Deleted Items folder empties itself... really 1

[tahoe2]

Exch 5.5 SP4 on NT SP6a.

This only happens to one user. Her Deleted Items folder empties every night at slightly different times. Her PC is always off at the time, and no one has logged in as her (I log logon and logoff events) from other workstations.

All the emails in the Deleted Items folder go. They are there in the 'Recover Deleted Items' list, so I know they have actually been deleted.

The user has no rules set up, and archiving is turned off.
I cannot find any reason for this to be happening.
Any help will be greatly appreciated, thanks!

Corie

 

[joepc]

Try just recreating her mailbox.

 

[SimonDavis]

Could it be as simple as the 'empty deleted items folder on exit' option is checked? So when she closes outlokk, it deletes the deleted items.

Depending on the version of Outlook, it should be somewhere in tools/options/other/general.

 

[tahoe2]

This has been happening randomly for a few months. I recreated the mailbox at the start of this problem, to no avail.
Also, since the folder empties when she is not logged in, it's not a setting in her Outlook application (which has all been checked).
Also, there are no limits set for storage so it's not that.

Anything else to try?

Thanks,
Corie

 

[fuego007]

Something HAS to be set somewhere in Outlook for this to happen. Go to Tools|Options|Other and click on Advanced Options. Then click on the 'COM Add-ins' button and check to see if there are any programs listed.

To rule out Outlook and the workstation, physically ensure she has logged out and disconnect her workstation from the network. Then disable her account. If her delete items folder still empties itself, call Microsoft.

This actually sounds like someone is messing with the user (and you). Have you checked the logs to see if someone else is connecting to her mailbox - someone with Exchange admin rights? The deleted items folder DOES NOT empty itself! The fact that this happens with a new mailbox, and with NO OTHER mailbox should tell you this. If I'm right, and you find the culprit, he or she needs to be terminated!

 

[tahoe2]

She is never logged in when this happens, and no one is logged into her mailbox. I log all successful and failed attempts to log into the domain, as well as Exchange login attempts. The closest was last Tuesday when she logged out at 4:07 PM and the deleted items folder emptied at 4:21 PM.

I've checked every setting I can think of, as well as every log file I can find.
The closest thing I can find is that within a few seconds of the last few empties, there is an entry in the Exchange log that looks like this:

/o=Alkar/ou=ALKAR/cn=Configuration/cn=Connections/cn=Internet Mail
Connector (NTSERVER)
/o=Alkar/ou=ALKAR/cn=Configuration/cn=Servers/cn=NTSERVER/cn=Microsoft
Private MDB <9933.275525.1696688620@nelltau.com>
bounceto-9933-1696688620@bounceto.nelltau.com 0 7408 0 0
1
/o=Alkar/ou=ALKAR/cn=Recipients/cn=M

c=us;a= ;p=alkar;l=NTSERVER0409281621TPLRXS81 1000 2004.9.28 16:21:25

I have no idea what this means, (could be nothing) all I know is that it happened at the same time as the delete.

Corie

 

[SimonDavis]

Depends - is that your email domain, and your user?

Or, what part of that entry DO you recognise?

 

[tahoe2]

Our domain is ALKAR. I recognize this part:
/o=Alkar/ou=ALKAR/cn=Configuration/cn=Connections/cn=Internet Mail
Connector (NTSERVER)
/o=Alkar/ou=ALKAR/cn=Configuration/cn=Servers/cn=NTSERVER/cn=Microsoft
Private MDB

But not the Bounce address.

Corie

 

[AKPolarBear]

Did you check that configuration against another without the problem to see what is different?

Does somebody have rights to her inbox?

When was the last time the Exchange server was rebooted?

Did you delete the user entirely off the network and start all over?

 

[tahoe2]

Did you check that configuration against another without the problem to see what is different?"

The config is the same as mine and I have no problems.

"Does somebody have rights to her inbox?"

Just me and the CFO.

"When was the last time the Exchange server was rebooted?"

About a week ago, I installed a critical update. I also deleted the user and recreated everything at around the same time, so far so good...

 

[ALEKSJAY]

I realize this is an old question and might have been solved, but I have a suggestion.
Do any of the people with access to the account(i.e. the CFO and you) have her profile configured in your own outlook? If so, you can verify if the "delete items on exit" is enabled in any of those accounts. If , for Example, the CFO can see both his profile and hers, when he closes Outlook, it will erase her messages if the option is turned on.

 

[tahoe2]

Thanks for responding!
I thought the CFO had to be logged in as her for that to happen. He has since quit and the problem stopped occurring around that same time. I know he had access to her account, so I'm guessing that was it.

Thanks again, and I've filed this answer for future reference!

Corie

 

[ALEKSJAY]

Glad I helped.

Alexis J.