Aaand again…another CRAZY Office365 issue solved, with a resolution out of left field. In this case, the user was having problems when replying to emails; not only did the email get delivered as usual, and the usual sent item was created in Sents, but the original email in the INBOX was being converted to a DRAFT! So if I sent him an email, and he replied to me, I’d get the reply as usual, but my original email, in his inbox, was turning into a draft.
In addition, he complained that his calendar was out-of-sync; things on his phone weren’t showing up in Outlook.
This was definitely one of those doozies that took more than a month to iron out; partly due to the user being a heavy traveler which meant most of the troubleshooting happened remotely. It also seemed to happen in conjunction with a mobile phone issue, and seemed to originally only happen when replies were sent from a mobile phone (IOS/activesync), however after further testing I found it happened on replies through Outlook as well.
I went down several rabbit holes:
- Removed/re-configured activesync connection on phone
- Audited all email/calendar/default calendar settings on phone
- Replaced phone (it was due and had other issues)
- Removed all apps from AzureAD
- Disabled/removed all plugins from Outlook
- Pulled audit logs
- Checked for malicious logins, and ran a malware scan on his PC
Nothing seemed to lead to anything definitive.
Finally after getting unfettered access to both his laptop and phone, I did some testing and determined that it wasn’t just his mobile phone; replies in Outlook were creating the same drafts. In asking him to show me an example of the calendar issue, he accepted an invite on his phone, and verified the appointment showed up on his calendar on his phone. We then checked Outlook Web Access, which also showed the appointment as expected. However when looking at the Outlook calendar, it didn’t show up. In trying to do a “Update Folder” action on Calendar, it presented a “Message Store” sync error, which led me to this KB article.
The KB article mentions looking for existing litigation holds, as the Recoverable Items Quota may be getting maxed out. Sure enough, I followed some other KB articles to find the holds, some of which dated back to a couple years ago, and in running get-mailboxfolderanalytics against the mailbox, the DiscoveryHolds folder was nearly 100gb, which maxed out the Recoverable Items quota.
So the user didn’t get a warning since it was a Discovery Hold quota being met, not an actual mailbox size quota. It also didn’t prevent anything from working, other than the calendar not syncing properly. It just prevented things from working right.
To solve the issue, I found the holds were no longer needed, and was able to remove the holds (I had to go into the Classic Exchange panel to find them), and then ran start-managedfolderassistant against the mailbox. This sees the hold being removed, and actually sets a “delayhold” attribute as true, for 30 days to provide a grace period against removing the hold. (I mean come on!). Since I know this data isn’t needed anymore, I ran set-mailbox -removedelayhold to clear that, and then ran the folder assistant again, which seemed to clear up a bit of the data over a couple hours.
Note that the above resolution steps were found in this informative KB article.
Since then, with the pressure removed from the mailbox, things are now back to normal for the user; his calendar is syncing properly, and the draft emails are no longer being created.
Running a scan for existing holds by looking at the “inplaceholds” attribute could find affected mailboxes. (get-mailbox | ? inplaceholds -ne $null)
WHEW.