Solved

Search-AdminAuditLog returns no results

Posted on 2015-02-15
6
386 Views
Last Modified: 2015-02-20
Hey all,

So, in my lab I have Exchange 2010 and Exchange 2013 in coexistence.

On the Exchange 2010 box I can run Search-AdminAuditLog and get all the CMDLETs that have been run in my environment. Including CMDLETs run from the 2013 side. As expected.

When I run Search-AdminAuditLog from 2013 EMS it returns no results. Just goes back to a prompt as if the AdminLog was empty. No error.

The configuration of the Admin Audit Log on 2013 is in its default out-of-the-box setting. I confirmed nothing had changed as well with Get-AdminAuditLogConfig. Its identical to 2010.

Exchange 2013 is on the latest CU. Single server in lab - no DAG.

I am wondering if it is something with the Arbitration mailbox.  The arbitration mailbox is on 2013. Or maybe even Indexing.
0
Comment
Question by:Gareth Gudger
  • 4
  • 2
6 Comments
 
LVL 53

Expert Comment

by:Will Szymkowski
ID: 40611070
If you run the Audit command from the EAC do you get any results? Also, might be a long shot but I would check to see if your AuditLogAgent is enabled.

I would assume because you are getting logs appearing from Exchange 2013 from 2010.

Get-CmdletExtensionAgent -Identity "admin audit log agent" | fl

Open in new window


I don't have a 2010/2013 co-existenance in my lab (currently just 2007/2013), but i also have a 2013 green install and get-adminauditlog works out of the box.

Will.
0
 
LVL 31

Author Comment

by:Gareth Gudger
ID: 40611150
Yep. The ExtensionAgent is enabled.

Yea its strange. I have used this before in greenfield and coexistence scenarios. And you are right it is enabled by default. And the lab is fairly new. So I'm a little baffled. This is the first time ever I have seen it not work.

One thing I did just notice though is that while I can pull the entire admin audit log from 2010, as soon as I enter parameters I get nothing in return. So for example if I used -StartDate or -Cmdlets. I have seen others post on the forums about that symptom as well but with no real solution ever posted.

I'm going to build another exchange admin as well. Just to see.
0
 
LVL 31

Accepted Solution

by:
Gareth Gudger earned 0 total points
ID: 40611169
So I created a new Exchange Admin and its fine..... weird!!!

Far as I can tell both have the same rights.... oh well. Will research that a bit later.
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 
LVL 53

Expert Comment

by:Will Szymkowski
ID: 40611540
That is bizarre. Did you create a fresh new account or did you copy an existing account. If you didn't copy the account I would be curious if it would work the same.

Will.
0
 
LVL 31

Author Comment

by:Gareth Gudger
ID: 40611567
I just threw Organization Management onto one of my regular users and it worked.

Would be interesting to see what a copy did.
0
 
LVL 31

Author Closing Comment

by:Gareth Gudger
ID: 40620772
New Admin fixed the issue.
0

Featured Post

The problems with reply email signatures

Do you wish that you could place an email signature under a reply? Well, unfortunately, you can't. That great Exchange/Office 365 signature you've created will just appear at the bottom of an email chain. What a pain! Is there really no way to solve this? Well, there might be...

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article lists the top 5 free OST to PST Converter Tools. These tools save a lot of time for users when they want to convert OST to PST after their exchange server is no longer available or some other critical issue with exchange server or impor…
This article aims to explain the working of CircularLogArchiver. This tool was designed to solve the buildup of log file in cases where systems do not support circular logging or where circular logging is not enabled
In this video we show how to create a User Mailbox in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >> Mailb…
In this video we show how to create a Resource Mailbox in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: Navigate to the Recipients >> Resources tab.: "Recipients" is our default selection …

910 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

22 Experts available now in Live!

Get 1:1 Help Now