question

67085432 avatar image
0 Votes"
67085432 asked EricYin-MSFT commented

Audit Log doesn't work in Exchange 2013

Hi

I enabled Audit Log for the mailboxes in our organization by enabling AuditEnable value as True. However when I tried to search the log for the actions of the mailbox owner, there's no result. From the official KB, it turns out that auditing of mailbox owner actions can generate a large number of mailbox audit log entries and is therefore disabled by default.

So I enabled the auditing of mailbox owner actions by the cmdlet below. And I did move emails from the Inbox folder to the other folders and delete some emails. However still, the cmdlet search-mailboxaudit returns none. What's the real problem?

Set-Mailbox -Identity <> -AuditOwner "Move,MoveToDeletedItems,SoftDelete,HardDelete" -AuditEnabled $true

https://docs.microsoft.com/en-us/exchange/mailbox-audit-logging-exchange-2013-help
https://docs.microsoft.com/en-us/exchange/enable-or-disable-mailbox-audit-logging-for-a-mailbox-exchange-2013-help

office-exchange-server-administrationoffice-exchange-server-itpro
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

67085432 avatar image
0 Votes"
67085432 answered EricYin-MSFT commented

Hi Eric,

Thanks for your help. This issue has been resolved. I used the cmdlet "Search-MailboxAuditLog -identity <> ", it won't return anything. However if I specify the parameter "LogonTypes" with the value "Owner", then the log came out.

Search-MailboxAuditLog -identity <> -LogonTypes Onwer -ShowDetails

Anyway, thanks again for your information.

· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Thanks for your info, would you accept it as answer to close this thread?

0 Votes 0 ·
EricYin-MSFT avatar image
0 Votes"
EricYin-MSFT answered EricYin-MSFT converted comment to answer

Hi,
Please run the following command to check if the size of folder is 0KB:

 Get-MailboxFolderStatistics User2 |where{$_.Name -like "*audit*"}   

Aslo, check the account you use is in Records Management management role group.

Next step, follow this KB and change the language settings on the server where the searched mailbox is located:
Search-AdminAuditLog and Search-MailboxAuditLog with parameter return empty results



If an Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.





· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

I am writing here to confirm with you how the thing going now?
If you need further help, please provide more detailed information, so that we can give more appropriate suggestions.


If an Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.


0 Votes 0 ·