Solved

Search-AdminAuditLog returns no results

Posted on 2015-02-15
6
361 Views
Last Modified: 2015-02-20
Hey all,

So, in my lab I have Exchange 2010 and Exchange 2013 in coexistence.

On the Exchange 2010 box I can run Search-AdminAuditLog and get all the CMDLETs that have been run in my environment. Including CMDLETs run from the 2013 side. As expected.

When I run Search-AdminAuditLog from 2013 EMS it returns no results. Just goes back to a prompt as if the AdminLog was empty. No error.

The configuration of the Admin Audit Log on 2013 is in its default out-of-the-box setting. I confirmed nothing had changed as well with Get-AdminAuditLogConfig. Its identical to 2010.

Exchange 2013 is on the latest CU. Single server in lab - no DAG.

I am wondering if it is something with the Arbitration mailbox.  The arbitration mailbox is on 2013. Or maybe even Indexing.
0
Comment
Question by:Gareth Gudger
  • 4
  • 2
6 Comments
 
LVL 53

Expert Comment

by:Will Szymkowski
ID: 40611070
If you run the Audit command from the EAC do you get any results? Also, might be a long shot but I would check to see if your AuditLogAgent is enabled.

I would assume because you are getting logs appearing from Exchange 2013 from 2010.

Get-CmdletExtensionAgent -Identity "admin audit log agent" | fl

Open in new window


I don't have a 2010/2013 co-existenance in my lab (currently just 2007/2013), but i also have a 2013 green install and get-adminauditlog works out of the box.

Will.
0
 
LVL 31

Author Comment

by:Gareth Gudger
ID: 40611150
Yep. The ExtensionAgent is enabled.

Yea its strange. I have used this before in greenfield and coexistence scenarios. And you are right it is enabled by default. And the lab is fairly new. So I'm a little baffled. This is the first time ever I have seen it not work.

One thing I did just notice though is that while I can pull the entire admin audit log from 2010, as soon as I enter parameters I get nothing in return. So for example if I used -StartDate or -Cmdlets. I have seen others post on the forums about that symptom as well but with no real solution ever posted.

I'm going to build another exchange admin as well. Just to see.
0
 
LVL 31

Accepted Solution

by:
Gareth Gudger earned 0 total points
ID: 40611169
So I created a new Exchange Admin and its fine..... weird!!!

Far as I can tell both have the same rights.... oh well. Will research that a bit later.
0
Don't lose your head updating email signatures!

Do your end users still have the wrong email signature? Do email signature updates bore you or fill you with a sense of dread? You can make this a whole lot easier on yourself by trusting an Exclaimer email signature management solution. Over 50 million users do...so should you!

 
LVL 53

Expert Comment

by:Will Szymkowski
ID: 40611540
That is bizarre. Did you create a fresh new account or did you copy an existing account. If you didn't copy the account I would be curious if it would work the same.

Will.
0
 
LVL 31

Author Comment

by:Gareth Gudger
ID: 40611567
I just threw Organization Management onto one of my regular users and it worked.

Would be interesting to see what a copy did.
0
 
LVL 31

Author Closing Comment

by:Gareth Gudger
ID: 40620772
New Admin fixed the issue.
0

Featured Post

Do email signature updates give you a headache?

Constantly trying to correctly format email signatures? Spending all of your time at every user’s desk to make updates? Want high-quality HTML signatures on all devices, including on mobiles and Macs? Then, let Exclaimer solve all your email signature problems today!

Join & Write a Comment

Suggested Solutions

Title # Comments Views Activity
outlook, calendar 21 41
Powershell Script Error Handling 7 34
Custom attributes in Exchange 8 37
cached or not 5 41
"Migrate" an SMTP relay receive connector to a new server using info from an old server.
Find out how to use Active Directory data for email signature management in Microsoft Exchange and Office 365.
To show how to generate a certificate request in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.:  First we need to log into the Exchange Admin Center. Navigate to the Servers >> Certificates…
This video discusses moving either the default database or any database to a new volume.

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now