Some problems require the help of a cup of decent coffee to sort out, especially those ones where things magically disappear for no apparent reason….such as EVPM filters set on the Deleted Items folder of Exchange 2013 mailboxes.
When you set a filter via EVPM, it stores the details of the filter in an item in the associated contents of the mailbox. As it's in the associated contents, the users won't see it but the archiving task will be able to find it and apply it.
We also use the associated contents of the Deleted Items folder for temporarily restoring items to view via OWA. Under normal circumstances, the OWA extensions will remove those items when the user closes them, but if for example, they don't close the item whilst connected to the network, then those temporary items may be left behind.
To mitigate against this, the archiving task checks for such items which are over 2 hours old when it processes the mailbox, and removes them. This is based on a custom MAPI property, the Restored Date, added to the item when it is put there. Prior to Exchange 2013, asking MAPI for all items with a Restored Date older than 2 hours ago returned only those items with a Restored Date of the correct age.
Exchange 2013, however, not only gives all items with a Restored Date older than 2 hours ago, but also returns all items which don't have a Restored Date at all. One example of which, if it exists, is the EVPM filter for the Deleted Items folder. The end result is that every time the archiving task runs against an Exchange 2013 mailbox, it removes the EVPM filter for the Deleted Items folder!
A little tweak made in 11.0.0 CHF2 ensures the archiving task checks the item does actually have a Restored Date before removing it, and the EVPM filter in the Deleted Items folder is safe once more.
Now, where's my mug?