I have customer who has exchange 2010 environment with Outlook 2010 and 2007. Today I was asked to investigate following issue. Manager sent Meeting Request to three external customers using Outlook 2010. After couple of hours he got Acceptation from internal user called Security for the request as well as from other invited people. The problem is he has never sent invitation to Security user so he asked me to check what had happened. I expected easy issue, where user just made simple mistake adding accidently additional address, what I was going to improve using logs. However I was wrong My troubleshooting method. Checked original meeting request e-mail and it was really addressed only to external users, no security e-mail address included. Just in case looked to Delivery report which confirmed this.Looked to Security mailbox and was able to see reply for invitation and record in calendar where apart of all external people as required, the problematic user was included as optional. Compared original message which was sent to three external users and reply to it made by security, a part of time (around 3 hours delay) no difference at all. Checked logs on Exchange server and can see invitation sent to three external addresses but not sent to Security. I can see reply but not message which should be delivered. Even more, the security mailbox hasnt got any e-mail that day.I looked at calendar records on both calendars and Security was as Optional person.Just in case I checked both mailboxes for hard and soft deleted items and wasnt able to find invitation.There is no relation between Manager Calendar and Security Calendar, they dont share them or open. I tried to find any reasonable explanation for this issue, even possible way how it could happened and wasnt able. Is it possible to send invitation other way than e-mail? How it could possibly happened? Could you advise me how to resolve the issue please? Manager really wanders if his invitation is broadcasted over network to people who shouldnt get them.

Any idea about this please? I just stuck and don't know what to do...

Hi piotrkow, Could you please make a test again, confirm whether the issue could be reproduced. If it could be reproduced, check whether there some transport rules do it, especially send the email in BCC method. Please also use get-inboxrule, to confirm it. What about the security user, it seems be created for specific usage. Regards!Gavin TechNet Community Support

Hi Gavin-Zhang, Thank you for reply Ive tried to reproduce it and wasnt able and this is my problem as I have no idea how it could happen. How to send invitation which wont be recorded on outlook or exchange logs? Only reply was recorded. No transport rules, get-inboxrule shows only one default rule for both mailboxes. Security user is just generic one for usage on PC in security room. Couple of people is using it for internet and to send and receive some e-mails from and to management. There is no relation between users in active directory (delegated rights for calendar or mailbox) and it is not created for any special purposes. Any idea how it could possibly happen?

Just to confirm the manager who sent the email doesn't see this in the sent items or in the original meeting invite? Also, you saying message tracking just shows a reply to the meeting but nothing going out? Are there any mobile devices involved here for any of the users?Sukh

Sukh, Thank you for your reply. Manager doesnt see this in the sent items (nor deleted or hardly deleted). In original meeting invite there is no Security user at all. Tracking show replay but nothing coming to security mailbox and there is nothing in inbox of security (nor deleted or hardly deleted items). There is Samsung Galaxy phone used by manager. Do you think this may be related somehow? Only Manager Mailboxes are on the device. Once again, thank you for your help.

It could be to do with the mobile device, I've seen similar issues around this. As you can't reproduce the issue, it's going to be hard to get to the bottom of this. Can you check the Samsung? Sukh

Could you tell me what I need to check on Samsung please? I looked at it wasn't able to see any unusual things.<o:p></o:p>

Nothing in particular, just check to see the meeting and if there's any assoication on with the Security mailbox.Sukh

I will have a look at it, thank you.

because of it being a "security" mailbox I would ask if they have access to the managers mailbox. If they do, what happens if they open his calendar while logged into to their mailbox and saves/accepts the invite? I am just throwing out a wild guess here as I do not know what would or even if that is possible. Chris Morgan

Chris, Security doen't have access to managers mailbox for sure.

What was the details of the meeting request? was there any resource objects involved? do you have a 3rd party application that handles any of the scheduling?Chris Morgan

Hi piotrkow, Per your description, you can't reproduce the issue, right? Please use get-mailbox to retrieve the information about the security mailbox, and post them here. Regards!Gavin TechNet Community Support

Chris, It was standard meeting request which invited 3 people. Resource (room) was involved. No 3^rd party application was used.

Hi Gavin Thank you for your reply. Unfortunately not able to reproduce the issue - simply no idea how it could happen.<o:p></o:p> Im not quite sure what details do you mean as basic command shows only information below. Could you post full command if this one is not enough please? Name Alias ServerName ProhibitSendQuota ---- ----- ---------- ----------------- Security Security servername unlimited

Hi piotrkow, Maybe you could use get-mailbox -identity xx |fl then you could get more detailed infoamtion about the mailbox. Due to you could not reproduce the issue, It is difficult to confirm the exact cause for your issue further. Or you could make a phone call support from MS. Regards!Gavin TechNet Community Support

Hi Gavin, Thanks for your reply. I know that this is extremely difficult to find what cause the problem if Im not able to reproduce the issue. Im just looking even for possible way to do this. Im not able to phone to MS as no support contract on please because it is too expensive. RunspaceId : d90846c4-07d8-488e-9a21-bd84ce0923ab Database : Mailbox Database UseDatabaseRetentionDefaults : True RetainDeletedItemsUntilBackup : False DeliverToMailboxAndForward : False LitigationHoldEnabled : False SingleItemRecoveryEnabled : False RetentionHoldEnabled : False EndDateForRetentionHold : StartDateForRetentionHold : RetentionComment : RetentionUrl : LitigationHoldDate : LitigationHoldOwner : ManagedFolderMailboxPolicy : RetentionPolicy : AddressBookPolicy : CalendarRepairDisabled : False ExchangeGuid : ExchangeSecurityDescriptor : System.Security.AccessControl.RawSecurityDescriptor ExchangeUserAccountControl : None MessageTrackingReadStatusEnabled : True ExternalOofOptions : External ForwardingAddress : ForwardingSmtpAddress : RetainDeletedItemsFor : 30.00:00:00 IsMailboxEnabled : True Languages : {en-IE} OfflineAddressBook : ProhibitSendQuota : unlimited ProhibitSendReceiveQuota : unlimited RecoverableItemsQuota : unlimited RecoverableItemsWarningQuota : unlimited DowngradeHighPriorityMessagesEnabled : False ProtocolSettings : {HTTP11, OWA1} RecipientLimits : unlimited IsResource : False IsLinked : False IsShared : False LinkedMasterAccount : ResourceCapacity : ResourceCustom : {} ResourceType : SamAccountName : Security SCLDeleteThreshold : SCLDeleteEnabled : SCLRejectThreshold : SCLRejectEnabled : SCLQuarantineThreshold : SCLQuarantineEnabled : SCLJunkThreshold : SCLJunkEnabled : AntispamBypassEnabled : False ServerLegacyDN : /o=First Organization/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Co nfiguration/cn=Servers/cn=servername ServerName : servername UseDatabaseQuotaDefaults : False IssueWarningQuota : unlimited RulesQuota : 64 KB (65,536 bytes) Office : UserPrincipalName : Security@domain.local UMEnabled : False MaxSafeSenders : MaxBlockedSenders : ReconciliationId : WindowsLiveID : ThrottlingPolicy : RoleAssignmentPolicy : Default Role Assignment Policy SharingPolicy : Default Sharing Policy RemoteAccountPolicy : MailboxPlan : ArchiveDatabase : ArchiveGuid : 00000000-0000-0000-0000-000000000000 ArchiveName : {} ArchiveQuota : unlimited ArchiveWarningQuota : unlimited ArchiveDomain : ArchiveStatus : None RemoteRecipientType : None DisabledArchiveDatabase : DisabledArchiveGuid : 00000000-0000-0000-0000-000000000000 QueryBaseDNRestrictionEnabled : False MailboxMoveTargetMDB : MailboxMoveSourceMDB : MailboxMoveFlags : None MailboxMoveRemoteHostName : MailboxMoveBatchName : MailboxMoveStatus : None IsPersonToPersonTextMessagingEnabled : False IsMachineToPersonTextMessagingEnabled : True UserSMimeCertificate : {} UserCertificate : {} CalendarVersionStoreDisabled : False ImmutableId : PersistedCapabilities : {} SKUAssigned : False AuditEnabled : False AuditLogAgeLimit : 90.00:00:00 AuditAdmin : {Update, Move, MoveToDeletedItems, SoftDelete, HardDelete, FolderBind, SendAs, SendOnBehalf, Create} AuditDelegate : {Update, SoftDelete, HardDelete, SendAs, Create} AuditOwner : {} WhenMailboxCreated : 16/12/2011 13:18:02 UsageLocation : Extensions : {} HasPicture : False HasSpokenName : False AcceptMessagesOnlyFrom : {} AcceptMessagesOnlyFromDLMembers : {} AcceptMessagesOnlyFromSendersOrMembers : {} AddressListMembership : {\Default Global Address List, \All Users} Alias : Security ArbitrationMailbox : BypassModerationFromSendersOrMembers : {} OrganizationalUnit : OU CustomAttribute1 : CustomAttribute10 : CustomAttribute11 : CustomAttribute12 : CustomAttribute13 : CustomAttribute14 : CustomAttribute15 : CustomAttribute2 : CustomAttribute3 : CustomAttribute4 : CustomAttribute5 : CustomAttribute6 : CustomAttribute7 : CustomAttribute8 : CustomAttribute9 : ExtensionCustomAttribute1 : {} ExtensionCustomAttribute2 : {} ExtensionCustomAttribute3 : {} ExtensionCustomAttribute4 : {} ExtensionCustomAttribute5 : {} DisplayName : Security EmailAddresses : {smtp:Security@domain.local, X400:C=US;A= ;P=First Organizati;O=E xchange;S=Security;, SMTP:Security@domain.com} GrantSendOnBehalfTo : {} ExternalDirectoryObjectId : HiddenFromAddressListsEnabled : False LastExchangeChangedTime : LegacyExchangeDN : /o=First Organization/ou=first administrative group/cn=Recipients/cn=Security MaxSendSize : unlimited MaxReceiveSize : unlimited ModeratedBy : {} ModerationEnabled : False PoliciesIncluded : {{ECE3E9AC-7697-4D2C-ACB6-A58FBA3E1DBA},{26491CFC-9E50-4857-861B-0CB8DF22B5D7} } PoliciesExcluded : {} EmailAddressPolicyEnabled : True PrimarySmtpAddress : Security@domain.com RecipientType : UserMailbox RecipientTypeDetails : UserMailbox RejectMessagesFrom : {} RejectMessagesFromDLMembers : {} RejectMessagesFromSendersOrMembers : {} RequireSenderAuthenticationEnabled : False SimpleDisplayName : SendModerationNotifications : Always UMDtmfMap : {} WindowsEmailAddress : Security@domain.com MailTip : MailTipTranslations : {} PartnerObjectId : 00000000-0000-0000-0000-000000000000 IsValid : True ExchangeVersion : 0.10 (14.0.100.0) Name : Security DistinguishedName : CN=Security,OU=SBSUsers,OU=Users,OU=MyBusiness,DC=domain,D C=local Identity : domain.local/MyBusiness/Users/SBSUsers/Security Guid : 7927b637-3b93-4eeb-980d-2a2af34524e9 ObjectCategory : domian.local/Configuration/Schema/Person ObjectClass : {top, person, organizationalPerson, user} WhenChanged : 29/06/2012 16:08:24 WhenCreated : 02/04/2009 16:18:42 WhenChangedUTC : 29/06/2012 15:08:24 WhenCreatedUTC : 02/04/2009 15:18:42 OrganizationId : OriginatingServer : SERVERNAME.domain.local

I wonder if there could be a delegate issues here? Messages do NOT just get sent to a recipient, however we all know a user can make setting changes and not realise the impact. If the Security mailbox was at some point set up as a delegate, or if messages were being reouted there via mailbox config, that might explain this. Just a few outside the box ideas :)

Hi SG_Dan, What is the delegate issue you mention in here? can you be specific as I have customer facing the similar issue that meeting request sent to wrong recipient who are users either internet or internal. There are few users affected now and expected more will come and what is the next action plan?? Please advise... Thanks alot