Missing messages - Part 4

The message was delivered to the mailbox - where did it go?

This is the most common scenario [I mean, speaking as one Exchange Admin to another - what else could it be? ;) ].  As a personal aside, your goal is to figure out what happened and calmly point it out to the user.  The user will likely feel embarrassed already - no need to editorialize or lecture.

As discussed in Part 1, a successful message delivery typically means one of the following:

-  It reached the mailbox and was segregated or deleted by a system function

-  It reached the mailbox and was segregated or deleted by a client function

-  It reached the mailbox and was segregated or deleted by a user function

-  It reached the mailbox and was manually segregated or deleted

System function typically means forwarding configured in AD

To check for forwarding, open the Users & Computers console (ADUC) and open the properties of the recipient's object.  On the Exchange General tab go to Delivery Options.  Any forwarding configured at the Active Directory level will appear there.

Client functions include anti-virus/anti-spam filtering, and directing new messages to a personal folder

Check the console and logs of any 3rd-party anti-virus and anti-spam software.  Check the Junk E-mail folder in the user's mailbox.

Check all workstations this user logs on to for a profile that directs all new messages to a Personal Folder instead of to the mailbox.

User functions include rules, auto-archiving, and viewing filters

Check for and disable any viewing filters in Outlook (View-->ArrangeBy-->Custom)

Check for auto-archiving (File-->Archive), look in all Personal folders listed in the Outlook profile.  Search for all PST files on the local drive and all mapped drives.

Check for rules (Tools-->Rules and Alerts)

If the ruleset is empty, there is still a possibility that something formerly in rules is still acting on messages.  To make sure, close Outlook, then launch it again from a command line using the /cleanrules switch (e.g. outlook.exe /cleanrules)

If the ruleset is not empty and you wish to keep them, you can export the set to a file then import again later.

Remember that the Out Of Office function can also have rules.  If OOO is enabled, make sure you check that configuration for rules.

Manual processes initiated by the user

Look for and search any PST files in the Outlook profile and on the local drive.

Look in the Deleted Items folder.  Look at the Recover Deleted Items area.

Search the other folders for items which were Shift-Deleted.

Missing messages - Part 3

Message Tracking sees the message, but it was not delivered to the mailbox

If Message Tracking (MT) has a record of the messsage in question, Exchange has received it.  If it does not reach the mailbox, the message is typically:
-  stuck in a queue
-  stuck in a routing loop
-  segregated by anti-virus/anti-spam filtering

You can often gain insight as to what is happening by reading through the audit trail of the message in MT.

Search the local and inter-server queues on all your servers.  If found, try manually releasing it and see what happens.

Check the logs of any 3rd-party anti-virus and anti-spam software.

Missing messages - Part 2

Message Tracking does not find the message I was expecting, where could it be?

This situation calls for additional sleuthing.  You need to understand your messaging environment and all the systems a message passes through on its way to the Exchange server.  Identify each and check any available logs.  Configuration and operation of routers, firewalls, mail gateways, even managed layer-3 switches can have an effect on inbound mail.

How widespread is this issue?  Does it affect all inbound messages, a significant number of inbound messages, or a small number of inbound messages?  Look for any consistencies (sending domain, sending address, receiving address).

Test inbound routing by sending yourself a message from an outside mail system (e.g. Yahoo, Hotmail, gMail).  Test by sending the affected user a message from that same outside system.

This scenario can get very complicated and vary greatly from environment to environment because you are dealing with any number of different devices and configurations.  Take it systematically, start at the outside and work your way in. Test each step, raise logging levels if necessary.

Missing messages - Part 1

How to start

I have been approached many times by users claiming that they never received a particular Email message. So where does one start looking? Most of the following scenarios have happened to me. The rest are follow-up thoughts of my own.

I start by asking my user some questions:
- What was the sending address?
- Approximately what time was the message sent?
- Are you seeing other messages arrive?
- If necessary may I open your mailbox to investigate?

I could also ask if the sender received a "bounce" message (a.k.a. Non-Delivery Report, a.k.a. NDR), but that tends to take extra coordinative effort. It's easier to assume that the sender is fine and to search for issues in the environment you can control (i.e. your own). Prove your own system sound before trying to look for causes outside. Show that you want to solve problems and not look for someone to blame.

Armed with this information, let's consider some possibilities:
1. It never reached our systems
2. It reached our systems but did not reach Exchange
3. It reached Exchange but was not delivered to the recipient's mailbox
4. It reached the recipient's mailbox but does not appear in the client software

The list is sorted according to message flow, but that does not mean you have to investigate in the same order.

The first question I ask myself is, does Exchange think it was delivered to the recipient's mailbox? Most of the time I find that the message did in fact reach the recipient's mailbox and something was done to it either automatically or manually.

Use Message Tracking (MT) to confirm whether the message was delivered. Use the information obtained from the user as the search parameters. If MT finds the message (regardless of outcome), rule out #1 and #2. If MT reports "Message delivered locally to store", it reached the recipient ruling out #3.

At this point, let's break the investigation into three parts.

If you cannot find the message in MT, continue with Part 2, Message Tracking does not find the message I was expecting, where could it be?

If MT finds the message, but reports something other than "delivered locally", continue with Part 3, Message Tracking sees the message, but it was not delivered to the mailbox

If MT does not find the message, continue with Part 4, The message was delivered to the mailbox - where did it go?

Exchange 5.5 Public Folder Tools

This isn't much of a post, but some people may find it useful. I was searching for the old PFInfo and PFAdmin tools for someone in a forum. All of the hits in my Google searching seemed to be similar queries from people trying to find the old utilities, and no reference to any online sources. The only solutions were that they were supposed to be on the Exch5.5 install CD, or that you had to call Microsoft PSS to get them.

I muddled through and finally came across a reference to our good friends at MSExchangeTeam.com and I knew I was on the right track. I can't take any credit for this, other than to say I persevered. Hopefully future search engine inquiries will find my post and this old lost tool won't be so hard to track down.

For those curious what the big deal is, the newer tool (PFDAVAdmin) doesn't work with Exchange 5.5. If you deal with Public Folder permissions, I strongly advise you check out these tools. They can save you a lot of time.

Finally, without further ado, links to all the tools can be found at: http://msexchangeteam.com/archive/2004/11/05/252979.aspx