Outlook Automatically Deletes Email | Outlook Junk E-mail FilterOutlook Automatically Deletes Email | Outlook Junk E-mail Filter
Background Story
Them: I'm not getting email from Foo User.
Me: According to server logs the message is being received. Are you sure you don't see the message in the Inbox.
Them: Yes, I am sure. The message is not there.
Me: OK, I'll look into it.
Trace/Tail the Message Through the Server
First, trace the message to see where it is going:
Get-MessageTrackingLog -Start "04/20/2021" -Sender This e-mail address is being protected from spambots. You need JavaScript enabled to view it -Recipients This e-mail address is being protected from spambots. You need JavaScript enabled to view it -Resultsize Unlimited -MessageSubject:"foo-subject"
And see if there are any FAIL's:
Get-MessageTrackingLog -EventId FAIL -Start "04/01/2021" -Recipients
This e-mail address is being protected from spambots. You need JavaScript enabled to view it
<null>
This will verify that the message is indeed being received.
Trace/Tail the Message in Outlook
Next, let's take a look at where the messages are in Outlook. This will generate a report and put it in your Mailbox. The report will collect the message info and let us know where the messages are in Outlook:
Get-Mailbox foo.user | Search-Mailbox -SearchQuery {Received:"03/01/2021..04/20/2021" AND Subject:"foo-subject"} -TargetMailbox "my.account" -TargetFolder "SearchAndDeleteLog" -LogOnly -LogLevel Full
The result is that the messages are being received and are in OUTLOOK but they are in the DELETIONS folder and they have not been read:
The DELETIONS folder is a special folder that is different than the DELETED-ITEMS folder. The DELETIONS folder is for email that has been deleted from the DELETED-ITEMS.
How is that happening?
To start with the DELETION folder, let's see how many items are in the DELETIONS folder:
Get-MailboxFolderStatistics foo.user |Select Name, ItemsInFolder |findstr /i deletions
IGNORE
The IGNORE button will automatically send messages-in-the-conversation to the DELETIONS folder.
This can be recovered by:
- -click DELETED-ITEMS (on the left-hand side)
- -click RECOVER-DELETED-ITEMS-FROM-SERVER (at the top)
- -select the messages in the list.
- -click OK to restore.
- -if the IGNORE button is shaded, then IGNORE is turned on. Click it to toggle it OFF.
As an administrator, the only way to see if IGNORE is on is through MFCMAPI (just search for it, comes right up):
- -load the mailbox.
- -QUICK-START > OPEN-FOLDER > IPM_SUBTREE
- -new window opens.
- -click IPM_SUBTREE
- -right-click CONVERSATION-ACTION-SETTINGS
- -click Open-Associated-Contents-Table
This will show if there are any IGNORE conversations with the SUBJECT and DATE so that you can target the message in the RECOVER-DELETED-ITEMS-FROM-SERVER.
Updated Story
Them: The messages are not IGNORED.
Me: hmmm.... Messages are automatically deleted and are not ignored.
Looking into it on the Exchange Server 2013
Just to double-check, let's make sure IMAP and POP are stopped. The reason we want to do this is so that there are no IMAP client problems happeing.
get-service -Name MSExchangeIMAP*
get-service -Name MSExchangePOP*
Even if the services are stopped, we want to check the settings for the services to ensure the LoginType is SecureLogin:
get-ImapSettings |fl
get-POPSettings |fl
get-IMAPSettings |select *log*
get-POPSettings |select *log*
And make sure that the logs are turned on incase something gets turned on by someone else on the team:
Set-ImapSettings -ProtocolLogEnabled $true
Set-PopSettings -ProtocolLogEnabled $true
Also, let's turn off mailbox access to IMAP, POP and OWA:
get-casmailbox | ?{$_.OWAEnabled -eq $true} |set-casmailbox -OWAEnabled $false
get-casmailbox | ?{$_.POPEnabled -eq $true} |set-casmailbox -POPEnabled $false
get-casmailbox | ?{$_.IMAPEnabled -eq $true} |set-casmailbox -IMAPEnabled $false
Check the mailbox Spam Confidence Level (SCL) to see if anything is enabled:
Get-ContentFilterConfig |fl Enabled
Enabled : False
Get-OrganizationConfig |fl *scl*
SCLJunkThreshold : 8
Get-Mailbox foo.user |fl AntispamBypassEnabled
AntispamBypassEnabled : False
Get-Mailbox foo.user |fl SCL*
SCLDeleteThreshold :
SCLDeleteEnabled :
SCLRejectThreshold :
SCLRejectEnabled :
SCLQuarantineThreshold :
SCLQuarantineEnabled :
SCLJunkThreshold :
SCLJunkEnabled :
Junk E-Mail Configuration Exchange
Junk E-mail options are included in Exchange/Outlook. This happens on both the server-side in EXCHANGE but also can happen in the local OUTLOOK client directly as OUTLOOK uses its own SMARTSCREEN filter technology; a client-side filter.
(Note that this is why the settings in EXCHANGE don't always reflect the settings in OUTLOOK.)
This happens because OUTLOOK can be used with accounts other than EXCHANGE accounts. Again, the local OUTLOOK client has its own Junk Mail filter that is independent from the server-side EXCHANGE Junk Mail filter.
To add more, on 11/01/2016, Microsoft stopped generating updates for the OUTLOOK client SMARTSCREEN client-side filter.
As a result, for Email Protection to work properly/efficiently, Junk Email filtering should be:
-enabled in OWA/EMS.
-disabled in Outlook client.
The server-side EXCHANGE filter happens through a hidden INBOX-RULE on the mailbox. Let's see the server-side filter:
Get-InboxRule -Mailbox foo.user
Get-InboxRule -Mailbox foo.user -IncludeHidden
Let's check the configuration for the Junk E-mail on the server-side EXCHANGE. This can be done in the OWA (web email access) or through EMS (Exchange Management Shell); both have the same effect (but does not change the client-filter in OUTLOOK):
Get-MailboxJunkEmailConfiguration foo.user
Let's set the mailbox Junk E-mail Settings:
set-MailboxJunkEmailConfiguration foo.user-enabled $true
(or $false if needing to turn off)
(Note OWA changes can be done via the URL: https://mail.domain.tld/owa/ This e-mail address is being protected from spambots. You need JavaScript enabled to view it /#path=/mail)
While the client-side filter OPTIONS-tab (off | low | medium | high) cannot be changed by settings on the mailbox, the SAFE-SENDERS, SAFE-RECIPIENTS, BLOCKED-SENDERS tabs can be changed on the server which will update the settings in OUTLOOK:
(Get-MailboxJunkEmailConfiguration foo.user).BlockedSendersAndDomains
To set and make changes on the client-side filter and set just one domain:
set-MailboxJunkEmailConfiguration foo.user -trustedsendersanddomains foobar.tld
Or add the domain without changing what is already set in place:
set-MailboxJunkEmailConfiguration foo.user -trustedsendersanddomains @{Add="foobar.tld"}
Headers
With the server-side EXCHANGE settings set, let's look at the message headers to see if there are any server-side junk-email tags in the headers:
Get-Mailbox foo.user | Search-Mailbox -SearchQuery {Received:"03/01/2021..04/20/2021" AND Subject:"foo-subject"} -TargetMailbox "my.account" -TargetFolder "SearchAndDeleteLog"
RESULT: no EXCHANGE tags are found the message headers.
Junk E-Mail Configuration Outlook
Again, to reiterate, the state of the junk email rule on the mailbox doesn't affect the client-side junk email settings that are available in the Outlook Junk Email Filter. Even when the junk email rule is disabled in the server-side mailbox, Outlook can still move messages to the Junk Email folder or automatically delete messages.
When the local client-side Outlook Junk Email Filter is set to Low or High, the Outlook Junk Email Filter uses its own SmartScreen filter technology to identify and move spam to the Junk Email folder. This spam classification is separate from the SCL Junk Email threshold that's configured on the Exchange organization or on the mailbox. In fact, Outlook ignores the SCL value that's set on a message by Exchange (for all SCL values other than -1), and uses its own criteria to determine whether the message is spam.
So how to change the local Outlook Junk Email Filter that uses its own SmartScreen filter technology?
While Microsoft recommends that to enable, disable, and configure the client-side Junk Email Filter settings that are available in Outlook to use Group Policy, there are regedits that can be made to control a policy. When the regedits are made, the setting is greyed-out and cannot be changed by the local account.
On the client system with OUTLOOK, check to see if any policies exist:
reg query HKCU\Software\Policies\Microsoft\office\16.0\outlook
reg query HKCU\Software\Policies\Microsoft\office\16.0\outlook\Options\Mail
Disable the local OUTLOOK client JUNK E-MAIL SMARTSCREEN filter but Options can still be changed (no visual queue shows the filter is disabled):
echo y |reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Outlook" /v DisableAntiSpam /t REG_DWORD /d 1
Change the JUNK E-MAIL OPTIONS to LOW:
echo y |reg add "HKCU\Software\Policies\Microsoft\office\16.0\outlook\Options\Mail" /v JunkMailProtection /t REG_DWORD /d 0xfffffff
Change the JUNK E-MAIL OPTIONS to OFF:
echo y |reg add "HKCU\Software\Policies\Microsoft\office\16.0\outlook\Options\Mail" /v JunkMailProtection /t REG_DWORD /d 4294967295
Updated Story
Them: I am finally getting the report now. Thank you for helping me!
NOTES:
https://docs.microsoft.com/en-us/powershell/module/exchange/set-mailboxjunkemailconfiguration?view=exchange-ps
https://techcommunity.microsoft.com/t5/exchange-team-blog/deprecating-support-for-smartscreen-in-outlook-and-exchange/ba-p/605332