Search-AdminAuditLog and Search-MailboxAuditLog with parameters return empty results

Original KB number:  3054391

Symptoms

In Exchange Management Shell, you run the Search-AdminAuditLog or Search-MailboxAuditLog cmdlets together with a Cmdlets or Parameters parameter to search a mailbox and filter the search results. In this scenario, an empty or incomplete result set is returned. Even if you run the Search-AdminAuditLog cmdlet without parameters, the full results might not be returned as expected.

Resolution

To fix this issue, install the following cumulative updates (CUs), as appropriate:

Cumulative Update 12 for Exchange Server 2019 or a later cumulative update for Exchange Server 2019

Cumulative Update 23 for Exchange Server 2016 or a later cumulative update for Exchange Server 2016

Workaround

If you still see the issue after you install the appropriate cumulative update, check the language format for system accounts. You might have a secondary regional language set as the language format on the server that contains the mailbox that you’re searching.

For example, the following screenshot shows the language format for system accounts set to a secondary language, German (Switzerland), instead of the primary language, German (Germany).

Screenshot of the Welcome screen and new user accounts settings dialog box with the language format for the welcome screen highlighted.

If a secondary regional language is set as the language format, update the format for the system and network service accounts to one of the following primary languages:

  • Arabic (United Arab Emirates)
  • English (United States)
  • German (Germany)
  • French (France)
  • Korean (Korea)
  • Spanish (Spain)

Note: This workaround has been determined to work for these languages only. It doesn’t work for the primary languages Italian (Italy) and Korean (North Korea).

To update the language format, follow these steps:

  1. In Control Panel, select Region.
  2. On the Formats tab, select a primary regional language format, and then select Apply.
  3. On the Administrative tab, select Copy settings.
  4. In the Welcome screen and new user accounts settings dialog box, select Welcome screen and system accounts, and then select OK.

After you complete this step, you don’t have to restart the server or any processes or services.

Notes:

  • The system account includes the network service account. Therefore, these updates apply to both accounts.
  • If you want, you can revert the format of the language setting for Current user to its original value. However, the format of the language setting for Welcome screen must remain set to one of the primary languages that are compatible with this workaround.
  • Usually, the MSExchangeDelivery service starts together with Exchange Server. If the service doesn’t start, follow these steps:
    1. Change the logon account of the service to Local System.
    2. Revert the logon account to Network Service.
    3. Start the service.