I stumbled upon a strange issue where a Exchange Shared mailbox continued moving emails from Inbox to Recoverable Items folder
we have shared mailbox with full access for many people and someone deleted all items in this shared.
I run the command
Search-MailboxAuditLog -identity BelovedCustomersMailbox -LogonTypes Delegate,Owner -ShowDetails
That gives me no result related to the Soft Delete. No error.
It's Exchange Server 2013. On shared mailbox Audit logging has been enabled.
I checked everywhere including:
- mailbox settings in Exchange Server admin portal
- Exchange transport rules
- Exchange Shared Mailbox Inbox Rules - --- Get-InboxRule -IncludeHidden
- No any retention policy
- get-calendarprocessing ---->>> automateprocessing : AutoUpdate
Still with no evidence.
Are there any logs about MoveToDeletedItems? Yes There are 3 records.
Do you added the -Mailbox sharedmailbox when using Get-Inboxrule?
yes
what if you recover these items to the inbox, will them be deleted after a while? No , after recovering items , no any action
Solution 1:
Are there any logs about MoveToDeletedItems? Please also use Get-Mailbox SharedMailbox | FL *Audit* to check what actions could be recorded.
Do you added the -Mailbox sharedmailbox when using Get-Inboxrule?
And what if you recover these items to the inbox, will them be deleted after a while?
You could try repairing the mailbox with New-MailboxRepairRequest.
Sorry that I was meant to add a comment, but it said that the point should be 50 to do so.