Search-MailboxAuditLogs Issue in Exchange 2019

By Ashok M

Recently, I came across an issue with mailbox auditing in the Exchange 2019. 

Issue:

Search-MailboxAuditLog gives no results

[PS] C:\Windows\system32>Search-MailboxAuditLog -Identity “test” -ShowDetails | fl

[PS] C:\Windows\system32>

Assessment/Troubleshooting:

  • Mailbox enabled for auditing

[PS] C:\Windows\system32>Get-Mailbox -Identity test | fl *audit*

AuditEnabled : True

  • Mailbox folder statistics returns the result for audit folder

[PS] C:\Windows\system32>Get-MailboxFolderStatistics test |where{$_.Name -like “*audit*”}

ItemsInFolder        : 500

DeletedItemsInFolder    : 0

FolderSize        : 10.01 MB (10,496,246 bytes)

  • Account running the search command is part of Organization management, records management, recipient management and admin groups
  • Mailbox is not enabled for Audit Bypass
  • Disabled and re-enabled the auditing
  • Database indexes are healthy and Test-ExchangeSearch for the mailbox returns No Error
  • Tried from the EAC -> Compliance Management > Auditing > Run a non-owner mailbox access report and even this did not return any results

Solution:

Set the current system locale to English (United States)

  • Region > Administrative > Copy settings, make sure “Welcome screen and system accounts” is selected:

  • Click “Change system locale…”, make sure the current system locale is set to English (United States):

  • Don’t forget to restart Exchange server after making the modification.

Source Credits:

Though the KB article applies to Exchange 2013 and Exchange 2016, it has been identified that its applicable to Exchange 2019 as well.

https://support.microsoft.com/en-us/help/3054391/search-adminauditlog-or-search-mailboxauditlog-with-parameter-returns

https://social.technet.microsoft.com/Forums/en-US/c10f9756-44d5-4a97-adfe-a7ba3a61d5b3/searchmailboxauditlog-gives-no-results?forum=Exch2019

Happy learning !! 🙂

 Category: Exchange
About Ashok M

Microsoft Certified Professional with key technical skills including Microsoft Exchange, Windows Server, Microsoft Azure, Office 365, Intune, EMS, Skype for Business, Active Directory, ADFS and has got more exposure to Hyper V, System Center Configuration Manager, Virtualization, Video conferencing room systems, SQL. Have experience in design, implementation, migration & support for various Microsoft infrastructure products. Currently working as "Implementation Engineer" with the UAE's first tier IV Data Center design certification in the region.

Related articles

Leave a Reply