Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

Search-AdminAuditLog returns no results

Posted on 2015-02-15
6
Medium Priority
?
781 Views
Last Modified: 2015-02-20
Hey all,

So, in my lab I have Exchange 2010 and Exchange 2013 in coexistence.

On the Exchange 2010 box I can run Search-AdminAuditLog and get all the CMDLETs that have been run in my environment. Including CMDLETs run from the 2013 side. As expected.

When I run Search-AdminAuditLog from 2013 EMS it returns no results. Just goes back to a prompt as if the AdminLog was empty. No error.

The configuration of the Admin Audit Log on 2013 is in its default out-of-the-box setting. I confirmed nothing had changed as well with Get-AdminAuditLogConfig. Its identical to 2010.

Exchange 2013 is on the latest CU. Single server in lab - no DAG.

I am wondering if it is something with the Arbitration mailbox.  The arbitration mailbox is on 2013. Or maybe even Indexing.
0
Comment
Question by:Gareth Gudger
  • 4
  • 2
6 Comments
 
LVL 53

Expert Comment

by:Will Szymkowski
ID: 40611070
If you run the Audit command from the EAC do you get any results? Also, might be a long shot but I would check to see if your AuditLogAgent is enabled.

I would assume because you are getting logs appearing from Exchange 2013 from 2010.

Get-CmdletExtensionAgent -Identity "admin audit log agent" | fl

Open in new window


I don't have a 2010/2013 co-existenance in my lab (currently just 2007/2013), but i also have a 2013 green install and get-adminauditlog works out of the box.

Will.
0
 
LVL 31

Author Comment

by:Gareth Gudger
ID: 40611150
Yep. The ExtensionAgent is enabled.

Yea its strange. I have used this before in greenfield and coexistence scenarios. And you are right it is enabled by default. And the lab is fairly new. So I'm a little baffled. This is the first time ever I have seen it not work.

One thing I did just notice though is that while I can pull the entire admin audit log from 2010, as soon as I enter parameters I get nothing in return. So for example if I used -StartDate or -Cmdlets. I have seen others post on the forums about that symptom as well but with no real solution ever posted.

I'm going to build another exchange admin as well. Just to see.
0
 
LVL 31

Accepted Solution

by:
Gareth Gudger earned 0 total points
ID: 40611169
So I created a new Exchange Admin and its fine..... weird!!!

Far as I can tell both have the same rights.... oh well. Will research that a bit later.
0
Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 53

Expert Comment

by:Will Szymkowski
ID: 40611540
That is bizarre. Did you create a fresh new account or did you copy an existing account. If you didn't copy the account I would be curious if it would work the same.

Will.
0
 
LVL 31

Author Comment

by:Gareth Gudger
ID: 40611567
I just threw Organization Management onto one of my regular users and it worked.

Would be interesting to see what a copy did.
0
 
LVL 31

Author Closing Comment

by:Gareth Gudger
ID: 40620772
New Admin fixed the issue.
0

Featured Post

Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Want to know how to use Exchange Server Eseutil command? Go through this article as it gives you the know-how.
This month, Experts Exchange sat down with resident SQL expert, Jim Horn, for an in-depth look into the makings of a successful career in SQL.
In this video we show how to create an Address List in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Organization >> Ad…
The video tutorial explains the basics of the Exchange server Database Availability groups. The components of this video include: 1. Automatic Failover 2. Failover Clustering 3. Active Manager
Suggested Courses

971 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question