0

Apologies in advance for possibly not including enough information. In short, I have a few users who are missing a large chunk of emails and it doesn't seem to follow a pattern in terms of what's missing, the length of time, etc... -- for example, one of my users is missing all emails from what appears to be April 2016 to today.

No emails seem to show up in recover deleted items, exchange search dumpster doesn't show up many results either. I thought for sure they had to of archived or autoarchived these emails potentially somewhere, but no .PST files were found in their home directories stored on the network or locally on their computer. The emails also are confirmed missing on all devices as well as webmail. I also get a log of all commands/actions taken on mailboxes in Exchange and I did not come across any actions taken on the users' mailboxes that are missing mail.

We are running Exchange 2010. Is there anywhere someone can recommend I look or start troubleshooting? Appreciate the help in advance!

1 Answer 1

0

Enable mailbox audit log against the affected mailbox. Then, if the issue happens again, check the audit log for details.

Enable Audit log for a mailbox:

Set-Mailbox -Identity user1 -AuditDelegate Create, HardDelete, Move, MoveToDeletedItems, SoftDelete,SendAs,SendOnBehalf -AuditEnabled $true

Search the audit log:

Search-MailboxAuditLog -Identity user1 -ShowDetails -LogonTypes Admin,Delegate,Owner -StartDate 7/1/2017 -EndDate 8/1/2017 | fl >C:\mbaudit.txt  

Note: You can modify the StartDate and EndDate with the actual data.

https://technet.microsoft.com/en-us/library/ff459237(v=exchg.141).aspx

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .