Can't enable mailbox audit logs

Hello!
I can't enable mailbox audit logs. I use cmdlet Set-Mailbox -Identity "mailbox" -AuditEnabled $true and Get-Mailbox shows that
audit is enabled. But when i check Get-Mailbox| Get-MailboxFoldersStatistics there is no "Audit" subfolder, and all audit searches also return no results.
I am working now with several Exchange installations (five actually, and one is brand-new test lab) and checked the same in each organization. Result was the same!
I am stronly sure i miss something important, could you point it to me?

Hi,
Please use the following command to check the Mailbox Audit Logging action setting.
Get-Mailbox –Identity “username” | fl name,*audit*
Are there any administrator, delegate, and owner actions in the audit logging configuration for that mailbox? Please post them to check this issue.
If the settings above are configured correctly, only the administrator, delegate, and owner actions specified in the audit logging configuration for the mailbox are logged. And the “Audits” folder will show up after the administrator, delegate,
and owner take the actions specified in the audit logging configuration.
By default, these actions in the audit logging configuration should be like this:
AuditAdmin       : {Update, Move, MoveToDeletedItems, SoftDelete, HardDelete, FolderBind, SendAs, SendOnBehalf, Create}
AuditDelegate   : {Update, SoftDelete, HardDelete, SendAs, Create}
AuditOwner       : {}
By the way, which command do you use to search the audit log?
Mailbox audit logging procedures
https://technet.microsoft.com/en-us/library/ff461939%28v=exchg.150%29.aspx?f=255&MSPPError=-2147217396
Best Regards.
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected]
Lynn-Li
TechNet Community Support

Similar Messages

When enabling Mailbox Audit Logging would take effect?

I enable the Mailbox Audit Logging by the command below, but found it can't take effect
immediately (I have no idea if there is needs some time to replication ,or others in the DC)even I reboot the exchange server.
So my question is if I want to make the "Mailbox Audit Logging" taking effect immediately , what should I do?
Set-Mailbox -Identity "Ben Smith" -AuditEnabled $true
Set-Mailbox -Identity "Ben Smith" -AuditDelegate SendAs,SendOnBehalf ,,,,,,,,-AuditEnabled $true
Set-Mailbox -Identity "Ben Smith" -AuditAdmin MessageBind,FolderBind,,,,,,,, -AuditEnabled $true
Set-Mailbox -Identity "Ben Smith" -AuditOwner HardDelete,,,,,,,, -AuditEnabled $truehttp://technet.microsoft.com/en-us/library/ff461937(v=exchg.141).aspx
Please click the Mark as Answer button if a post solves your problem!

In order to force auditing to run immediately (and be sure it does), you need a few things - you need only one domain controller, and you need to restart the Microsoft Exchange Active Directory Topology service (which will restart all Exchange services)
on all of your Exchange servers. I highly recommend not doing either of these, since they will 1) reduce the availability of your Active Directory, and 2) take all your Exchange databases offline. Auditing will take effect in a short time period
after being set, so all you can do is wait (unless you want to do the above). We do auditing on all our mailboxes and set them when we create the mailbox. That way, we don't need to worry about missing something because it wasn't enabled.
BTW, the above commands don't need all the extra commas, and if you are doing them on a single mailbox, they can be run as a single command:
Set-Mailbox -Identity "Ben Smith" -AuditDelegate SendAs,SendOnBehalf -AuditAdmin MessageBind,FolderBind -AuditOwner HardDelete -AuditEnabled $true

Mailbox Audit Log

Can we backup mailbox audit log? These logs are stored in the recovery folder in each mailbox. Normally it should be backup with mailbox. How can restore and query these logs from after their audit age limit has expired?
Thanks.
Irfan
Irfan Goolab SALES ENGINEER (Microsoft UC) MCP, MCSA, MCTS, MCITP, MCT

Hi Irfan,
Base on my knowledge, you can refer to the following methods to backup audit log:
1. Export mailbox audit logs:
https://technet.microsoft.com/en-us/library/jj150552(v=exchg.150).aspx
2. Audit logs can be found in the eventviewer under MSExchangeManagement, you can save it, as below:
Best regards,
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected]
Niko Cheng
TechNet Community Support

Mailbox auditing log search only shows last 7 days

I have mailbox auditing turned on for a mailbox, and the audit log age limit is set to 90 days. When I run the non admin user access report however it only shows me auditing items for the past 7 days. If i go to powershell, and run search-mailboxauditlog
it shows the same 7 days. Any suggestions?

http://technet.microsoft.com/en-us/library/ff459237(v=exchg.150).aspx
Mailbox audit logs are generated for each mailbox that has mailbox audit logging enabled. Log entries are stored in the Audits subfolder of the audited mailbox Recoverable Items folder. This ensures that all audit logs are available from a single location,
regardless of which client access method was used to access the mailbox or which server or workstation an administrator used to access the mailbox audit log. If you move a mailbox to another Mailbox server, the mailbox audit logs for that mailbox are also
moved because they're located in the mailbox.
By default, mailbox audit log entries are retained in the mailbox for 90 days and then deleted. You can modify this retention period by using the
AuditLogAgeLimit parameter with the
Set-Mailbox cmdlet. If a mailbox is on In-Place Hold or litigation hold, audit log entries are only retained until the audit log retention period for the mailbox is reached. To retain audit log entries longer, you have to increase the retention period by
changing the value for the AuditLogAgeLimit parameter, or export audit log entries before the retention period is reached.
Ed Crowley MVP "There are seldom good technological solutions to behavioral problems."

Enable Security Audit Log

Hi All,
If we will enable Security Audit Log, does it affect the performance of the SAP System.
Please clarify my doubt.
Thanks

Hello Anil, Security audit log is creates archive log file on daily basis. No performance issues will come if you take care of some parameters
The system does not delete or overwrite audit files from previous days, it keeps them until manually deleted. Due to the amount of information that may accumulate, we should archive these files on a regular basis and delete the originals from the application server.
You define the name and location of the files in the profile parameter haanrsau/local/file. When an event occurs that is to be audited, the system generates a corresponding audit record, also called an audit message, and writes it to the file. The audit record contains the following information.
We can define the maximum size of the audit file in the profile parameter rsau/maxdiskspace/local_. The default is 1000000 bytes (= 1 MB). If the maximum size is reached, then the auditing process stops.
Hope it helps.
Regards, Amber S | ITL

Search-MailboxAuditLog is empty - Mailbox Audit Logging not working in Exchange 2013 CU6 environment

Hello,
i activated Mailbox Audit Logging for Admin, delegate and owner with all supported operations (update, delete, etc..)
like mentioned here:
http://exchangeserverpro.com/using-exchange-server-2013-mailbox-audit-logging/
But also two days later (and also one Server reboot later) search-MailboxAuditLog is still empty.
any ideas how to fix this?
Best,
martin

Hi S.Nithyanandham,
i looked up the mailboxfolderstatistics. There are items in the folder:
[PS] C:\Windows\system32>Get-MailboxFolderStatistics mailboxname |where{$_.Name -like "*audit*"}
RunspaceId : a95e32b8-93c3-4330-8d42-45cade9d64d4
Date : 18.09.2014 16:35:20
Name : Audits
FolderPath : /Audits
FolderId : LgAAAADmBpGVdb8iQp3F89WOcmcHAQBpQNFODkTESLeLj74B887wAAAAAAESAAAB
FolderType : Audits
ItemsInFolder : 147
DeletedItemsInFolder : 0
FolderSize : 434.2 KB (444,649 bytes)
ItemsInFolderAndSubfolders : 147
DeletedItemsInFolderAndSubfolders : 0
FolderAndSubfolderSize : 434.2 KB (444,649 bytes)
OldestItemReceivedDate :
NewestItemReceivedDate :
OldestDeletedItemReceivedDate :
NewestDeletedItemReceivedDate :
OldestItemLastModifiedDate :
NewestItemLastModifiedDate :
OldestDeletedItemLastModifiedDate :
NewestDeletedItemLastModifiedDate :
ManagedFolder :
DeletePolicy :
ArchivePolicy :
TopSubject :
TopSubjectSize : 0 B (0 bytes)
TopSubjectCount : 0
TopSubjectClass :
TopSubjectPath :
TopSubjectReceivedTime :
TopSubjectFrom :
TopClientInfoForSubject :
TopClientInfoCountForSubject : 0
SearchFolders :
Identity : mailboxname\Audits
IsValid : True
ObjectState : New
What do you think?
why cant i search and find these entries the auditlog?
best,
martin

Mailbox audit logging

Hi!
We have two exchange servers in our company, ex2010 and ex2013. I set the audit logging to true for some mailbox, but if i run a report at the ex2013 to a specific a mailbox no data at the log. But! if i run a report at the ex2010 ecp website i get information
from the same mailbox (folderbind etc..). I try run a report via shell at the ex2013, no data, same as the gui. The specific mailboxes migrated from ex2010 to ex2013.

Hi ToniSlow,
Thank you for your question.
We could run the following command to make sure the mailbox has been moved to Exchange 2013:
Get-Mailbox <username> | FL
Then we could check the item of “database” if this database is on Exchange 2013.
By my understanding, when we move mailbox to Exchange 2013, the mailbox audit logs for that mailbox are also moved because they're located in the mailbox.
If there are any questions regarding this issue, please be free to let me know.
Best Regard,
Jim
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected]
Jim Xu
TechNet Community Support

Mailbox audit log - Not searchable

Exchange 2010 SP2 RU7
I enabled audit on one mailbox using the Set-Mailbox cmdlet. Here is the audit-specific o/p from the mailbox,
AuditEnabled : True AuditLogAgeLimit : 90.00:00:00 AuditAdmin : {Move, MoveToDeletedItems, SoftDelete, HardDelete} AuditDelegate : {Move, MoveToDeletedItems, SoftDelete, HardDelete} AuditOwner : {Move, MoveToDeletedItems, SoftDelete, HardDelete}
I am trying to track who is deleting objects from the mailbox, so I tested whether auditing is actually logging anything by deleting three items at different times from the mailbox. The I run another cmdlet to test whether an audit folder is there and what
are it's contents,
PS C:\temp\ps> Get-MailboxFolderStatistics -Identity "MBX" | ? {$_.Name -eq "Audits" -and $_.FolderType -eq "Audits"} | Format-Table Identity, ItemsInFolder, FolderSize -AutoSize
Identity ItemsInFolder FolderSize
MBX\Audits 3 5.918 KB (6,060 bytes)
Sure enough there are 3 items in there meaning it's auditing those deletions. BUT when I try to search the audit logs using the below command, I get no results (YES I am using the -ShowDetails switch).
Search-MailboxAuditLog -Identity MBX -LogonTypes Admin,Owner,Delegate -ShowDetails -StartDate "2/1/2014" -EndDate "2/10/2014" | ft Operation, OperationResult, LogonUserDisplayName, ItemSubject, LastAccessed, -AutoSize
If there are results in the audit log, then why is the search-mailboxauditlog not presenting them even with the broadest search criteria? I have tried removing the start and end dates too but no luck.
Really frustrated with these half-baked features Microsoft puts into these products. Can someone help?

Hi,
In order to troubleshoot the issue more efficiently, I need to clarify some information.
1. Did the issue affect all users or only one specific user?
2. Have you tied to extract the result from ECP or using New-MailboxAuditLogSearch?
3. Is there any error message in the event log?
For this issue, could you please test again using this mailbox you mentioned above to check the result? I tested in my lab, search results are outputed after waiting for some time.
Best regards,
Belinda
Belinda Ma
TechNet Community Support

ENABLING OF AUDIT LOGS

I enabled audit logging on our SAP Development using transaction sm19 and noticed that the log files residing on the OS file system: /usr/sap/DEV/DVEBMGS00/log growing rather fast.
This is for Development only, If I enable it on Production the growth would probably be faster.
Aside from the fact that the logs eat up a lot of space, will audit logging result to any performance degradation? Does audit logging create additional dialog processes?
Our present setup is rather standard and we cannot provide additional resources as of now.
My machine has 4096 MB memory and speed of 2 Processor Power PC_Power4 1 GB

To enable audit log, you should consider 2 SAP parameter :
1. rsau/enable
and
2. rsau/max_diskspace/local (default value 1 MB)
For local diskspace you can limit it. I think SAP audit log would have impact on your server performance because every transaction has additional process and consume CPU and memory resource.
Please award point if it helpful.
ardhian

I can't delete Data Audit log. Out of process memory

Hi Did someone ever saw this?
An error has occurred. Please contact your administrator.
Show Details:
Error Reference Number: {188D41D2-6440-480A-9604-C7C608131887};User Name: alord@LCE
Num: 0x80040e14;Type: 1;DTime: 8/1/2010 11:48:56 PM;Svr: LCLNTHQ134;File: DataDataAudit.cpp;Line: 2398;Ver: 9.3.1.11.2590;DStr: ORA-04030: out of process memory when trying to allocate 258072 bytes (callheap,kllcqas:kllsltba);
Num: 0x80004005;Type: 0;DTime: 8/1/2010 11:48:56 PM;Svr: LCLNTHQ134;File: CHsvData.cpp;Line: 17239;Ver: 9.3.1.0.2385;
Num: 0x80004005;Type: 0;DTime: 8/1/2010 11:48:56 PM;Svr: LCLNTHQ134;File: CHFMwData.cpp;Line: 2285;Ver: 9.3.1.0.1502;
For the last 3 days, my concolidation process is very very slow

If you mean that Find My Phone is asking for a password to a different Apple ID to your current Apple IDand that ID is a previous version of your current ID, not an entirely different one.
This feature has been introduced to make stolen phones useless to those that have stolen them.
However it can also arise when the user has changed their Apple ID details with Apple and not made the same changes to their iCloud account/Find My Phone on their device before upgrading to iOS 7, or if you restore from a previous back up made before you changed your details and some other circumstances.
The only solution is to change your Apple ID back to its previous state with Apple at My Apple ID using your current password, you don’t need access to this address if it’s previously been used with your Apple ID, once you have saved these details enter the password as requested on your device and then turn off "find my phone" and delete the account from your device. It may take a short while to remove the account.
You should then change your Apple ID back to its current state, save it once again and then log back in using your current Apple ID. Finally, turn "find my phone" back on once again.
This article provides more information about Activation Lock.

Exchange 2010 Mailbox Auditing Owner Sent Items (Create)

I have activated Mailbox auditing feature for a Mailbox "Set-mailbox -identity User1 -auditenabled $true | Set-Mailbox -Identity User1 -Auditowner harddelete,create", I need to audit sent ítems (create), but the Search command didn´t show
any results:
Search-Mailboxauditlog -Identity User1 -Logontypes Owner -Showdetails -Startdate 1/1/2014 -enddate 1/22/2014

Hi,
First,run the following command to verify that you have successfully enabled mailbox audit logging for a mailbox and specified the correct logging settings owner access:
Get-Mailbox "User1" | Format-List *audit*
If all are right,please run the following command to search the result:
Search-MailboxAuditLog -Identity user1 -LogonTypes Owner -ShowDetails -StartDate 1/1/2014 -EndDate 1/22/2014 | Where-Object {$_.Operation -eq "Create"}
The following articles for your reference:
Mailbox Audit Logging
Exchange Server 2010 SP1 Mailbox Audit Logging Step by Step Guide
Hope this helps!
Thanks.
Niko Cheng
TechNet Community Support

Exchange 2013 - Mailbox Auditing

Hi all,
Like to check what is the event id that will appear on Windows Event Viewer when a mailbox is access by someone else?
For exchange 2007, the event id is 10100. I cannot seems to find the id for 2013 on the net.
Also, if I wish to monitor exchange administrator if they are accessing any other person's mailbox,
Would this power shell command be enough to turn on what I wish to monitor?
Set-Mailbox -AuditEnabled:$true
Thanks!
Zack

Hi Zack,
Thank you for your question.
Mailbox audit logs are generated for each mailbox that has mailbox audit logging enabled. Log entries are stored in the Recoverable Items folder in the audited mailbox, in the Audits subfolder. By default, mailbox audit log entries are retained in the mailbox
for 90 days and then deleted. We could modify this retention period by using the AuditLogAgeLimit parameter with the Set-Mailbox cmdlet. We could use the following command to enable mailbox audit logging:
Set-Mailbox –Identity <Username/Email address> -AuditEnable $ture
To verify that we have successfully enabled mailbox audit logging for a mailbox and specified the correct logging settings for administrator, delegate, or owner access, use the Get-Mailbox cmdlet to retrieve the mailbox audit logging settings for that mailbox.
This example retrieves Ben Smith’s mailbox settings and pipes the specified audit settings, including the audit log age limit, to the Format-List cmdlet.
Get-Mailbox "Ben Smith" | Format-List *audit*
The more details will be referred by the following link:
https://technet.microsoft.com/en-us/library/ff459237(v=exchg.150).aspx
If there are any questions regarding this issue, please be free to let me know.
Best Regard,
Jim
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected]
Jim Xu
TechNet Community Support

How to enable the Exchange 2010 Admin Audit logs in Event Viewer

How to enable the Exchange 2010 Admin Audit(Mailbox Auditing) logs in Event Viewer.
- Sivashankar. Please mark as answer/useful if my contribution is helpful

Hi Siva,
We could execute the command below to view Administrator Audit Logging settings:
Get-AdminAuditLogConfig
If it is not enabled, please run the command below:
Set-AdminAuditLogConfig -AdminAuditLogEnabled $True
In addition, here are some references for you to utilize this feature:
Configure Administrator Audit Logging :
http://technet.microsoft.com/en-us/library/dd335109(v=exchg.141).aspx
Search the Administrator Audit Log :
http://technet.microsoft.com/en-us/library/ff459262(v=exchg.141).aspx
Regards,
Rebecca Tu
TechNet Community Support

Mailbox Admin Audit Logs

Hi All ,
Could you tell me how to clear Mailbox Admin Audit Logs for past days , i have disabled the audit logs for mailboxes but still i could able to see the information from ECP about last mailboxes accessed details also i've decreased the age limit
of mailbox still the information were reflecting in ECP
Set-Mailbox -Identity xxxx -AuditLogAgeLimit 0
Confirm
You've specified the mailbox audit log age limit of 0 for mailbox "XXXX". If you continue, all log entries will
be deleted. This change takes effect immediately.
[Y] Yes [A] Yes to All [N] No [L] No to All [?] Help (default is "Y"): a
- Sivashankar. Please mark as answer/useful if my contribution is helpful

Hi,
I tested in my lab, it is the same with your result. As a workaround, since the mailbox audit log entries are stored in the Audits folder, we can MFCMAPI to delete the Audits folder which is a subfolder of Recoveralbe Items folder.
Best regards,
Belinda
Belinda Ma
TechNet Community Support

Unable to capture Exchange Mailbox Auditing events for email creation

We are looking to capture Owner mailbox auditing events using the native Exchange 2013 auditing tools (Search-MailboxAuditLog). I have auditing enabled with all actions for Owner, and capture items performed via Outlook, except for new emails created.
If I create new emails via OWA, I am able to capture the event, but as soon as I go back to Outlook and create a new message, I don’t see anything audited. I also tried this is our Dev environment and seeing the same behavior. Has anyone else experience this
behavior?

Hi,
I have a test in my environment. If I create a message on Outlook as a owner, the mailbox audit logging can't record it.
If I create a message on Outlook as a delegate, when using the Search-MailboxAuditLog cmdlet to search the audit log, it will be displayed as follows:
The operation is "SendAs", not "Create".
Hope this can be helpful to you.
Best regards,
If you have feedback for TechNet Subscriber Support, contact
[email protected]
Amy Wang
TechNet Community Support

Can't enable mailbox audit logs

Similar Messages

Maybe you are looking for