Active Directory SMTP Account Empties Inbox

[Nattylou]

Hi,

I have had an issue with regards to one specific email address. Suddenly, it stopped receiving emails. No error was sent to the sender, nor was one appearing in the administrator reports.

The spam filter is processing messages sent to this account in the same way as all others and showing them as clean and passed through so they are not stuck there, however, the inbox remains mysteriously empty.

I can send to this address from other accounts on the same domain (i.e. internally) but not from an external account.

I suspected that it was the specific email account that was at fault and so I removed it from that user and they can now receive mail.

I then added the account to my own inbox to test it and my entire inbox immediately emptied itself and there is no sign of the emails that were there anywhere.

Apart from feeling mightily foolish for making all of my own emails disappear, I am foxed as to what is happening with this email address as I've never seen anything like it.

Please can someone help?

Thank you.

 

[noveyron]

Is anything visible in OWA?

 

[Nattylou]

Hi,

thanks for replying.

It doesn't seem to matter where I look (remote desktop, local machine, OWA or on my windows mobile device), they are still missing.

N

 

[noveyron]

Can you explain a little bit more:
What are you using for spam filtering ?
Do internal emails arrive/are visible in the inbox ?

 

[Nattylou]

I am using SpamTitan and the account is set identically to all the others in the organisation, which work with no problem.

Items are not arriving in the inbox at all. They are leaving the sender, who gets no error at all, arriving on the spam server, which is verifying them as clean and passing them through, but then simply disappearing!

Internal emails arrive in the inbox as normal.

Most peculiar.

 

[noveyron]

I am not familiar with SpamTitan, but I would think that there is some oddity configured within your antispam solution with regard to this user account and non delivery of external mail to the mailbox.

I must admit I am a bit lost as to how your mailbox is being emptied. How did you "add this account to your own inbox?" Did you add it as an alias in the email address tab in ADUC? or is it actually an additional user account rather than an alias, and you added this account to your outlook profile?

 

[ShackDaddy]

This sounds like something else to me. Sounds like somewhere there is a POP3 client configured to connect to your server and download mail, and it's hitting whichever mailbox "owns" the smtp address in question. Somewhere there's probably a local .pst or mailbox file that has all the mail from both mailboxes in it. Can you think of anything like that? Maybe even a forward-to-smartphone setup that went awry? Any other 3rd party products besides the anti-spam?

Dave Shackelford
Shackelford Consulting

 

[noveyron]

Yep, I was thinking some kind of pop thing going on originally, but dismissed it as internal emails remain visible?

Its definitely an odd one

 

[ShackDaddy]

Oops, you're right, Novy. I suppose completely disabling SpamTitan for a period of time to see how that changes behavior would narrow things down and tell us whether it plays a part in the disappearance of external mail.

Is the IMF also running? Could someone have configured it to drop mail being sent to that address using the recipient filtering? That would match with this behavior.

Dave Shackelford
Shackelford Consulting

 

[Nattylou]

Wow, what a response!!!

Thank you all so much for jumping on this with such enthusiasm. Here are some responses for you.

NOVEYRON:
"I am not familiar with SpamTitan, but I would think that there is some oddity configured within your antispam solution with regard to this user account and non delivery of external mail to the mailbox.

I must admit I am a bit lost as to how your mailbox is being emptied. How did you "add this account to your own inbox?" Did you add it as an alias in the email address tab in ADUC? or is it actually an additional user account rather than an alias, and you added this account to your outlook profile?"

I have disabled spamtitan for this account and it has made no difference I'm afraid. Plus, it is passing them through as clean and not retaining them there so I don't think that is the issue. I added the SMTP email account bu going into AD, removing it from the User account it was attributed to and adding it to my own, so yes, as an alias in the email address tab.


SHACKDADDY
"This sounds like something else to me. Sounds like somewhere there is a POP3 client configured to connect to your server and download mail, and it's hitting whichever mailbox "owns" the smtp address in question. Somewhere there's probably a local .pst or mailbox file that has all the mail from both mailboxes in it. Can you think of anything like that? Maybe even a forward-to-smartphone setup that went awry? Any other 3rd party products besides the anti-spam? "

I set the server up from scratch, along with all the accounts. It worked really well until I recently. I am not sure whether it stopped working when the SpamTitan server came into play, I don't think it was as I think I would have dealt with it then had that been the case. The account in question is the one I use for IT support and is only ever accessed by me and has never been set up in any way other than as an ost. Also, emails that come in but have a rule applied to them (sorry, I forgot this bit) to put them directly into another folder (server alerts, website registrations) still come through, although that is probably because they come through on a different email address that is an alias for that account. I tried setting up a forward to my own account and the messages did not arrive with me either. I have been back through all the AD settings and compared them with my own (which works fine) and they are identical.

There are no other 3rd party products and I have done a search for ost & pst files on all the machines I have ever accessed this account on and there is nothing showing.

NOVEYRON
"Yep, I was thinking some kind of pop thing going on originally, but dismissed it as internal emails remain visible?

Its definitely an odd one "

I agree!!!!



SHACKDADDY
"Oops, you're right, Novy. I suppose completely disabling SpamTitan for a period of time to see how that changes behavior would narrow things down and tell us whether it plays a part in the disappearance of external mail.

Is the IMF also running? Could someone have configured it to drop mail being sent to that address using the recipient filtering? That would match with this behavior. "

Spamtitan is disabled - no difference!!!

I had not thought to look at the IMF as I did try using that before I installed spamtitan. I am not all that familiar with it but I'm sure I can fathom how to disable it so I'll try that next, thank you!

 

[noveyron]

How / Where did you set up the rules? Outlook?

What does ESM show in terms of size and number of items of the emptied mailboxes

In ESM, what does the message tracking Centre tell you about delivery or otherwise?

 

[Nattylou]

Hi again,

The rules were set up using the Outlook rules wizard.

ESM Shows that there are messages in the emptied mailboxes but I am not sure that helps as I would have thought those numbers include messages in folders other than the inbox, which are still present. I've added the other folders up manually and there seem to be about the same number of emails there as ESM states so I don't think they are being counted in that figure.

I haven't tried the message tracking service because I am not sure it is working - I am not that familiar with that side of ESM. Also, I am not sure how I would locate the message to track it as I never see them come in!

Thanks again for the continuing help.

 

[noveyron]

Have a go at the message tracking, it is pretty intuitive and easy to use once you have switched it on. (You would not need to see the mail come in to the inbox in order to track it, as the tracking tells you whether it has been delivered to the mailbox or not, irrespective of whether you can see it in Outlook or not)

http://support.microsoft.com/kb/246856

If the mail is in fact hitting hitting the mailbox, then I would imagine that it would be something misconfigured in one of the Outlook rules.

If it doesn't hit the mailbox, it will probably be the Spam Titan or IMF, as Dave rightly says above

Keep us posted!