Search-AdminAuditLog and Search-MailboxAuditLog with parameter return empty results

Original KB number:  3054391


When you run the Search-AdminAuditLog or Search-MailboxAuditLog cmdlets in Exchange Management Shell together with a Cmdlets or Parameters parameter to filter the results, an empty or incomplete result set is returned. Even if you run the Search-AdminAuditLog cmdlet without parameters, the full results might not be returned as expected.


You might be able to work around this issue depending on the language settings on the server where the searched mailbox is located (active copy of database containing the mailbox you are running search for). On the server, open the Welcome screen and new user accounts settings dialog box in the Region settings and check the Format setting for Welcome screen. If Format is not set to English (United States), follow these steps to set the language and regional settings for the system and network service accounts:

  1. Set English (United States) as the primary language.
    1. In Control Panel, open the Language item.
    2. Add the language of English (United States).
    3. Select Options for the added language.
    4. Select Download and install language pack if this option is available.
    5. Select Make this the primary language.
  2. Copy the regional settings.
    1. In Control Panel, open the Region item.

    2. Select English (United States) in the Format list.

    3. Open the Administrative tab, and select Copy settings.

    4. In the Welcome screen and new user accounts settings dialog box, select Welcome screen and system accounts, and then select OK.


      • The system accounts include the network service account.
      • You can revert the Format setting for Current user to the original value as long as Format for Welcome screen is set to English (United States).

      Screenshot that shows the Welcome screen and system accounts option is selected.


The MSExchangeDelivery service may not start together with Exchange Server. If the service doesn't start, follow these steps:

  1. Change the logon account of the service to Local System.
  2. Revert the logon account to Network Service.
  3. Start the service.


Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.