Recently, I came across an issue with mailbox auditing in the Exchange 2019. 

Issue:

Search-MailboxAuditLog gives no results

[PS] C:\Windows\system32>Search-MailboxAuditLog -Identity “test” -ShowDetails | fl

[PS] C:\Windows\system32>

Assessment/Troubleshooting:

  • Mailbox enabled for auditing

[PS] C:\Windows\system32>Get-Mailbox -Identity test | fl *audit*

AuditEnabled : True

  • Mailbox folder statistics returns the result for audit folder

[PS] C:\Windows\system32>Get-MailboxFolderStatistics test |where{$_.Name -like “*audit*”}

ItemsInFolder        : 500

DeletedItemsInFolder    : 0

FolderSize        : 10.01 MB (10,496,246 bytes)

  • Account running the search command is part of Organization management, records management, recipient management and admin groups
  • Mailbox is not enabled for Audit Bypass
  • Disabled and re-enabled the auditing
  • Database indexes are healthy and Test-ExchangeSearch for the mailbox returns No Error
  • Tried from the EAC -> Compliance Management > Auditing > Run a non-owner mailbox access report and even this did not return any results

Solution:

Set the current system locale to English (United States)

  • Region > Administrative > Copy settings, make sure “Welcome screen and system accounts” is selected:

  • Click “Change system locale…”, make sure the current system locale is set to English (United States):

  • Don’t forget to restart Exchange server after making the modification.

Source Credits:

Though the KB article applies to Exchange 2013 and Exchange 2016, it has been identified that its applicable to Exchange 2019 as well.

https://support.microsoft.com/en-us/help/3054391/search-adminauditlog-or-search-mailboxauditlog-with-parameter-returns

https://social.technet.microsoft.com/Forums/en-US/c10f9756-44d5-4a97-adfe-a7ba3a61d5b3/searchmailboxauditlog-gives-no-results?forum=Exch2019

Happy learning !! 🙂

By Ashok M

Microsoft Certified Professional, Blogger, Author at Cloudexchangers.com, Real world technical contribution via Microsoft Communities (Social Technet/QnA). Extensive knowledge and experience in Messaging (Microsoft Exchange 2003 - 2019) and services including Infrastructure (Windows Server, Active Directory, ADFS, ADCS, File Servers, SCCM), Cloud (Microsoft Azure, Microsoft 365, EMS), Unified Communication (Skype for Business, Video conferencing room systems, Surface Hub), Virtualization (Hyper V), Database (SQL). Have experience in design, implementation, migration & support for various Microsoft infrastructure products across various industry verticals. Currently working as "Implementation Engineer" with the UAE's first tier IV Data Center design certification in the region.

Leave a Reply

Your email address will not be published. Required fields are marked *