Mail dissapeared

[parker309]

I have a fairly large Exchange 2K network (about 350 users) and I have ONE user whose Inbox just "cleared" itself. She went to lunch with 240MB in her Inbox and came back with nothing left. The rest of her folders within her mailbox are fine. She started with 440MB in her total mailbox and now the Exchange Store is showing her at 200MB. The mail is gone from within Exchange. I initially thought it was a view or a filter set, but since the Exchange Store is showing the reduced size I am concerned it is gone.

I am currently building a restore Exchange server to restore the entire store from tape but wanted some feed back. Any thoughts would be much appreciated. Thanks in advance.

 

[zoeythecat]

You sure she does not have the "Delivery" set in her outlook to go to "personal folders"? Check her outlook client to verify this.

 

[paulha]

check auto archiving to pst too

 

[parker309]

The delivery is still set to the Exchange account and Auto-archive is disabled. Any other thoughts? Thanks.

 

[paulha]

check exchange permissions, and client permissions to her mailbox, poss somebody else who has access has deleted them ?

 

[parker309]

No body has permissions to her mailbox except for administrators and none of us did anything to her mailbox. Has anyone ever seen an exchange server just strip all active mail out of a mailbox? Since this happened her mail is functioning properly but I am concerned this is only a matter of time before it happens again. Thanks for all your replys.

 

[paulha]

I would look closely in the User's direction.

In my experience, a computer never does anything "itself" unless it is told to.

If you didnt change anything, and nobody else has permissions to the mailbox, it points to the user.

 

[zoeythecat]

Any rules setup in Rules Wizard? Do you have deleted item retention setup on Exchange Server for an x number of days? If you do you may be able to recover from her outlook client by clicking on the "deleted items" bucket and do a "Tools" "Recover Deleted Items"

 

[NetworkDOC]

Sounds kinda like either outlook express (or another outlook user logged in and sucked the mail to a personal folder. With or without her permission....

 

[dan]

Not to contradict the good advice given, but we have had the same thing happen 3 times over the last few years (about once a year). This happend with our Exchange 5.5 servers and now the most recent time was this fall with our Exchange 2003 server. The user was working from our computer lab where the clients are locked down. She was using Outlook with no rules turned on and was the only one with access to her account. Messages started disappearing before her eyes. She rebooed the computer and loggeg back into Outlook only to see her inbox continue be delete messages.
We never could find the cause (suspected a stuck key?) and had to rebuild a recover server as well. It was very frustrating.

Dan

 

[lhuegele]

Make sure that this user doesn't have the POP protocol enabled. It sounds like someone POP'ed in and downloaded the email off the server. We had this happen one time and it turned out that the user had gone home for vacation and POP'ed right into their account, which downloaded all the messages to their computer at home. For this reason, we disable the POP protocol for all users except those that use it (which is very few). If POP protocol is on for the user, but the user didn't do it, I would suspect that someone has access to the users account and would have them change their password immediatly.

Good luck,
Larry

 

[parker309]

Thanks for all the great replys. We do not support POP or IMAP. Users only connect through the Outlook client via corporate mode or through OWA and the Web. We are resorting to restoring the database from tape and recovering the mail via a package called Aelita Recovery Manager for Exchange. Thanks again for all your help.

 

[kmcferrin]

The only time that I have seen this happen is when people either POP into their mailbox or otherwise download the messages.

For awhile when my company was just opening, we only had external email via a POP account at our ISP, so email was configured to deliver to a .PST in our default installs. Later on when we moved to Exchange we changed everybody's mail delivery locations to the server. However, on some of the original PCs the Office installation was never updated, so any new users who logged into the PC were delivering to .PST by default. Nobody noticed until one of the VPs "borrowed" someone else's computer to check their mail and ended up with the old settings on that profile. When she went back to her desk her mailbox was empty.

 

[lhuegele]

Yes, and although you don't support POP or IMAP, I believe these two protocols are turned ON by default, but I'm not sure. Seems to be ON whenever we add new users to AD so we have to manually turn them off each time.

 

[parker309]

POP and IMAP are turned on within Exchange but our firewall does not allow traffic on these ports. I suppose it is conceivable that someone "inside" used OE, but unlikely unless the password of the user was comprimised, because the affected user did not use OE.

 

[kmcferrin]

You wouldn't need to use OE to use POP or IMAP from the inside, nor would they need POP or IMAP to download the messages locally and clear the Exchange server mailbos. As I outlined earlier, an incorrectly configured Outlook installation can do the same thing using only MAPI.