The mail is received and in the inbox then disappears. We have seen them in the inbox and the user has started to read it and then it is removed. I'm thinking spam filtering (using Sophos) however it's not shown up in there, it's not in the deleted items or junk folder either. And when searching the emails are not found.

Thanks

Tim

 

[YeOldeStonecat]

My colleague troubleshot an active sync issue (smart phone) on SBS11 around mid summer...took him a while but he found the issue I'll see if I can find those notes tomorrow. I recall him being deep in ESM.
The disappearing e-mails...first, check via OWA....are all the emails normal there? Or are they disappearing there too? If all e-mails stay there, then your issue with on the local Outlook. Perhaps some rules, or the OST is corrupted (delete and let it rebuild). But start by checking in OWA.

 

[autumn]

Yes Active sync can be a pain to toubleshoot.

Thanks @YeOldeStonecat they disappear from OWA as well. A search from the server doesn't find them either.

 

[autumn]

L forgot to mention that there are no rules on the users mailbox either

I had tried a rules for this sender to forward a copy to myself (an external address) and move it to another folder however that didn't work either

 

[TurricanII]

The last time I had this problem it turned out to be a remote computer or phone was doing its own Junk filtering. I made these notes. It was for an in house Exchange 2010 server:
---
Sometimes we need to enable mailbox audit to be able to track what causes email to be deleted/moved into Junk.

Enabling mailbox owner and delegate movement and deletion of messages with this command:

Set-Mailbox -Identity "John Smith" -AuditOwner HardDelete,Move -AuditEnabled $true
Set-Mailbox -Identity "John Smith" -AuditDelegate HardDelete,Move -AuditEnabled $true

Review the audit logs with this Exchange 2010 command. Note that it takes a good 15 minutes for the results of this command to arrive the recipient Inbox. Also, the results are an XML attachment. Open this as an XML table with Excel:

New-MailboxAuditLogSearch -Mailboxes "John Smith" -StatusMailRecipients "helpdesk@itcompany.com" -StartDate 07/26/2015 -EndDate 07/28/2015 -LogonTypes Owner -ShowDetails

This example entry shows one 'Test email' was deleted from the Inbox (and moved in to Junk) overnight. The culprit was Mac Mail/8.2 on home Mac:

2015-07-27T21:42:24
HardDelete Succeeded
\Inbox
Client=WebServices;UserAgent=Mac OS X/10.10.4 (14E46); ExchangeWebServices/5.0 (213); Mail/8.2 (2102)
IP: 213.133.81.223
Subject: Re. Test email

You should be able to use these commands to find out what is happening to the email.

With regard to the error forwarding emails, are they definitely using ActiveSync - no SMTP/IMAP/POP3?

 

[autumn]

The last time I had this problem it turned out to be a remote computer or phone was doing its own Junk filtering. I made these notes. It was for an in house Exchange 2010 server:
---
Sometimes we need to enable mailbox audit to be able to track what causes email to be deleted/moved into Junk.

Enabling mailbox owner and delegate movement and deletion of messages with this command:

Set-Mailbox -Identity "John Smith" -AuditOwner HardDelete,Move -AuditEnabled $true
Set-Mailbox -Identity "John Smith" -AuditDelegate HardDelete,Move -AuditEnabled $true

Review the audit logs with this Exchange 2010 command. Note that it takes a good 15 minutes for the results of this command to arrive the recipient Inbox. Also, the results are an XML attachment. Open this as an XML table with Excel:

New-MailboxAuditLogSearch -Mailboxes "John Smith" -StatusMailRecipients "helpdesk@itcompany.com" -StartDate 07/26/2015 -EndDate 07/28/2015 -LogonTypes Owner -ShowDetails

This example entry shows one 'Test email' was deleted from the Inbox (and moved in to Junk) overnight. The culprit was Mac Mail/8.2 on home Mac:

2015-07-27T21:42:24
HardDelete Succeeded
\Inbox
Client=WebServices;UserAgent=Mac OS X/10.10.4 (14E46); ExchangeWebServices/5.0 (213); Mail/8.2 (2102)
IP: 213.133.81.223
Subject: Re. Test email

You should be able to use these commands to find out what is happening to the email.

With regard to the error forwarding emails, are they definitely using ActiveSync - no SMTP/IMAP/POP3?

Thanks @TurricanII wIth the log dates are the previous dates or can be in the future dates? And I take it will only show once the previous 2 Audits have been enabled so for example, I how they had issues on Monday, I have enabled the Audits today the log won't show anything as the Audit wasn't enabled on Monday.

With the Activesync I may have a solution just getting the right terminology in searches and using Activesync instead on phone I think I've found the problem. Maybe.

 

[TurricanII]

You are correct - you can only search the logs for emails that disappear AFTER you enabled logging. Also, Exchange 2010 keeps the audit logs for 90 days which should be long enough for your purpose.

 

[autumn]

Another interesting thing, the user had the emails sent to his gmail account and then forwarded them to his exchange account and he said they were there for about 10 seconds and then they deleted/removed themselves.

will let you know what the logs display. It sounds like the spam filter or a rule.

 

[autumn]

OK the issue with the activesync isn't fixed. What I was thinking was the "Include inheritable permissions ......" in the advance settings and security wasn't ticked.

A vague memory from previous fix was something about the size of the file being sent.

 

[autumn]

And the move/deleted audit report shows that activesync is moving the emails

Operation DestFolder Path Name Client Info String Subject
Move \Deleted Items\Unwanted2 Client= ActiveSync;UserAgent=Android-SAMSUNG-SM-G925I/101.60001;Action=/Microsoft-Server-ActiveSync/default.eas?Cmd=MoveItems&User=denis&DeviceId=SEC19BD773500D04&DeviceType=SAMSUNGSMG925I Fwd: RFQ (metalpro)
Move \Deleted Items\Unwanted2 Client= ActiveSync;UserAgent=Android-SAMSUNG-SM-G925I/101.60001;Action=/Microsoft-Server-ActiveSync/default.eas?Cmd=MoveItems&User=denis&DeviceId=SEC19BD773500D04&DeviceType=SAMSUNGSMG925I Fwd: Metalpro RFQ 1711201601 - & Test

If it's a rule shouldn't it show up in Outlook?

 

[TurricanII]

If the Samsung Galaxy S6 Edge mobile is deleting them then it is not a client side rule in Outlook and it is not a server side rule on Exchange.

Ask the end user: "Do you know that when you delete or read emails from your phone that they are deleted or 'marked as read' from your Inbox?"

The end user probably used to use POP3 where a DUPLICATE email was downloaded and they were free to delete that duplicate.

If the end user is deleting a bunch of emails offline out of the office then coming into the office/WiFi range then those deletions will all happen in a batch as soon as the phone gets a connection.

 

[TurricanII]

The Deleted Items\Unwanted folder mentioned in the log you posted is an unusual folder. Here is the answer:

http://exchangeitup.blogspot.co.uk/2014/10/exchange-2010-extra-junk-or-unwanted.html
---
Exchange Extra "Junk" or "Unwanted" Folder Being Added To Outlook

I recently had a user who's Outlook mysteriously created a new folder name "Unwanted" and started filtering all mail into that folder instead of the Inbox. What's also strange, is the Search Folders > Unread Messages didn't reflect the same unread count as the Inbox.

After some routine Outlook diagnosing, I found that the user has a Samsung Galaxy S5, which has it's own SPAM filtering built into the phone. In that SPAM filter, our *@domain.com was listed...along with a bunch of other email addresses that shouldn't have been filtered.
**Note** This issue/fix applies to several model lines of the Samsung Galaxy

Here's what you need to do to fix it:

1. On the phone, open the E-Mail app
2. Hit the Menu Key > Settings > General Settings
3. Select Spam Addresses and look for any errant email addresses, especially *@yourdomain.comentries, which would filter any messages from your domain.
4. Remove those addresses

Now the user can move the messages out of the Unwanted Folder and delete that folder, and email will stop being filtered improperly.

 

[autumn]

Thanks everyone, mainly @TurricanII , 1 problem solved it was the phone spam filtering. bloody phones, I have a S7 edge which doesn't have that feature. Interesting is that it had *@gmail.com which allowed his only gmail to stay until he forwarded the other email through his account. very weird, anyway.

Any ideas about replying and forwarding from the phone? As I said this user had an issue with an earlier phone and from memory it was something to do with the size of the email.