emails deleted

Hi @Glenn Maxwell,

Welcome to the Microsoft Q&A platform!

According to your description, it sounds like you're dealing with a couple of complex issues in your Exchange 2016 hybrid environment. Let’s tackle each issue one by one:

Issue 1: Shared Mailbox Emails Getting Deleted

1.Check Mailbox Audit Logs:

You can use the Search-MailboxAuditLog cmdlet to check who is deleting the emails. For example:

Search-MailboxAuditLog -Identity "SharedMailbox" -LogonTypes Delegate -ShowDetails -StartDate "2024-08-01" -EndDate "2024-08-29" | Where-Object {$_.Operation -eq "SoftDelete"}

This command will show you the details of the delegate actions, including deletions.

2.Verify Delegation:

To check if there are any delegates, you can use the Get-MailboxPermission cmdlet:

Get-MailboxPermission -Identity "SharedMailbox" | Where-Object {($.AccessRights -eq "FullAccess") -and ($.IsInherited -eq $false)}

This will list all users who have full access to the shared mailbox1.

Issue 2: Emails Going Directly to Recoverable Items Folder

1.Check for Hidden Rules:

Sometimes, rules might not be visible in the Outlook client but can still exist. You can use the Get-InboxRule cmdlet to check for any hidden rules:

Get-InboxRule -Mailbox "UserMailbox"

2.Mailbox Audit Logs:

Similar to the shared mailbox, you can use the Search-MailboxAuditLog cmdlet to check for deletions:

Search-MailboxAuditLog -Identity "UserMailbox" -LogonTypes Owner -ShowDetails -StartDate "2024-08-01" -EndDate "2024-08-29" | Where-Object {$.Operation -eq "MoveToDeletedItems" -or $.Operation -eq "SoftDelete"}

3.Check for Mobile Device Rules:

Sometimes, rules set up on mobile devices can cause emails to be deleted or moved. Ensure the user checks their mobile email app settings.

By following these steps, you should be able to identify the cause of the email deletions and address the issues.

Please feel free to contact me for any updates. And if this helps, don't forget to mark it as an answer.

Best,

Jake Zhang