Shortcuts missing from users mailboxes

[nils35]

Hi,

Anyone got an idea why all shortcuts are suddenly missing from several users mailboxes? The mailbox policy is configured to delete shortcuts after 6 months and its been working like this for years.

Thanks.

[GertjanA]

Did you by any chance upgraded Outlook to 2013? There was an issue with displaying the icons properly. See http://www.symantec.com/docs/TECH213877 for more info.

If this is not the case, it might be users have created rules themselves, or an Exchange Managed Policy has been applied, or users were added to a Provisioning Group that has a different setting (i.e. another archiving policy)

I don't think the shortcuts disappear 'suddenly'. It must be something else doing this, especially seeing you say it worked fine for years.

[nils35]

Thanks for your reply.

We use Office 2010 and the entire messages are gone, not just the icons. Note that the clock icon on the items archived last night is present in the mailboxes.

I have checked several random users and none of them have created any rules manually.

Exchange Managed Policy is not used.

There are only three mailbox policies configured and all of them have delete shortcuts after 6 months.

[JesusWept3]

What version of EV? Did you check the reports to see if it was shortcut expiry deleted more shortcuts than normal? What is the oldest shortcut you've been able to find thus far? May be worth checking with the exchange team to make sure they didn't run any powershell scripts to purge certain message classes Other than that you may need to enable auditing on a couple of mailboxes and look at what time messages are being deleted and by who etc Also are the messages in the recover deleted items in outlook or have they been hard deleted?? You could also DTrace archivetask next time to see if it's deleting items outside of policy

[nils35]

Thanks for your reply.

Its EV 8.0 SP5. I have been looking at the MovedItemsUpdateSummary_BGO-P-EX-07_date.txt report files, but I am not sure what I should look for exactly.

I can't find any shortcuts. The oldest trace of EV is the messages archived last night having the clock icon waiting to be backed up. I am also the Exchange admin here and I did not run any scipts to purge these messages. There are no messages in the Recover Deleted Items.

[JesusWept3]

ok not sure about 8 but the report would look like

EV_MBXSHORTCUTDELETION_exchangeServerName_YYYYMMDDhhmmss.txt


How are you searching for the shortcuts btw?
The best way to search for them is

1. Open Outlook
2. Hold Ctrl+Shift and press F
3. Next to Look choose "Any Type of Outlook Item"
4. Press the "Browse" button 
5. Make sure the root of the mailbox is checked
6. Make sure "Search Subfolders" is checked
7. Press OK
8. Click the Advanced tab.
9. Press the "Field" drop down menu and go to "All Mail Fields" and select "Message Class"
10. Under "Condition" choose "Contains"
11. in the Value box type "EnterpriseVault" and press "Add To List"
12. Press Find Now

This should return any shortcuts in the mailbox, when it returns you will see the folder that it exists in etc

You may need to try and repro the issue and dtrace archivetask to see whats going on

 

[nils35]

The latest file I have starting with the name EV_MBXSHORTCUTDELETION is from 2009, so it doesn't seem to create these any more...

I tried searching like you specified, but I still only find the messages which were archived last night having the clock icon.

I have created a case with Symantec Support now and hopefully they can help me figure this out.

[nils35]

Do you know if there is any reason why the reports like EV_MBXSHORTCUTDELETION_exchangeServerName_YYYYMMDDhhmmss.txt is not being created? Is there any place where this may have been disabled?

Thanks.

[nils35 · Accepted solution]

I feel like talking to myself here, but in case anyone get this same problem in the future I will post the solution. This happened because we had changed from archived date to modified date on the Storage Expiry tab.

Enterprise Vault uses the modified date or archived date to determine the age of a shortcut. You can specify which date to use on the Storage Expiry tab of Site Properties.

Thanks to all of you who tried helping on this issue.

[GertjanA]

Thanks for letting us know. It is however strange the report is not created anymore. If a question remains unanswered,mit is probably because we're out of ideas also. Best bet is then to call support. Be advised that your ev-version 8 is no longer supported i believe. Start thinking about upgrading!

[nils35]

We still get support from Symantec, but we are in the middle of planning to upgrade so hope to get it done this year or early next year. I will ask Symantec about the lack of logging.