Issues with emails being permanently deleted on a random basis

Question

Good Morning,
I have a user reporting that corporate wide emails (emails that go out to all users) are being randomly deleted from a shared mailbox.  The emails are being shift deleted and bypassing the Deleted Items folder.  This is a shared mailbox accessed by
about 7 people.  I spoke to the manager and she "assured" me that no one has been deleting them. There are no Inbox rules and I have used MFCMAPI to verify that there are no hidden or stale rules. My best instincts tell me someone is deleting
the emails, but without some sort of audit trail I cannot prove it.  Aside from that does anyone know what could cause this kind of behaviour
I did enable Audting on the mailbox through the Exchange Managment Shell and verfied by using Get-Mailbox (Mailbox) | FL Name, *Audit* -- I am not getting any results.  I am using the following command:  Search-MailboxAuditLog (mailbox) -LogonTypes
Delegates,Admin -ShowDetails -StartDate "xx/xx/xxxx" | ? {$_.Operation -eq "HardDelete"} | Select Operation, OperationResult,ClientInfoString, MailboxOwnerUPN, LogonUserDisplayName  Looking at a screenshot from an article I found,
it should give me some information, but it does not.  Also, exporting an audit log from the ECP just returns a blank XML file.  Am I doing something incorrectly, or does the auditing not capture this information.  My best instincts tell me someone
is deleting the emails, but without some sort of audit trail I cannot prove it.  I have also considered adding the corporate email addresses into the Reject emails from this sender in the EMC.
Our environment is Exchange Server 2010 with all latest rollups and service packs.  Clients are using Outlook 2010 and Outlook Web Access 2010.
Thank You
Brian Dougherty

Answer 1

Hi,
First, please check if the AutoArchive feature if enabled for this shared mailbox.
Besides, please check if these deleted emails go to the Recover Deleted Items folder.
Did you enable mailbox audit logging before the issue appeared?
I tested in my lab, created a shared mailbox and assigned full access to userA, userA login to this shared mailbox and delete an item to Deleted Items folder. After that, I searched the audit log for shared mailbox, it didn't return results. However, after
a while, I checked again and I got the output. Could you please wait for some time and check it again?
If there is still no any output, as a workaround, you can try to grant Reviewer permission of Inbox folder to those users who want to access shared mailbox instead of full access permission. Then you can check whether corporate wide emails are randomly deleted
from this shared mailbox.
You can use the following command to grant Read-Only Access to a mailbox.
Add-MailboxFolderPermission -Identity [email protected]:\Inbox -User test1 -AccessRights Reviewer
Best regards,
Belinda
Belinda Ma
TechNet Community Support