Recently, I came across an issue with mailbox auditing in the Exchange 2019.
Issue:
Search-MailboxAuditLog gives no results
[PS] C:\Windows\system32>Search-MailboxAuditLog -Identity “test” -ShowDetails | fl [PS] C:\Windows\system32> |
Assessment/Troubleshooting:
- Mailbox enabled for auditing
[PS] C:\Windows\system32>Get-Mailbox -Identity test | fl *audit* AuditEnabled : True |
- Mailbox folder statistics returns the result for audit folder
[PS] C:\Windows\system32>Get-MailboxFolderStatistics test |where{$_.Name -like “*audit*”} ItemsInFolder : 500 DeletedItemsInFolder : 0 FolderSize : 10.01 MB (10,496,246 bytes) |
- Account running the search command is part of Organization management, records management, recipient management and admin groups
- Mailbox is not enabled for Audit Bypass
- Disabled and re-enabled the auditing
- Database indexes are healthy and Test-ExchangeSearch for the mailbox returns No Error
- Tried from the EAC -> Compliance Management > Auditing > Run a non-owner mailbox access report and even this did not return any results
Solution:
Set the current system locale to English (United States)
- Region > Administrative > Copy settings, make sure “Welcome screen and system accounts” is selected:
- Click “Change system locale…”, make sure the current system locale is set to English (United States):
- Don’t forget to restart Exchange server after making the modification.
Source Credits:
Though the KB article applies to Exchange 2013 and Exchange 2016, it has been identified that its applicable to Exchange 2019 as well.
Happy learning !! 🙂