Search-MailboxAuditLog is empty - Mailbox Audit Logging not working in Exchange 2013 CU6 environment

Hello,
i activated Mailbox Audit Logging for Admin, delegate and owner with all supported operations (update, delete, etc..)
like mentioned here:
http://exchangeserverpro.com/using-exchange-server-2013-mailbox-audit-logging/
But also two days later (and also one Server reboot later) search-MailboxAuditLog is still empty.
any ideas how to fix this?
Best,
martin

Hi S.Nithyanandham,
i looked up the mailboxfolderstatistics. There are items in the folder: 
[PS] C:\Windows\system32>Get-MailboxFolderStatistics mailboxname |where{$_.Name -like "*audit*"}
RunspaceId : a95e32b8-93c3-4330-8d42-45cade9d64d4
Date : 18.09.2014 16:35:20
Name : Audits
FolderPath : /Audits
FolderId : LgAAAADmBpGVdb8iQp3F89WOcmcHAQBpQNFODkTESLeLj74B887wAAAAAAESAAAB
FolderType : Audits
ItemsInFolder : 147
DeletedItemsInFolder : 0
FolderSize : 434.2 KB (444,649 bytes)
ItemsInFolderAndSubfolders : 147
DeletedItemsInFolderAndSubfolders : 0
FolderAndSubfolderSize : 434.2 KB (444,649 bytes)
OldestItemReceivedDate :
NewestItemReceivedDate :
OldestDeletedItemReceivedDate :
NewestDeletedItemReceivedDate :
OldestItemLastModifiedDate :
NewestItemLastModifiedDate :
OldestDeletedItemLastModifiedDate :
NewestDeletedItemLastModifiedDate :
ManagedFolder :
DeletePolicy :
ArchivePolicy :
TopSubject :
TopSubjectSize : 0 B (0 bytes)
TopSubjectCount : 0
TopSubjectClass :
TopSubjectPath :
TopSubjectReceivedTime :
TopSubjectFrom :
TopClientInfoForSubject :
TopClientInfoCountForSubject : 0
SearchFolders :
Identity : mailboxname\Audits
IsValid : True
ObjectState : New
What do you think?
why cant i search and find these entries the auditlog?
best, 
martin

Similar Messages

  • Throttling policy not working on Exchange 2013 CU6

    Hi,
    We have a test throttling policy to restrict a mailbox to send at most 2 messages
    per minute in our live Exchange 2013 CU6 enviroment. It was associated to a test mailbox. We have separated installed 2 mailboxe and 2 cas server roles in our enviroment. I have checked latest CU-s (7 & 8) but these are
    not fixing any related bugs.
    We tried lots of workaround (see below list) and solutions to fix this but it is still not working with outlook MAPI and OWA client.
    Throttling policy not working
    smtp service restart
    RPC Client Acces service restart
    The policy details:
    Get-ThrottlingPolicy  low_rate_limit |fl *limit*
    MessageRateLimit   : 2
    RecipientRateLimit : 1000
    Get-mailbox [email protected] | fl ThrottlingPolicy
    ThrottlingPolicy           : low_rate_limit
    Do you have any idea what is the problem?
    Thank you in advance.
    br,
    Zoltan

    Hi Zoltan,
    Base on my research, you need to configure the MessageRateLimit parameter on receive connector also.
    The MessageRateLimit parameter specifies the maximum number of messages that can be sent by a single client IP address per minute. The default value for a Receive connector configured in the Transport service on a Mailbox server is
    unlimited. The default value for a Receive connector configured on an Edge server is 600 messages per minute. The valid input range for this parameter is 1 to 2147483647. To remove the message rate limit on a Receive connector, enter a value of
    unlimited.
    https://technet.microsoft.com/en-us/library/bb125140(v=exchg.150).aspx
    Best regards,
    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected]
    Niko Cheng
    TechNet Community Support

  • Mailbox audit log - Not searchable

    Exchange 2010 SP2 RU7
    I enabled audit on one mailbox using the Set-Mailbox cmdlet. Here is the audit-specific o/p from the mailbox,
    AuditEnabled : True AuditLogAgeLimit : 90.00:00:00 AuditAdmin : {Move, MoveToDeletedItems, SoftDelete, HardDelete} AuditDelegate : {Move, MoveToDeletedItems, SoftDelete, HardDelete} AuditOwner : {Move, MoveToDeletedItems, SoftDelete, HardDelete}
    I am trying to track who is deleting objects from the mailbox, so I tested whether auditing is actually logging anything by deleting three items at different times from the mailbox. The I run another cmdlet to test whether an audit folder is there and what
    are it's contents,
    PS C:\temp\ps> Get-MailboxFolderStatistics -Identity "MBX" | ? {$_.Name -eq "Audits" -and $_.FolderType -eq "Audits"} | Format-Table Identity, ItemsInFolder, FolderSize -AutoSize
    Identity ItemsInFolder FolderSize
    MBX\Audits 3 5.918 KB (6,060 bytes)
    Sure enough there are 3 items in there meaning it's auditing those deletions. BUT when I try to search the audit logs using the below command, I get no results (YES I am using the -ShowDetails switch).
    Search-MailboxAuditLog -Identity MBX -LogonTypes Admin,Owner,Delegate -ShowDetails -StartDate "2/1/2014" -EndDate "2/10/2014" | ft Operation, OperationResult, LogonUserDisplayName, ItemSubject, LastAccessed, -AutoSize
    If there are results in the audit log, then why is the search-mailboxauditlog not presenting them even with the broadest search criteria? I have tried removing the start and end dates too but no luck.
    Really frustrated with these half-baked features Microsoft puts into these products. Can someone help?

    Hi,
    In order to troubleshoot the issue more efficiently, I need to clarify some information.
    1. Did the issue affect all users or only one specific user?
    2. Have you tied to extract the result from ECP or using New-MailboxAuditLogSearch?
    3. Is there any error message in the event log?
    For this issue, could you please test again using this mailbox you mentioned above to check the result? I tested in my lab, search results are outputed after waiting for some time.
    Best regards,
    Belinda
    Belinda Ma
    TechNet Community Support

  • POP3 is not working in Exchange 2013

    Hi,
    Facing Wiered issue in Exchange 2013, POP3 is not working ... When configuring POP3 in outlook it failed to authenticate.
    unknown user name or bad password. [Error=ProxyNotAuthenticated Proxy=ZAJNBEXC03.cws.sasol.com:1995:SSL]"
    Amit

    Credentials are correct
    Here is the output ..... pls. let me know if this is correct
    [PS] C:\Windows\system32>Get-PopSettings |fl
    RunspaceId                        : ecc593c8-067e-4d9d-aca1-c121295b8499
    Name                              : 1
    ProtocolName                      : POP3
    MaxCommandSize                    : 512
    MessageRetrievalSortOrder         : Ascending
    UnencryptedOrTLSBindings          : {[::]:110, 0.0.0.0:110}
    SSLBindings                       : {[::]:995, 0.0.0.0:995}
    InternalConnectionSettings        : {ZAJNBEXC02.cws.sasol.com:995:SSL, ZAJNBEXC02.cws.sasol.com:110:TLS}
    ExternalConnectionSettings        : {ZAJNBEXC02.cws.sasol.com:995:SSL}
    X509CertificateName               : mail.sasol.com
    Banner                            : The Microsoft Exchange POP3 service is ready on ZAJNBEXC02.
    LoginType                         : PlainTextLogin
    AuthenticatedConnectionTimeout    : 00:30:00
    PreAuthenticatedConnectionTimeout : 00:01:00
    MaxConnections                    : 2147483647
    MaxConnectionFromSingleIP         : 2147483647
    MaxConnectionsPerUser             : 16
    MessageRetrievalMimeFormat        : BestBodyFormat
    ProxyTargetPort                   : 1995
    CalendarItemRetrievalOption       : iCalendar
    OwaServerUrl                      :
    EnableExactRFC822Size             : False
    LiveIdBasicAuthReplacement        : False
    SuppressReadReceipt               : False
    ProtocolLogEnabled                : True
    EnforceCertificateErrors          : False
    LogFileLocation                   : D:\Program Files\Microsoft\Exchange Server\V15\Logging\Pop3
    LogFileRollOverSettings           : Daily
    LogPerFileSizeQuota               : 0 B (0 bytes)
    ExtendedProtectionPolicy          : None
    EnableGSSAPIAndNTLMAuth           : True
    Server                            : ZAJNBEXC02
    AdminDisplayName                  :
    ExchangeVersion                   : 0.10 (14.0.100.0)
    DistinguishedName                 : CN=1,CN=POP3,CN=Protocols,CN=ZAJNBEXC02,CN=Servers,CN=Exchange Administrative
                                        Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=Sasol,CN=Microsoft
                                        Exchange,CN=Services,CN=Configuration,DC=cws,DC=sasol,DC=com
    Identity                          : ZAJNBEXC02\1
    Guid                              : 4c5d5409-1b4a-4127-a4cd-11b064156322
    ObjectCategory                    : cws.sasol.com/Configuration/Schema/ms-Exch-Protocol-Cfg-POP-Server
    ObjectClass                       : {top, protocolCfg, protocolCfgPOP, protocolCfgPOPServer}
    WhenChanged                       : 2015-02-24 08:57:41 AM
    WhenCreated                       : 2014-12-08 11:25:29 AM
    WhenChangedUTC                    : 2015-02-24 06:57:41 AM
    WhenCreatedUTC                    : 2014-12-08 09:25:29 AM
    OrganizationId                    :
    OriginatingServer                 : ZAJNBWCWSFGC001.cws.sasol.com
    IsValid                           : True
    ObjectState                       : Unchanged
    ==================================================================
    In my case I have 4 DAG and each having 3 server. .. I am POP test and it is failing with below error
    RunspaceId                  : 75d8800c-3f32-4750-8fe1-940133eaf6e8
    LocalSite                   : AFR-BYN
    SecureAccess                : True
    VirtualDirectoryName        :
    Url                         :
    UrlType                     : Unknown
    Port                        : 0
    ConnectionType              : Plaintext
    ClientAccessServerShortName : ZAJNBEXC01
    LocalSiteShortName          : AFR-BYN
    ClientAccessServer          : ZAJNBEXC01.cws.sasol.com
    Scenario                    : Create a MailboxSession object.
    ScenarioDescription         : Creating MailboxSession object to access the mailbox [[email protected]].
    PerformanceCounterName      :
    Result                      : Failure
    Error                       : Unable to create MailboxSession object to access the mailbox [[email protected]].
                                  Detailed error information:
                                  [Microsoft.Exchange.Data.Storage.WrongServerException]: The user and the mailbox are
    in different Active Directory sites. Inner error [Microsoft.Mapi.Ma
    UserName                    : migrationtest3
    StartTime                   : 2015-02-24 10:58:51 AM
    Latency                     : -00:00:00.0010000
    EventType                   : Error
    LatencyInMillisecondsString :
    Identity                    :
    IsValid                     : True
    ObjectState                 : New
    Amit

  • RBL not working on Exchange 2013 Edge Transport

    Single multi-role server with a couple of mailboxes, recently added an Edge Transport server. After configuring the Edge Subscribtion I added sen.spamhaus.org as a RBL Provider:
    Add-IPBlockListProvider -Name Spamhaus -LookupDomain zen.spamhaus.org
    This is not working. A lot of spam is still entering Exchange and the http://www.crynwr.com/spam/ test failed.
    Both servers run Exchange 2013 CU5.
    Did my post help? Please use "Vote As Helpful", "Mark as answer" or "Propose as answer". Thank you!

    Hi,
    Yes, the command is specific for provider SpamHaus.
    http://tweaks.com/windows/40003/cut-down-on-spam-with-ip-block-list-providers-rbl/
    Note: Microsoft is providing this information as a convenience to you. The sites are not controlled by Microsoft. Microsoft cannot make any representations regarding the quality, safety,
    or suitability of any software or information found there. Please make sure that you completely understand the risk before retrieving any suggestions from the above link.
    Have you added the additional parameters in the command and did it work?
    Thanks,
    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact
    [email protected]
    Simon Wu
    TechNet Community Support

  • SME 7.1 not working with Exchange 2013 SP1 CU6

    Hello, i tried upgrading to SME 7.1 on our Exchange 2013 SP1 CU6, but when trying to configure the Exchange Server in the SME management console using the configuration wizard, it gave an error before the LUN mapping page, saying "Failed to get Exchange information for server" and "The communication object, System.ServiceModel.Channels.ServiceChannel, cannot be used for communication because it is in the Faulted state.". I upgraded Snapdrive to 7.1, verfied all credentials according to the manuals, re-installed and rebooted multiple times (registry and filesystem cleaned, even tried to rename the existing SnapInfo directory, ...), stopped all other services on the server but without any change... Every time when trying to run the configuration wizard, the debug log shows no errors, lists all Exchange information and ends with the following lines:[11/18 12:51:58 155] Exit CSmeCDOExm::GetExchangeStructureInternal 0x0
    [11/18 12:51:58 155] Exit CNtapSnapMgr::GetExchangeStructure: 0x0
    [11/18 12:51:58 233] Enter CSmeServerBase::~CSmeServerBase ...
    [11/18 12:51:58 248] m_ptrSnapShot released
    [11/18 12:51:58 248] m_pISnapShot4 released
    [11/18 12:51:58 248] m_pISnapShot5 released
    [11/18 12:51:58 248] m_pISnapShot6 released
    [11/18 12:51:58 248] m_pISnapShot7 released
    [11/18 12:51:58 248] m_pISnapShot8 released
    [11/18 12:51:58 248] m_pISnapShot9 released I ended up uninstalling SME 7.1 and re-installed SME 7.0 which is working. Exchange Server: ESXi 5.5 VM, Windows Server 2012 R2 (with current patches), Exchange 2013 SP1 CU6 - no DAG, single server installation (in co-existence with Exchange 2010), 4 iSCSI LUNs created with Snapdrive (1x Log, 3x Store), System drive and Exchange installation drive on vmdk Disks (via ESXi -> NFS store on the same NetApp)NetApp: FAS 2240-2 with Data ONTAP 8.1.4P1 7-mode (with complete license bundle) Anyone else got this problem or even better - a solution? 

    We could not reproduce the error with the upgrade workflow.Looking at the error and the relevant function, we could force the problem in following conditions: -SME is configured or ran at the DAG level-one of the following services is stopped or not responding on one nodes of the DAG Snapdrive Service, Snapmanager Service, Snapdrive Storage Management Service,Snapdrive Management Service. Would be good if we could get the output of following powershell cmdlet before and after the upgrade: Get-Service –ComputerName Node1, Node2, Node3 –name Snap*, SDMGMT*, SWSvc  Best regards,Dan 

  • Redirect emails in OWA and Outlook 2010 not working in Exchange 2013

    I have an new install of Exchange 2013 with all updates.
    When I setup an inbox rule to redirect messages to another contact it is not working.
    When I used Outlook 2010 and ran the rule manually I received this error:
    "the redirect action is not currently supported with run rules now"
    It seems that I didn't setup up something correctly in Exchange 2013 or a feature is not turned on. Please assist.
    In the EM console when I setup forwarding that is working. Its the inbox rule redirect not working.

    Hi,
    From your description, I recommend you use the following cmdlet to ensure that the DeliverToMailboxAndForward parameter is set to $True.
    Get-Mailbox <identity> | fl DeliverToMailboxandForward
    If this parameter is false, you can use the Set-Mailbox cmdlet to set it and check the result.
    Hope this can be helpful to you.
    Best regards,
    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected]
    Amy Wang
    TechNet Community Support

  • AutoReplyState is Enabled. But still OOF is not working on exchange 2013

    Hi All,
     We have exchange 2013 installed. How can I make our OOF (Out of Office) reply works?
    Thanks in advance.
    Jake

    Hi Sneff,
     Sorry, but I can't find anything on my event viewer that is "MSExchangeMailboxAssistants". Do i need to start the "Microsoft Account Sign-in Assistant" in services?
    Checking oof with
    https://testconnectivity.microsoft.com/. I got lots of "x". Please give some advice : 
    Exchange Web Services synchronization, notification, availability, and Automatic Replies.
    Not all tests of Exchange Web Services tasks completed.
    Additional Details
    Elapsed Time: 42852 ms.
    Test Steps
    The Microsoft Connectivity Analyzer is attempting to test Autodiscover for blank.com.ph.
    Testing Autodiscover failed.
    Additional Details
    Elapsed Time: 42852 ms.
    Test Steps
    Attempting each method of contacting the Autodiscover service.
    The Autodiscover service couldn't be contacted successfully by any method.
    Additional Details
    Elapsed Time: 42852 ms.
    Test Steps
    Attempting to test potential Autodiscover URL https://blank.com.ph:443/Autodiscover/Autodiscover.xml
    Testing of this potential Autodiscover URL failed.
    Additional Details
    Test Steps
    Attempting to test potential Autodiscover URL https://autodiscover.blank.com.ph:443/Autodiscover/Autodiscover.xml
    Testing of this potential Autodiscover URL failed.
    Additional Details
    Elapsed Time: 21299 ms.
    Test Steps
    Attempting to resolve the host name autodiscover.blank.com.ph in DNS.
    The host name resolved successfully.
    Additional Details
    Testing TCP port 443 on host autodiscover.blank.com.ph to ensure it's listening and open.
    The specified port is either blocked, not listening, or not producing the expected response.
     <label for="testSelectWizard_ctl12_ctl06_ctl00_ctl00_ctl01_ctl01_tmmArrow">Tell
    me more about this issue and how to resolve it</label>
    Additional Details
    Attempting to contact the Autodiscover service using the HTTP redirect method.
    The attempt to contact Autodiscover using the HTTP Redirect method failed.
    Additional Details
    Test Steps
    Attempting to contact the Autodiscover service using the DNS SRV redirect method.
    The Microsoft Connectivity Analyzer failed to contact the Autodiscover service using the DNS SRV redirect method.
    Additional Details
    Test Steps
    Checking if there is an autodiscover CNAME record in DNS for your domain 'blank.com.ph' for Office 365.
    Failed to validate autodiscover CNAME record in DNS. If your mailbox isn't in Office 365, you can ignore this warning.
     <label for="testSelectWizard_ctl12_ctl06_ctl00_ctl00_ctl04_tmmArrow">Tell
    me more about this issue and how to resolve it</label>
    Additional Details
    There is no Autodiscover CNAME record for your domain 'blank.com.ph'.
    Elapsed Time: 24 ms.
    Thanks
    Jake

  • Lync integration not working after Exchange 2013 SP1 is installed...

    Hi,
    I have two Exchange 2013 servers running and everything is fine, almost.
    The problem is that on the first server we had OWA with Lync integration working before installing SP1, but after the installation of SP1, it doesn't Work any more.
    The second server was installed with SP1 from the start, but we can't get the Lync integration to Work on this one either..
    When we log in to OWA, it just starts to sign in but then says "there was a problem signing in, if this continues please contact your helpdesk"
    I have checked the Exchange server for events, and i can see the event ID 112 everytime i recycle the Application Pool, so there are some connection between Exchange and Lync..
    Have any of you Guys seen or experienced any thing like this?
    Thanks in advance.
    Regards
    Kenneth

    Hi,
    I recommend that you refer to the following article to troubleshoot the issue:
    Troubleshooting tips for Exchange 2013 OWA IM Integration to Lync 2013
    This post describes how to configure Exchange 2013 OWA to have IM integration to Lync 2013. Here I would like to give some troubleshooting tips in case you can't get the integration to work.
    In addition, here is a similar thread for your reference:
    Lync 2013 with Exchange 2013 SP1 OWA integration failed   
    Hope this helps!
    Thanks.                              
    Niko Cheng
    TechNet Community Support

  • Moderation Mail Not Work in Exchange 2013

    Hello All,
    I facing difficulties regarding Moderation Mail. The Moderation mail not send to moderator. also i found that the arbitration mailbox also corrupted.
    Error:
    WARNING: The object abc.com/Users/Migration.8f3e7716-2011-43e4-96b1-aba62d229136 has been corrupted, and
    it's in an inconsistent state. The following validation errors happened:
    WARNING: Database is mandatory on UserMailbox.
    WARNING: Database is mandatory on UserMailbox.
    Please suggest

    Hi,
    To recreate this arbitration mailbox, you can follow the steps below.
    Start the Active Directory Users and Computers snap-in.
    Click Users, and then find the following account:
    Migration.8f3e7716-2011-43e4-96b1-aba62d229136
    Remove this account.
    Run the following cmdlet:
    setup /preparead/IAcceptExchangeServerLicenseTerms
    Run the following cmdlets:
    Enable-Mailbox -Arbitration -Identity "Migration.8f3e7716-2011-43e4-96b1-aba62d229136"
    Set-Mailbox "Migration.8f3e7716-2011-43e4-96b1-aba62d229136" -Arbitration –Management:$true
    Here is an article about re-creating the Discovery system mailbox, it is the same process to recreate the arbitration mailbox mentioned in the error message above.
    http://technet.microsoft.com/en-gb/library/gg588318(v=exchg.150).aspx
    Best regards,
    Belinda Ma
    TechNet Community Support

  • Mailbox auditing log search only shows last 7 days

    I have mailbox auditing turned on for a mailbox, and the audit log age limit is set to 90 days.  When I run the non admin user access report however it only shows me auditing items for the past 7 days.  If i go to powershell, and run search-mailboxauditlog
    it shows the same 7 days. Any suggestions?

    http://technet.microsoft.com/en-us/library/ff459237(v=exchg.150).aspx
    Mailbox audit logs are generated for each mailbox that has mailbox audit logging enabled. Log entries are stored in the Audits subfolder of the audited mailbox Recoverable Items folder. This ensures that all audit logs are available from a single location,
    regardless of which client access method was used to access the mailbox or which server or workstation an administrator used to access the mailbox audit log. If you move a mailbox to another Mailbox server, the mailbox audit logs for that mailbox are also
    moved because they're located in the mailbox.
    By default, mailbox audit log entries are retained in the mailbox for 90 days and then deleted. You can modify this retention period by using the
    AuditLogAgeLimit parameter with the
    Set-Mailbox cmdlet. If a mailbox is on In-Place Hold or litigation hold, audit log entries are only retained until the audit log retention period for the mailbox is reached. To retain audit log entries longer, you have to increase the retention period by
    changing the value for the AuditLogAgeLimit parameter, or export audit log entries before the retention period is reached.
    Ed Crowley MVP "There are seldom good technological solutions to behavioral problems."

  • Can't enable mailbox audit logs

    Hello!
    I can't enable mailbox audit logs. I use cmdlet Set-Mailbox -Identity "mailbox" -AuditEnabled $true and Get-Mailbox shows that
    audit is enabled. But when i check Get-Mailbox| Get-MailboxFoldersStatistics there is no "Audit" subfolder, and all audit searches also return no results. 
    I am working now with several Exchange installations (five actually, and one is brand-new test lab) and checked the same in each organization. Result was the same!
    I am stronly sure i miss something important, could you point it to me?

    Hi,
    Please use the following command to check the Mailbox Audit Logging action setting.
    Get-Mailbox –Identity “username” | fl name,*audit*
    Are there any administrator, delegate, and owner actions in the audit logging configuration for that mailbox? Please post them to check this issue.
    If the settings above are configured correctly, only the administrator, delegate, and owner actions specified in the audit logging configuration for the mailbox are logged. And the “Audits” folder will show up after the administrator, delegate,
    and owner take the actions specified in the audit logging configuration.
    By default, these actions in the audit logging configuration should be like this:
    AuditAdmin        : {Update, Move, MoveToDeletedItems, SoftDelete, HardDelete, FolderBind, SendAs, SendOnBehalf, Create}
    AuditDelegate   : {Update, SoftDelete, HardDelete, SendAs, Create}
    AuditOwner        : {}
    By the way, which command do you use to search the audit log?
    Mailbox audit logging procedures
    https://technet.microsoft.com/en-us/library/ff461939%28v=exchg.150%29.aspx?f=255&MSPPError=-2147217396
    Best Regards.
    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected]
    Lynn-Li
    TechNet Community Support

  • When enabling Mailbox Audit Logging would take effect?

    I enable the Mailbox Audit Logging  by the command below, but found it can't take effect
    immediately (I have no idea if there is needs some time to replication ,or others in the DC)even I reboot the exchange server.
    So my question is if I want to make the "Mailbox Audit Logging" taking effect immediately , what should I do?
    Set-Mailbox -Identity "Ben Smith" -AuditEnabled $true
    Set-Mailbox -Identity "Ben Smith" -AuditDelegate SendAs,SendOnBehalf ,,,,,,,,-AuditEnabled $true
    Set-Mailbox -Identity "Ben Smith" -AuditAdmin MessageBind,FolderBind,,,,,,,, -AuditEnabled $true
    Set-Mailbox -Identity "Ben Smith" -AuditOwner HardDelete,,,,,,,, -AuditEnabled $truehttp://technet.microsoft.com/en-us/library/ff461937(v=exchg.141).aspx
    Please click the Mark as Answer button if a post solves your problem!

    In order to force auditing to run immediately (and be sure it does), you need a few things - you need only one domain controller, and you need to restart the Microsoft Exchange Active Directory Topology service (which will restart all Exchange services)
    on all of your Exchange servers.  I highly recommend not doing either of these, since they will 1) reduce the availability of your Active Directory, and 2) take all your Exchange databases offline.  Auditing will take effect in a short time period
    after being set, so all you can do is wait (unless you want to do the above).  We do auditing on all our mailboxes and set them when we create the mailbox.  That way, we don't need to worry about missing something because it wasn't enabled.
    BTW, the above commands don't need all the extra commas, and if you are doing them on a single mailbox, they can be run as a single command:
    Set-Mailbox -Identity "Ben Smith" -AuditDelegate SendAs,SendOnBehalf -AuditAdmin MessageBind,FolderBind -AuditOwner HardDelete -AuditEnabled $true

  • Mailbox Audit Log

    Can we backup mailbox audit log? These logs are stored in the recovery folder in each mailbox. Normally it should be backup with mailbox. How can restore and query these logs from after their audit age limit has expired?
    Thanks.
    Irfan
    Irfan Goolab SALES ENGINEER (Microsoft UC) MCP, MCSA, MCTS, MCITP, MCT

    Hi Irfan,
    Base on my knowledge, you can refer to the following methods to backup audit log:
    1. Export mailbox audit logs:
    https://technet.microsoft.com/en-us/library/jj150552(v=exchg.150).aspx
    2.  Audit logs can be found in the eventviewer under MSExchangeManagement, you can save it, as below:
    Best regards,
    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected]
    Niko Cheng
    TechNet Community Support

  • Mailbox audit logging

    Hi!
    We have two exchange servers in our company, ex2010 and ex2013. I set the audit logging to true for some mailbox, but if i run a report at the ex2013 to a specific a mailbox no data at the log. But! if i run a report at the ex2010 ecp website i get information
    from the same mailbox (folderbind etc..). I try run a report via shell at the ex2013, no data, same as the gui. The specific mailboxes migrated from ex2010 to ex2013.

    Hi ToniSlow,
    Thank you for your question.
    We could run the following command to make sure the mailbox has been moved to Exchange 2013:
    Get-Mailbox <username> | FL
    Then we could check the item of “database” if this database is on Exchange 2013.
    By my understanding, when we move mailbox to Exchange 2013, the mailbox audit logs for that mailbox are also moved because they're located in the mailbox.
    If there are any questions regarding this issue, please be free to let me know. 
    Best Regard,
    Jim
    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected]
    Jim Xu
    TechNet Community Support

Maybe you are looking for

  • How can I download my 2005 copy of Audition 1.5 again?

    How can I download my 2005 copy of Audition 1.5 again?

  • How to fetech n number of rows at one time

    Hi, In my production there is 3 million records data.So its taking long time to diplay the record.So i am thinking of display 100 records at a time.the query is SELECT MDN_NUMBER,STATUS,CUSTOMER_TYPE,PHONE_TYPE,CIRCLE,FIRST_NAME, LAST_NAME,ADDRESS,CI

  • How  group by function/procedure used in function

    i want to capture information in different table which extract by select statement like(select trans_date from bankAccount group by cust_id).

  • Mac OSX (10.5.6) to TV

    Question #1: When I connect my Mac to TV, the appearance on the Mac enlarges. Need help. Question#2: After I burn a DVD on my Mac, it won't play in another player. Need help.

  • Remove the unique icon for movie files

    In Finder, I get a custom icon for each movie file that is the first frame of the movie. That doesn't help me, so I want to change it to only show the QuickTime image as a custom icon. This is the behavior of Tiger and it was useful to me. I don't ge