Hi

I soon give up. I have a customer. 1000 users and 10 users claim that calendar items get deleted - randomly.

I have MailboxAuditLoggin enabled and can see that 

1. item is created
2. items are suddently softdeleted from the calendar (e.g. 10 items at once)

There are not "MovetoDeletedItems" which tells med that the user has shift+deleted many items at once - or something else did this for the user. :-)

The client is Outlook and the user is "Owner"

Any one else seen something like this? What can do this? Virus?

BR
Steen

• Edited by steenpedersen Wednesday, March 18, 2015 9:17 AM

Thanks for your suggestion.

They are not using ActiveSync but only Good.
When something is made via Good, it is the Good Service Account in the log.

In the Auditlog there is no doubt that this is done via Outlook and by the user (owner).

They don't have iTunes installed, I had hoped they had :-)

I have removed all permissions on their calendars (except for reviewers), but I have not checked for delegates - I should do this tomorrow.

I hate this case :-)

I'll update this thread when I come closer. 

BR
Steen

• Edited by steenpedersen Wednesday, March 18, 2015 9:30 PM

Hi Steen,

Since the MailboxAuditLogging indicates the calendar items are deleted by the Owner. Please check whether there is any retention policy or AutoArchive configured in this mailbox or Calendar folder to automatically delete the Calendar items.

Additionally, please check the mailbox permission or folder permission about Owner permission to this mailbox. And confirm if the items are deleted by these Owner. In Outlook client, check whether there is any Inbox Rule created to manage Outlook folders.

Regards,

Hi,

Any updates?

Regards,

Hi

No not at the moment. The case is still open at the customer, but I haven't heard of any mysterious deletions for the last week. 

BR
Steen

Hi

This is still an ongoing problem.

There are no retention policies and AutoArchiving doesnt move future items to the dumpster?

Only the owner has permissions and there are no doubt that the items are deleted by the owner.
But 10 future calendar items, directly to the dumpster? This means that the user should mark them all "CTRL+click" and then press "shift+delete".

It seems that this only happens when they are connected via VPN.

BR
Steen