Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 865
  • Last Modified:

Search-AdminAuditLog returns no results

Hey all,

So, in my lab I have Exchange 2010 and Exchange 2013 in coexistence.

On the Exchange 2010 box I can run Search-AdminAuditLog and get all the CMDLETs that have been run in my environment. Including CMDLETs run from the 2013 side. As expected.

When I run Search-AdminAuditLog from 2013 EMS it returns no results. Just goes back to a prompt as if the AdminLog was empty. No error.

The configuration of the Admin Audit Log on 2013 is in its default out-of-the-box setting. I confirmed nothing had changed as well with Get-AdminAuditLogConfig. Its identical to 2010.

Exchange 2013 is on the latest CU. Single server in lab - no DAG.

I am wondering if it is something with the Arbitration mailbox.  The arbitration mailbox is on 2013. Or maybe even Indexing.
0
Gareth Gudger
Asked:
Gareth Gudger
  • 4
  • 2
1 Solution
 
Will SzymkowskiSenior Solution ArchitectCommented:
If you run the Audit command from the EAC do you get any results? Also, might be a long shot but I would check to see if your AuditLogAgent is enabled.

I would assume because you are getting logs appearing from Exchange 2013 from 2010.

Get-CmdletExtensionAgent -Identity "admin audit log agent" | fl

Open in new window


I don't have a 2010/2013 co-existenance in my lab (currently just 2007/2013), but i also have a 2013 green install and get-adminauditlog works out of the box.

Will.
0
 
Gareth GudgerAuthor Commented:
Yep. The ExtensionAgent is enabled.

Yea its strange. I have used this before in greenfield and coexistence scenarios. And you are right it is enabled by default. And the lab is fairly new. So I'm a little baffled. This is the first time ever I have seen it not work.

One thing I did just notice though is that while I can pull the entire admin audit log from 2010, as soon as I enter parameters I get nothing in return. So for example if I used -StartDate or -Cmdlets. I have seen others post on the forums about that symptom as well but with no real solution ever posted.

I'm going to build another exchange admin as well. Just to see.
0
 
Gareth GudgerAuthor Commented:
So I created a new Exchange Admin and its fine..... weird!!!

Far as I can tell both have the same rights.... oh well. Will research that a bit later.
0
Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
Will SzymkowskiSenior Solution ArchitectCommented:
That is bizarre. Did you create a fresh new account or did you copy an existing account. If you didn't copy the account I would be curious if it would work the same.

Will.
0
 
Gareth GudgerAuthor Commented:
I just threw Organization Management onto one of my regular users and it worked.

Would be interesting to see what a copy did.
0
 
Gareth GudgerAuthor Commented:
New Admin fixed the issue.
0

Featured Post

Upgrade your Question Security!

Your question, your audience. Choose who sees your identity—and your question—with question security.

  • 4
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now