The following is the report from Message tracking esults for one sent item from an employee using his iphone's exchange connector to two people in our office. time stamp=the same for all three lines event id deliver event id receive event id submit source= storedriv for all three sourceContent blank;blank; ends with clinettype airsync message id Subject and sender are the same for all three event ids recipients is filled in correctly for the receive and deliver event ids Internal message ID is the same for the receive and deliver event ids client Ip is empty for the deliver line;and the same for the submit and receive event ids client host name is exchangeserver for the delivered line; EXCHANGESERVER for the submit event id line; and EXCHANGESERVER.domain.com for the recieve event id line serverIp is only listed for the receive event id line server host name is exchangeserver for the deliver and receive event id lines; EXCHANGESERVER for the submit line connectorId and Recipient status are blank for all three lines total bytes is 8804 for the receive event id line; 8978 for the deliver event id line; and null for the submit event id line recipient count is 2 for the deliver and receive event id lines; null for the submit line related recipients is blank reference is null in all three return path is the senders email address messageinfo is 04I on the receive event id line; the delivery date on the deliver event id line and blank for the submit line. I looked in the queue viewer and had the user login using OWA per another forum post but the email was not there. We use forefront protection and the email was not in quarantine. Any help is appreciated.

they logged into their owa and did not see the email.

Did he actually peform a search or he just looked in the inbox only? Did you check his dumpster?James Chong MCITP | EA | EMA; MCSE | M+, S+ Security+, Project+, ITIL msexchangetips.blogspot.com

Using search in OWA it was found. I then used advanced search in from their desktop and it was found in the sent items folder. rerunning message tracking still gives the same infor as before one event id as delivered (to the other recipient), one submit event and one receive event. is there a way to avoid this happening?

I would first see if it's reproducible and not some one off thing that the user did unknowlingly. Alot of times I find that the user inadvertently did something. If it's not reproducible I wouldnt spend time on it.James Chong MCITP | EA | EMA; MCSE | M+, S+ Security+, Project+, ITIL msexchangetips.blogspot.com