Hi

I soon give up. I have a customer. 1000 users and 10 users claim that calendar items get deleted - randomly.

I have MailboxAuditLoggin enabled and can see that 

1. item is created
2. items are suddently softdeleted from the calendar (e.g. 10 items at once)

There are not "MovetoDeletedItems" which tells med that the user has shift+deleted many items at once - or something else did this for the user. :-)

The client is Outlook and the user is "Owner"

Any one else seen something like this? What can do this? Virus?

BR
Steen

• Edited by steenpedersen 22 hours 5 minutes ago

My money are on mobile devices. Ask them to temporary disable the sync for any mobile device and see if they can repro the issue. You can apply the same logic to Outlook as well, to make sure no add-ins or other software is interfering - have them run OWA only for a while. Removing all delegate access in the meantime should be an added bonus :)

Thanks for your suggestion.

They are not using ActiveSync but only Good.
When something is made via Good, it is the Good Service Account in the log.

In the Auditlog there is no doubt that this is done via Outlook and by the user (owner).

They don't have iTunes installed, I had hoped they had :-)

I have removed all permissions on their calendars (except for reviewers), but I have not checked for delegates - I should do this tomorrow.

I hate this case :-)

I'll update this thread when I come closer. 

BR
Steen

• Edited by steenpedersen 9 hours 52 minutes ago