Recently, I came across an issue with mailbox auditing in the Exchange 2019. 

Issue:

Search-MailboxAuditLog gives no results

[PS] C:\Windows\system32>Search-MailboxAuditLog -Identity “test” -ShowDetails | fl

[PS] C:\Windows\system32>

Assessment/Troubleshooting:

  • Mailbox enabled for auditing

[PS] C:\Windows\system32>Get-Mailbox -Identity test | fl *audit*

AuditEnabled : True

  • Mailbox folder statistics returns the result for audit folder

[PS] C:\Windows\system32>Get-MailboxFolderStatistics test |where{$_.Name -like “*audit*”}

ItemsInFolder        : 500

DeletedItemsInFolder    : 0

FolderSize        : 10.01 MB (10,496,246 bytes)

  • Account running the search command is part of Organization management, records management, recipient management and admin groups
  • Mailbox is not enabled for Audit Bypass
  • Disabled and re-enabled the auditing
  • Database indexes are healthy and Test-ExchangeSearch for the mailbox returns No Error
  • Tried from the EAC -> Compliance Management > Auditing > Run a non-owner mailbox access report and even this did not return any results

Solution:

Set the current system locale to English (United States)

  • Region > Administrative > Copy settings, make sure “Welcome screen and system accounts” is selected:

  • Click “Change system locale…”, make sure the current system locale is set to English (United States):

  • Don’t forget to restart Exchange server after making the modification.

Source Credits:

Though the KB article applies to Exchange 2013 and Exchange 2016, it has been identified that its applicable to Exchange 2019 as well.

https://support.microsoft.com/en-us/help/3054391/search-adminauditlog-or-search-mailboxauditlog-with-parameter-returns

https://social.technet.microsoft.com/Forums/en-US/c10f9756-44d5-4a97-adfe-a7ba3a61d5b3/searchmailboxauditlog-gives-no-results?forum=Exch2019

Happy learning !! 🙂

By Ashok M

A technology enthusiast with 9+ years of experience in Planning, Designing, Implementation, Migration and Operations of various Microsoft Infrastructure & Cloud Services. Extensive knowledge of Cloud Computing, Microsoft Messaging & Collaboration, Digital Transformation, IT Services & Emerging technologies. • One of the Authors of the book – “Reimagine Remote Working with Microsoft Teams : A practical guide to increasing your productivity and enhancing collaboration in the remote world” - https://www.amazon.com/Reimagine-Remote-Working-Microsoft-Teams/dp/1801814163 • Blogger at CloudExchangers - https://cloudexchangers.com/ • Microsoft Community Contributor in Microsoft Q&A - https://docs.microsoft.com/en-us/users/ashokm-8240 • Microsoft Certified Professional in MS Azure, Microsoft365, MS Teams and Skype for Business