Search-MailboxAuditLog is empty - Mailbox Audit Logging not working in Exchange 2013 CU6 environment
Hello,
i activated Mailbox Audit Logging for Admin, delegate and owner with all supported operations (update, delete, etc..)
like mentioned here:
http://exchangeserverpro.com/using-exchange-server-2013-mailbox-audit-logging/
But also two days later (and also one Server reboot later) search-MailboxAuditLog is still empty.
any ideas how to fix this?
Best,
martin
Hi S.Nithyanandham,
i looked up the mailboxfolderstatistics. There are items in the folder:
[PS] C:\Windows\system32>Get-MailboxFolderStatistics mailboxname |where{$_.Name -like "*audit*"}
RunspaceId : a95e32b8-93c3-4330-8d42-45cade9d64d4
Date : 18.09.2014 16:35:20
Name : Audits
FolderPath : /Audits
FolderId : LgAAAADmBpGVdb8iQp3F89WOcmcHAQBpQNFODkTESLeLj74B887wAAAAAAESAAAB
FolderType : Audits
ItemsInFolder : 147
DeletedItemsInFolder : 0
FolderSize : 434.2 KB (444,649 bytes)
ItemsInFolderAndSubfolders : 147
DeletedItemsInFolderAndSubfolders : 0
FolderAndSubfolderSize : 434.2 KB (444,649 bytes)
OldestItemReceivedDate :
NewestItemReceivedDate :
OldestDeletedItemReceivedDate :
NewestDeletedItemReceivedDate :
OldestItemLastModifiedDate :
NewestItemLastModifiedDate :
OldestDeletedItemLastModifiedDate :
NewestDeletedItemLastModifiedDate :
ManagedFolder :
DeletePolicy :
ArchivePolicy :
TopSubject :
TopSubjectSize : 0 B (0 bytes)
TopSubjectCount : 0
TopSubjectClass :
TopSubjectPath :
TopSubjectReceivedTime :
TopSubjectFrom :
TopClientInfoForSubject :
TopClientInfoCountForSubject : 0
SearchFolders :
Identity : mailboxname\Audits
IsValid : True
ObjectState : New
What do you think?
why cant i search and find these entries the auditlog?
best,
martin
Similar Messages
-
Throttling policy not working on Exchange 2013 CU6
Hi,
We have a test throttling policy to restrict a mailbox to send at most 2 messages
per minute in our live Exchange 2013 CU6 enviroment. It was associated to a test mailbox. We have separated installed 2 mailboxe and 2 cas server roles in our enviroment. I have checked latest CU-s (7 & 8) but these are
not fixing any related bugs.
We tried lots of workaround (see below list) and solutions to fix this but it is still not working with outlook MAPI and OWA client.
Throttling policy not working
smtp service restart
RPC Client Acces service restart
The policy details:
Get-ThrottlingPolicy low_rate_limit |fl *limit*
MessageRateLimit : 2
RecipientRateLimit : 1000
Get-mailbox [email protected] | fl ThrottlingPolicy
ThrottlingPolicy : low_rate_limit
Do you have any idea what is the problem?
Thank you in advance.
br,
ZoltanHi Zoltan,
Base on my research, you need to configure the MessageRateLimit parameter on receive connector also.
The MessageRateLimit parameter specifies the maximum number of messages that can be sent by a single client IP address per minute. The default value for a Receive connector configured in the Transport service on a Mailbox server is
unlimited. The default value for a Receive connector configured on an Edge server is 600 messages per minute. The valid input range for this parameter is 1 to 2147483647. To remove the message rate limit on a Receive connector, enter a value of
unlimited.
https://technet.microsoft.com/en-us/library/bb125140(v=exchg.150).aspx
Best regards,
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected]
Niko Cheng
TechNet Community Support -
Mailbox audit log - Not searchable
Exchange 2010 SP2 RU7
I enabled audit on one mailbox using the Set-Mailbox cmdlet. Here is the audit-specific o/p from the mailbox,
AuditEnabled : True AuditLogAgeLimit : 90.00:00:00 AuditAdmin : {Move, MoveToDeletedItems, SoftDelete, HardDelete} AuditDelegate : {Move, MoveToDeletedItems, SoftDelete, HardDelete} AuditOwner : {Move, MoveToDeletedItems, SoftDelete, HardDelete}
I am trying to track who is deleting objects from the mailbox, so I tested whether auditing is actually logging anything by deleting three items at different times from the mailbox. The I run another cmdlet to test whether an audit folder is there and what
are it's contents,
PS C:\temp\ps> Get-MailboxFolderStatistics -Identity "MBX" | ? {$_.Name -eq "Audits" -and $_.FolderType -eq "Audits"} | Format-Table Identity, ItemsInFolder, FolderSize -AutoSize
Identity ItemsInFolder FolderSize
MBX\Audits 3 5.918 KB (6,060 bytes)
Sure enough there are 3 items in there meaning it's auditing those deletions. BUT when I try to search the audit logs using the below command, I get no results (YES I am using the -ShowDetails switch).
Search-MailboxAuditLog -Identity MBX -LogonTypes Admin,Owner,Delegate -ShowDetails -StartDate "2/1/2014" -EndDate "2/10/2014" | ft Operation, OperationResult, LogonUserDisplayName, ItemSubject, LastAccessed, -AutoSize
If there are results in the audit log, then why is the search-mailboxauditlog not presenting them even with the broadest search criteria? I have tried removing the start and end dates too but no luck.
Really frustrated with these half-baked features Microsoft puts into these products. Can someone help?Hi,
In order to troubleshoot the issue more efficiently, I need to clarify some information.
1. Did the issue affect all users or only one specific user?
2. Have you tied to extract the result from ECP or using New-MailboxAuditLogSearch?
3. Is there any error message in the event log?
For this issue, could you please test again using this mailbox you mentioned above to check the result? I tested in my lab, search results are outputed after waiting for some time.
Best regards,
Belinda
Belinda Ma
TechNet Community Support -
POP3 is not working in Exchange 2013
Hi,
Facing Wiered issue in Exchange 2013, POP3 is not working ... When configuring POP3 in outlook it failed to authenticate.
unknown user name or bad password. [Error=ProxyNotAuthenticated Proxy=ZAJNBEXC03.cws.sasol.com:1995:SSL]"
AmitCredentials are correct
Here is the output ..... pls. let me know if this is correct
[PS] C:\Windows\system32>Get-PopSettings |fl
RunspaceId : ecc593c8-067e-4d9d-aca1-c121295b8499
Name : 1
ProtocolName : POP3
MaxCommandSize : 512
MessageRetrievalSortOrder : Ascending
UnencryptedOrTLSBindings : {[::]:110, 0.0.0.0:110}
SSLBindings : {[::]:995, 0.0.0.0:995}
InternalConnectionSettings : {ZAJNBEXC02.cws.sasol.com:995:SSL, ZAJNBEXC02.cws.sasol.com:110:TLS}
ExternalConnectionSettings : {ZAJNBEXC02.cws.sasol.com:995:SSL}
X509CertificateName : mail.sasol.com
Banner : The Microsoft Exchange POP3 service is ready on ZAJNBEXC02.
LoginType : PlainTextLogin
AuthenticatedConnectionTimeout : 00:30:00
PreAuthenticatedConnectionTimeout : 00:01:00
MaxConnections : 2147483647
MaxConnectionFromSingleIP : 2147483647
MaxConnectionsPerUser : 16
MessageRetrievalMimeFormat : BestBodyFormat
ProxyTargetPort : 1995
CalendarItemRetrievalOption : iCalendar
OwaServerUrl :
EnableExactRFC822Size : False
LiveIdBasicAuthReplacement : False
SuppressReadReceipt : False
ProtocolLogEnabled : True
EnforceCertificateErrors : False
LogFileLocation : D:\Program Files\Microsoft\Exchange Server\V15\Logging\Pop3
LogFileRollOverSettings : Daily
LogPerFileSizeQuota : 0 B (0 bytes)
ExtendedProtectionPolicy : None
EnableGSSAPIAndNTLMAuth : True
Server : ZAJNBEXC02
AdminDisplayName :
ExchangeVersion : 0.10 (14.0.100.0)
DistinguishedName : CN=1,CN=POP3,CN=Protocols,CN=ZAJNBEXC02,CN=Servers,CN=Exchange Administrative
Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=Sasol,CN=Microsoft
Exchange,CN=Services,CN=Configuration,DC=cws,DC=sasol,DC=com
Identity : ZAJNBEXC02\1
Guid : 4c5d5409-1b4a-4127-a4cd-11b064156322
ObjectCategory : cws.sasol.com/Configuration/Schema/ms-Exch-Protocol-Cfg-POP-Server
ObjectClass : {top, protocolCfg, protocolCfgPOP, protocolCfgPOPServer}
WhenChanged : 2015-02-24 08:57:41 AM
WhenCreated : 2014-12-08 11:25:29 AM
WhenChangedUTC : 2015-02-24 06:57:41 AM
WhenCreatedUTC : 2014-12-08 09:25:29 AM
OrganizationId :
OriginatingServer : ZAJNBWCWSFGC001.cws.sasol.com
IsValid : True
ObjectState : Unchanged
==================================================================
In my case I have 4 DAG and each having 3 server. .. I am POP test and it is failing with below error
RunspaceId : 75d8800c-3f32-4750-8fe1-940133eaf6e8
LocalSite : AFR-BYN
SecureAccess : True
VirtualDirectoryName :
Url :
UrlType : Unknown
Port : 0
ConnectionType : Plaintext
ClientAccessServerShortName : ZAJNBEXC01
LocalSiteShortName : AFR-BYN
ClientAccessServer : ZAJNBEXC01.cws.sasol.com
Scenario : Create a MailboxSession object.
ScenarioDescription : Creating MailboxSession object to access the mailbox [[email protected]].
PerformanceCounterName :
Result : Failure
Error : Unable to create MailboxSession object to access the mailbox [[email protected]].
Detailed error information:
[Microsoft.Exchange.Data.Storage.WrongServerException]: The user and the mailbox are
in different Active Directory sites. Inner error [Microsoft.Mapi.Ma
UserName : migrationtest3
StartTime : 2015-02-24 10:58:51 AM
Latency : -00:00:00.0010000
EventType : Error
LatencyInMillisecondsString :
Identity :
IsValid : True
ObjectState : New
Amit -
RBL not working on Exchange 2013 Edge Transport
Single multi-role server with a couple of mailboxes, recently added an Edge Transport server. After configuring the Edge Subscribtion I added sen.spamhaus.org as a RBL Provider:
Add-IPBlockListProvider -Name Spamhaus -LookupDomain zen.spamhaus.org
This is not working. A lot of spam is still entering Exchange and the http://www.crynwr.com/spam/ test failed.
Both servers run Exchange 2013 CU5.
Did my post help? Please use "Vote As Helpful", "Mark as answer" or "Propose as answer". Thank you!Hi,
Yes, the command is specific for provider SpamHaus.
http://tweaks.com/windows/40003/cut-down-on-spam-with-ip-block-list-providers-rbl/
Note: Microsoft is providing this information as a convenience to you. The sites are not controlled by Microsoft. Microsoft cannot make any representations regarding the quality, safety,
or suitability of any software or information found there. Please make sure that you completely understand the risk before retrieving any suggestions from the above link.
Have you added the additional parameters in the command and did it work?
Thanks,
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact
[email protected]
Simon Wu
TechNet Community Support -
SME 7.1 not working with Exchange 2013 SP1 CU6
Hello, i tried upgrading to SME 7.1 on our Exchange 2013 SP1 CU6, but when trying to configure the Exchange Server in the SME management console using the configuration wizard, it gave an error before the LUN mapping page, saying "Failed to get Exchange information for server" and "The communication object, System.ServiceModel.Channels.ServiceChannel, cannot be used for communication because it is in the Faulted state.". I upgraded Snapdrive to 7.1, verfied all credentials according to the manuals, re-installed and rebooted multiple times (registry and filesystem cleaned, even tried to rename the existing SnapInfo directory, ...), stopped all other services on the server but without any change... Every time when trying to run the configuration wizard, the debug log shows no errors, lists all Exchange information and ends with the following lines:[11/18 12:51:58 155] Exit CSmeCDOExm::GetExchangeStructureInternal 0x0
[11/18 12:51:58 155] Exit CNtapSnapMgr::GetExchangeStructure: 0x0
[11/18 12:51:58 233] Enter CSmeServerBase::~CSmeServerBase ...
[11/18 12:51:58 248] m_ptrSnapShot released
[11/18 12:51:58 248] m_pISnapShot4 released
[11/18 12:51:58 248] m_pISnapShot5 released
[11/18 12:51:58 248] m_pISnapShot6 released
[11/18 12:51:58 248] m_pISnapShot7 released
[11/18 12:51:58 248] m_pISnapShot8 released
[11/18 12:51:58 248] m_pISnapShot9 released I ended up uninstalling SME 7.1 and re-installed SME 7.0 which is working. Exchange Server: ESXi 5.5 VM, Windows Server 2012 R2 (with current patches), Exchange 2013 SP1 CU6 - no DAG, single server installation (in co-existence with Exchange 2010), 4 iSCSI LUNs created with Snapdrive (1x Log, 3x Store), System drive and Exchange installation drive on vmdk Disks (via ESXi -> NFS store on the same NetApp)NetApp: FAS 2240-2 with Data ONTAP 8.1.4P1 7-mode (with complete license bundle) Anyone else got this problem or even better - a solution?We could not reproduce the error with the upgrade workflow.Looking at the error and the relevant function, we could force the problem in following conditions: -SME is configured or ran at the DAG level-one of the following services is stopped or not responding on one nodes of the DAG Snapdrive Service, Snapmanager Service, Snapdrive Storage Management Service,Snapdrive Management Service. Would be good if we could get the output of following powershell cmdlet before and after the upgrade: Get-Service –ComputerName Node1, Node2, Node3 –name Snap*, SDMGMT*, SWSvc Best regards,Dan
-
Redirect emails in OWA and Outlook 2010 not working in Exchange 2013
I have an new install of Exchange 2013 with all updates.
When I setup an inbox rule to redirect messages to another contact it is not working.
When I used Outlook 2010 and ran the rule manually I received this error:
"the redirect action is not currently supported with run rules now"
It seems that I didn't setup up something correctly in Exchange 2013 or a feature is not turned on. Please assist.
In the EM console when I setup forwarding that is working. Its the inbox rule redirect not working.Hi,
From your description, I recommend you use the following cmdlet to ensure that the DeliverToMailboxAndForward parameter is set to $True.
Get-Mailbox <identity> | fl DeliverToMailboxandForward
If this parameter is false, you can use the Set-Mailbox cmdlet to set it and check the result.
Hope this can be helpful to you.
Best regards,
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected]
Amy Wang
TechNet Community Support -
AutoReplyState is Enabled. But still OOF is not working on exchange 2013
Hi All,
We have exchange 2013 installed. How can I make our OOF (Out of Office) reply works?
Thanks in advance.
JakeHi Sneff,
Sorry, but I can't find anything on my event viewer that is "MSExchangeMailboxAssistants". Do i need to start the "Microsoft Account Sign-in Assistant" in services?
Checking oof with
https://testconnectivity.microsoft.com/. I got lots of "x". Please give some advice :
Exchange Web Services synchronization, notification, availability, and Automatic Replies.
Not all tests of Exchange Web Services tasks completed.
Additional Details
Elapsed Time: 42852 ms.
Test Steps
The Microsoft Connectivity Analyzer is attempting to test Autodiscover for blank.com.ph.
Testing Autodiscover failed.
Additional Details
Elapsed Time: 42852 ms.
Test Steps
Attempting each method of contacting the Autodiscover service.
The Autodiscover service couldn't be contacted successfully by any method.
Additional Details
Elapsed Time: 42852 ms.
Test Steps
Attempting to test potential Autodiscover URL https://blank.com.ph:443/Autodiscover/Autodiscover.xml
Testing of this potential Autodiscover URL failed.
Additional Details
Test Steps
Attempting to test potential Autodiscover URL https://autodiscover.blank.com.ph:443/Autodiscover/Autodiscover.xml
Testing of this potential Autodiscover URL failed.
Additional Details
Elapsed Time: 21299 ms.
Test Steps
Attempting to resolve the host name autodiscover.blank.com.ph in DNS.
The host name resolved successfully.
Additional Details
Testing TCP port 443 on host autodiscover.blank.com.ph to ensure it's listening and open.
The specified port is either blocked, not listening, or not producing the expected response.
<label for="testSelectWizard_ctl12_ctl06_ctl00_ctl00_ctl01_ctl01_tmmArrow">Tell
me more about this issue and how to resolve it</label>
Additional Details
Attempting to contact the Autodiscover service using the HTTP redirect method.
The attempt to contact Autodiscover using the HTTP Redirect method failed.
Additional Details
Test Steps
Attempting to contact the Autodiscover service using the DNS SRV redirect method.
The Microsoft Connectivity Analyzer failed to contact the Autodiscover service using the DNS SRV redirect method.
Additional Details
Test Steps
Checking if there is an autodiscover CNAME record in DNS for your domain 'blank.com.ph' for Office 365.
Failed to validate autodiscover CNAME record in DNS. If your mailbox isn't in Office 365, you can ignore this warning.
<label for="testSelectWizard_ctl12_ctl06_ctl00_ctl00_ctl04_tmmArrow">Tell
me more about this issue and how to resolve it</label>
Additional Details
There is no Autodiscover CNAME record for your domain 'blank.com.ph'.
Elapsed Time: 24 ms.
Thanks
Jake -
Lync integration not working after Exchange 2013 SP1 is installed...
Hi,
I have two Exchange 2013 servers running and everything is fine, almost.
The problem is that on the first server we had OWA with Lync integration working before installing SP1, but after the installation of SP1, it doesn't Work any more.
The second server was installed with SP1 from the start, but we can't get the Lync integration to Work on this one either..
When we log in to OWA, it just starts to sign in but then says "there was a problem signing in, if this continues please contact your helpdesk"
I have checked the Exchange server for events, and i can see the event ID 112 everytime i recycle the Application Pool, so there are some connection between Exchange and Lync..
Have any of you Guys seen or experienced any thing like this?
Thanks in advance.
Regards
KennethHi,
I recommend that you refer to the following article to troubleshoot the issue:
Troubleshooting tips for Exchange 2013 OWA IM Integration to Lync 2013
This post describes how to configure Exchange 2013 OWA to have IM integration to Lync 2013. Here I would like to give some troubleshooting tips in case you can't get the integration to work.
In addition, here is a similar thread for your reference:
Lync 2013 with Exchange 2013 SP1 OWA integration failed
Hope this helps!
Thanks.
Niko Cheng
TechNet Community Support -
Moderation Mail Not Work in Exchange 2013
Hello All,
I facing difficulties regarding Moderation Mail. The Moderation mail not send to moderator. also i found that the arbitration mailbox also corrupted.
Error:
WARNING: The object abc.com/Users/Migration.8f3e7716-2011-43e4-96b1-aba62d229136 has been corrupted, and
it's in an inconsistent state. The following validation errors happened:
WARNING: Database is mandatory on UserMailbox.
WARNING: Database is mandatory on UserMailbox.
Please suggestHi,
To recreate this arbitration mailbox, you can follow the steps below.
Start the Active Directory Users and Computers snap-in.
Click Users, and then find the following account:
Migration.8f3e7716-2011-43e4-96b1-aba62d229136
Remove this account.
Run the following cmdlet:
setup /preparead/IAcceptExchangeServerLicenseTerms
Run the following cmdlets:
Enable-Mailbox -Arbitration -Identity "Migration.8f3e7716-2011-43e4-96b1-aba62d229136"
Set-Mailbox "Migration.8f3e7716-2011-43e4-96b1-aba62d229136" -Arbitration –Management:$true
Here is an article about re-creating the Discovery system mailbox, it is the same process to recreate the arbitration mailbox mentioned in the error message above.
http://technet.microsoft.com/en-gb/library/gg588318(v=exchg.150).aspx
Best regards,
Belinda Ma
TechNet Community Support -
Mailbox auditing log search only shows last 7 days
I have mailbox auditing turned on for a mailbox, and the audit log age limit is set to 90 days. When I run the non admin user access report however it only shows me auditing items for the past 7 days. If i go to powershell, and run search-mailboxauditlog
it shows the same 7 days. Any suggestions?http://technet.microsoft.com/en-us/library/ff459237(v=exchg.150).aspx
Mailbox audit logs are generated for each mailbox that has mailbox audit logging enabled. Log entries are stored in the Audits subfolder of the audited mailbox Recoverable Items folder. This ensures that all audit logs are available from a single location,
regardless of which client access method was used to access the mailbox or which server or workstation an administrator used to access the mailbox audit log. If you move a mailbox to another Mailbox server, the mailbox audit logs for that mailbox are also
moved because they're located in the mailbox.
By default, mailbox audit log entries are retained in the mailbox for 90 days and then deleted. You can modify this retention period by using the
AuditLogAgeLimit parameter with the
Set-Mailbox cmdlet. If a mailbox is on In-Place Hold or litigation hold, audit log entries are only retained until the audit log retention period for the mailbox is reached. To retain audit log entries longer, you have to increase the retention period by
changing the value for the AuditLogAgeLimit parameter, or export audit log entries before the retention period is reached.
Ed Crowley MVP "There are seldom good technological solutions to behavioral problems." -
Can't enable mailbox audit logs
Hello!
I can't enable mailbox audit logs. I use cmdlet Set-Mailbox -Identity "mailbox" -AuditEnabled $true and Get-Mailbox shows that
audit is enabled. But when i check Get-Mailbox| Get-MailboxFoldersStatistics there is no "Audit" subfolder, and all audit searches also return no results.
I am working now with several Exchange installations (five actually, and one is brand-new test lab) and checked the same in each organization. Result was the same!
I am stronly sure i miss something important, could you point it to me?Hi,
Please use the following command to check the Mailbox Audit Logging action setting.
Get-Mailbox –Identity “username” | fl name,*audit*
Are there any administrator, delegate, and owner actions in the audit logging configuration for that mailbox? Please post them to check this issue.
If the settings above are configured correctly, only the administrator, delegate, and owner actions specified in the audit logging configuration for the mailbox are logged. And the “Audits” folder will show up after the administrator, delegate,
and owner take the actions specified in the audit logging configuration.
By default, these actions in the audit logging configuration should be like this:
AuditAdmin : {Update, Move, MoveToDeletedItems, SoftDelete, HardDelete, FolderBind, SendAs, SendOnBehalf, Create}
AuditDelegate : {Update, SoftDelete, HardDelete, SendAs, Create}
AuditOwner : {}
By the way, which command do you use to search the audit log?
Mailbox audit logging procedures
https://technet.microsoft.com/en-us/library/ff461939%28v=exchg.150%29.aspx?f=255&MSPPError=-2147217396
Best Regards.
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected]
Lynn-Li
TechNet Community Support -
When enabling Mailbox Audit Logging would take effect?
I enable the Mailbox Audit Logging by the command below, but found it can't take effect
immediately (I have no idea if there is needs some time to replication ,or others in the DC)even I reboot the exchange server.
So my question is if I want to make the "Mailbox Audit Logging" taking effect immediately , what should I do?
Set-Mailbox -Identity "Ben Smith" -AuditEnabled $true
Set-Mailbox -Identity "Ben Smith" -AuditDelegate SendAs,SendOnBehalf ,,,,,,,,-AuditEnabled $true
Set-Mailbox -Identity "Ben Smith" -AuditAdmin MessageBind,FolderBind,,,,,,,, -AuditEnabled $true
Set-Mailbox -Identity "Ben Smith" -AuditOwner HardDelete,,,,,,,, -AuditEnabled $truehttp://technet.microsoft.com/en-us/library/ff461937(v=exchg.141).aspx
Please click the Mark as Answer button if a post solves your problem!In order to force auditing to run immediately (and be sure it does), you need a few things - you need only one domain controller, and you need to restart the Microsoft Exchange Active Directory Topology service (which will restart all Exchange services)
on all of your Exchange servers. I highly recommend not doing either of these, since they will 1) reduce the availability of your Active Directory, and 2) take all your Exchange databases offline. Auditing will take effect in a short time period
after being set, so all you can do is wait (unless you want to do the above). We do auditing on all our mailboxes and set them when we create the mailbox. That way, we don't need to worry about missing something because it wasn't enabled.
BTW, the above commands don't need all the extra commas, and if you are doing them on a single mailbox, they can be run as a single command:
Set-Mailbox -Identity "Ben Smith" -AuditDelegate SendAs,SendOnBehalf -AuditAdmin MessageBind,FolderBind -AuditOwner HardDelete -AuditEnabled $true -
Can we backup mailbox audit log? These logs are stored in the recovery folder in each mailbox. Normally it should be backup with mailbox. How can restore and query these logs from after their audit age limit has expired?
Thanks.
Irfan
Irfan Goolab SALES ENGINEER (Microsoft UC) MCP, MCSA, MCTS, MCITP, MCTHi Irfan,
Base on my knowledge, you can refer to the following methods to backup audit log:
1. Export mailbox audit logs:
https://technet.microsoft.com/en-us/library/jj150552(v=exchg.150).aspx
2. Audit logs can be found in the eventviewer under MSExchangeManagement, you can save it, as below:
Best regards,
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected]
Niko Cheng
TechNet Community Support -
Hi!
We have two exchange servers in our company, ex2010 and ex2013. I set the audit logging to true for some mailbox, but if i run a report at the ex2013 to a specific a mailbox no data at the log. But! if i run a report at the ex2010 ecp website i get information
from the same mailbox (folderbind etc..). I try run a report via shell at the ex2013, no data, same as the gui. The specific mailboxes migrated from ex2010 to ex2013.Hi ToniSlow,
Thank you for your question.
We could run the following command to make sure the mailbox has been moved to Exchange 2013:
Get-Mailbox <username> | FL
Then we could check the item of “database” if this database is on Exchange 2013.
By my understanding, when we move mailbox to Exchange 2013, the mailbox audit logs for that mailbox are also moved because they're located in the mailbox.
If there are any questions regarding this issue, please be free to let me know.
Best Regard,
Jim
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected]
Jim Xu
TechNet Community Support
Maybe you are looking for
-
How can I download my 2005 copy of Audition 1.5 again?
How can I download my 2005 copy of Audition 1.5 again?
-
How to fetech n number of rows at one time
Hi, In my production there is 3 million records data.So its taking long time to diplay the record.So i am thinking of display 100 records at a time.the query is SELECT MDN_NUMBER,STATUS,CUSTOMER_TYPE,PHONE_TYPE,CIRCLE,FIRST_NAME, LAST_NAME,ADDRESS,CI
-
How group by function/procedure used in function
i want to capture information in different table which extract by select statement like(select trans_date from bankAccount group by cust_id).
-
Mac OSX (10.5.6) to TV
Question #1: When I connect my Mac to TV, the appearance on the Mac enlarges. Need help. Question#2: After I burn a DVD on my Mac, it won't play in another player. Need help.
-
Remove the unique icon for movie files
In Finder, I get a custom icon for each movie file that is the first frame of the movie. That doesn't help me, so I want to change it to only show the QuickTime image as a custom icon. This is the behavior of Tiger and it was useful to me. I don't ge