Emails moving to subfolder without a rule action

Question

Emails moving to subfolder without a rule action

Zach 106

We have this user experiencing a weird email issue, some of their emails will automatically move to a subfolder under their inbox even though there is no rule in place to move the email.

we checked outlook desktop rules, and there were some regarding meeting update emails to go to the "Junk" folder, but we have since disabled those to make sure we rule them out, however, they still have an email(s) that move to a subfolder.

we ran a message trace and found the emails in question, and the message trace details show that the email was delivered to the mailbox, but was delivered to an "insert folder name" and mentioned it was because of a rule, but we can't find any.

I'm not sure what else to check on this? Any ideas for audits? Does Outlook Desktop or Outlook Mobile for iOS/Android automatically move email messages if it finds a trend?

Kai Yao 37,776 Reputation points Moderator

2022-05-26T07:38:05.393+00:00

Hi @Zach

Just checking in to see if above information was helpful. Please let us know if you would like further assistance.
If the issue has been resolved, please accept the helpful replies as answers, this will make answer searching in the forum easier and be beneficial to other community members as well.

Answer accepted by question author

0 additional answers

Your answer

Kai Yao 37,776 Reputation points Moderator

2022-05-26T07:38:05.393+00:00

Hi @Zach

Just checking in to see if above information was helpful. Please let us know if you would like further assistance.
If the issue has been resolved, please accept the helpful replies as answers, this will make answer searching in the forum easier and be beneficial to other community members as well.

Answer 1

Vasil Michev 123.4K MVP Volunteer Moderator

Might be a "hidden" rule, which you'll have to delete with a low level tool such as MFCMAPI. Here's a sample article: https://www.slipstick.com/general/clean-out-of-office-rules-using-mfcmapi/

Alternatively, you can use this script to list them all: https://github.com/gscales/O365-InvestigationTooling/blob/master/Get-AllTenantRulesAndForms.ps1

Zach 106 Reputation points

2022-05-20T17:55:08.567+00:00

I'll check out the MFCMAPI tool further, I noticed there were 5 rules in MFCMAPI even though there are only 4 rules the user can see between Outlook Desktop and OWA. Curious if you have any further tips for finding hidden/corrupt rules with MFCMAPI, most of the info in there looks gibberish to me and hard to follow/narrow down what the rule is doing similar to a user friendly view in Outlook Rules section.

As for the script, I tired to run it and granted myself Exchange Admin and Global Admin PIM roles but still couldn't get signed in as it was throwing an access denied.
Vasil Michev 123.4K Reputation points MVP Volunteer Moderator

2022-05-21T06:00:38.12+00:00

Simply look at the names (PR_RULE_MSG_NAME_W property) and delete the one you cannot see in Outlook. Editing a rule via MFCMAPI is not something I'd recommend, and in your case it should not be necessary. Just as reference, the corresponding actions/conditions are in the PR_EXTENDED_RULE_MSG_ACTIONS/PR_EXTENDED_RULE_MSG_CONDITION props respectively (make sure to switch to the Rule filter to "read" them properly).
As for the script, it looks like it has not been updated to support Modern auth, which is the likely reason you're unable to connect.
Zach 106 Reputation points

2022-05-27T16:55:14.777+00:00

thanks for following up, any chance you can let me know how to change to the "rule filter" so i can read to conditions properly?

i was able to find the value PR_EXTENDED_RULE_MSG_ACTIONS/PR_EXTENDED_RULE_MSG_CONDITION but the filter is where I'm still working.
Vasil Michev 123.4K Reputation points MVP Volunteer Moderator

2022-05-27T17:25:50.037+00:00

Do yourself a favor, and simply delete the rule. It will take you a lot less time to recreate it if needed, than to decypher what it does based on the information presented within MFCMAPI.

PR_EXTENDED_RULE_MSG_CONDITION > double-click > expand Smart View at the bottom of the Property Editor dialog > select Extender Rule Condition from the dropdown.
JayceYang 1,571 Reputation points Moderator

2022-06-02T06:49:07.427+00:00

Just circling back to check to see how things are going on with this thread. Should you need more help on this, you can feel free to post back.

If the answer is helpful please click on ACCEPT ANSWER as it could help other members of the Microsoft Q&A community who have similar questions and are looking for solutions.
Zach 106 Reputation points

2022-06-15T01:05:45.093+00:00

sorry, this was a good answer, but even after trying to remove those corrupt rules the user still has the same issue, we've circled back with MS support to get some further support/troubleshooting on fixing the issue. open for other suggestions that may arise.

Share via

Emails moving to subfolder without a rule action

0 additional answers

Your answer