While troubleshooting Outlook synchronisation, we looked at RPC Client Access logs.
We noticed several entries pointing to a long gone legacy Exchange server and to several long gone users/recipients.
Example log entries:
#Fields: date-time,session-id,seq-number,client-name,organization-info,client-software,client-software-version,client-mode,client-ip,server-ip,protocol,application-id,operation,rpc-status,processing-time,operation-specific,failures
2019-10-04T06:11:44.670Z,10817,94,/o=Stad Ieper/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=[censoredexistingrecipient]a86,,OUTLOOK.EXE,15.0.5125.1000,Cached,,,ncacn_ip_tcp,,
DelegateLogon,0,00:00:00.0312500,"Logon:
Delegate, /o=Stad Ieper/ou=
First Administrative Group/cn=Recipients/cn=
sec10in database Mailbox Database A-D last mounted on IEPMAIL.ieper.be at 29/09/2019 16:56:31, currently Mounted; LogonId: 5",
2019-10-04T06:11:45.029Z,10817,156,/o=Stad Ieper/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=[censoredexistingrecipient]a86,,OUTLOOK.EXE,15.0.5125.1000,Cached,,,ncacn_ip_tcp,,DelegateLogon,0,00:00:00.0468750,"Logon:
Delegate, /o=Stad Ieper/ou=First Administrative Group/cn=Recipients/cn=Inf01in database Mailbox Database E-N last mounted on IEPMAIL.ieper.be at 29/09/2019 16:56:31, currently Mounted; LogonId: 9",
Exchange First Administrative Group (referring to legacy Exchange) can still be found in ADSI Edit; but obviously does nog contain any servers or users anymore.
Recipients like sec10 and Inf01 don't exist (neither mailbox nor AD user).
But somehow some kind of Delegate logon entry is generated related to existing recipients (censored in above log entries). Those events happen quiet frequently, several hundred times a day.
Where do they come from and why are they generated ?