E-mails being deleted, unsure why.

Sep 18, 2013 at 6:44 PM
I have a shared mailbox in Exchange 2010 that a group of individuals have access to. For months now, e-mails are being deleted out of the Inbox and none of the users admit that they are doing it. So, to eliminate that, I've removed their permissions to be able to delete e-mails from all but two individuals that are helping solve this problem. A few weeks went by where e-mails were not deleted and bang, yesterday all e-mails in the Inbox were deleted.

Adding the Modified column shows that the last modified timestamp is 3:22AM.

How do I determine what/who is deleting these items?

I have MFCMapi open to the mailbox and can get to the deleted items in the "Deleted Items" folder and find the properties:

PR_Last_Modification_Time which matches up what Outlook says for modified.


PR_Last_Modifier_Name which shows the name of the Shared Mailbox which is a disabled AD user account that nobody can sign in with.

I am trying to find out what is deleting these e-mails???

Any suggestions are welcome.
Sep 18, 2013 at 6:49 PM