Empty results are returned when you run Search-AdminAuditLog or Search-MailboxAuditLog with a parameter in Exchange Server

Original KB number:  3054391


When you run the Search-AdminAuditLog or Search-MailboxAuditLog cmdlets in Exchange Management Shell together with a Cmdlets or Parameters parameter to filter the results, an empty result set is returned. Even if you run the Search-AdminAuditLog cmdlet without parameters, the full results may not be returned as expected.

This issue occurs in Microsoft Exchange Server 2013 and Exchange Server 2016.


To work around this issue, set language and regional settings for the system and network service accounts to English (United States) on the server where the searched mailbox is located (active copy of database containing the mailbox you are running search for).

  1. Set English (United States) as the primary language.
    1. In Control Panel, open Language.
    2. Add the language of English (United States).
    3. Click Options for the added language.
    4. Click Download and install language pack if it appears.
    5. Click Make this the primary language.
  2. Copy the regional settings.
    1. In Control Panel, open Region.

    2. Select English (United States) as Format in the "Format:" drop down list.

    3. Click the Administrative tab.

    4. On the Administrative tab, click Copy settings.

    5. In the Welcome screen and new user accounts settings dialog box, click to select Welcome screen and system accounts, and then click OK.


      The system accounts include the network service account.

      Select the Welcome screen and system accounts option

    6. Click Change system locale... and set it English (United States).

  3. Restart Exchange Server.

To verify that the language and regional setting is correct, open a Windows PowerShell window and run the Get-UICulture command. The command should return en-US on the Name column.


The MSExchangeDelivery service may not start with Exchange Server. If the service doesn't start, follow these steps:

  1. Change the logon account of the service to Local System.
  2. Revert the logon account to Network Service.
  3. Start the service.


Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.