This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(259.20000000000005, 9%, 35%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EIM%3C/text%3E%3C/svg%3E)
We have a Generic mailbox , which is being used by around 10 users and they USE VDI machines to access the mailbox in Outlook.
Outlook is constantly deleting emails from the mailbox and I am not able to identify exact user as they are using it with Generic Mailbox Username/password, so even in the Audit Logs it shows the Mailbox Username and even the IP is also a problem as its giving the Gateway IP ,because its a VDI machine.
They are escalating this as they are using the mailbox for Customer Service where in ,email comes to this mailbox and it is forwarded to a SAP server for creation of requests.
Any help would be appreciated, as I am not able to identity from whose outlook its happening .
Remove the ability to access it with a generic username and password. There is no way to identify who is deleting it if you allow that.
In other words, disable the shared mailbox AD account.
Then, delegate access ( full access and send as if needed) to the users who need access:
https://learn.microsoft.com/en-us/exchange/recipients/mailbox-permissions?view=exchserver-2019
Then ensure auditing is enabled for all actions for that mailbox.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(284.8, 17%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EYS%3C/text%3E%3C/svg%3E)
Hi @Imthyas Mahammad ，
Agree with Andy that you can assign full access and send as permission to the users so that they can access the shared mailbox using their own credentials. In this way, you would be able to track who deletes a message after properly configuring the mailbox audit logging.
By the way, if you found any of the replies provided helpful, you can accept it as answer so that others who have a similar question can benefit from your thread. If you still have further concerns on this, feel free to post back.
If an Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(137.6, 98%, 23%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAS%3C/text%3E%3C/svg%3E)
Do you access email on any other devices?
I've had users report similar issues to me in the past and what they were seeing is Outlook resyncing with the server when they open it. They saw messages they had deleted/moved on other devices - cell phone, home computer, etc. - and their office Outlook just updating.
Sorry for the delay, as per the suggestion, i have converted the mailbox to Shared and gave the users access.
Lets see, if they come back.