Solved

Search-AdminAuditLog returns no results

Posted on 2015-02-15
6
409 Views
Last Modified: 2015-02-20
Hey all,

So, in my lab I have Exchange 2010 and Exchange 2013 in coexistence.

On the Exchange 2010 box I can run Search-AdminAuditLog and get all the CMDLETs that have been run in my environment. Including CMDLETs run from the 2013 side. As expected.

When I run Search-AdminAuditLog from 2013 EMS it returns no results. Just goes back to a prompt as if the AdminLog was empty. No error.

The configuration of the Admin Audit Log on 2013 is in its default out-of-the-box setting. I confirmed nothing had changed as well with Get-AdminAuditLogConfig. Its identical to 2010.

Exchange 2013 is on the latest CU. Single server in lab - no DAG.

I am wondering if it is something with the Arbitration mailbox.  The arbitration mailbox is on 2013. Or maybe even Indexing.
0
Comment
Question by:Gareth Gudger
  • 4
  • 2
6 Comments
 
LVL 53

Expert Comment

by:Will Szymkowski
ID: 40611070
If you run the Audit command from the EAC do you get any results? Also, might be a long shot but I would check to see if your AuditLogAgent is enabled.

I would assume because you are getting logs appearing from Exchange 2013 from 2010.

Get-CmdletExtensionAgent -Identity "admin audit log agent" | fl

Open in new window


I don't have a 2010/2013 co-existenance in my lab (currently just 2007/2013), but i also have a 2013 green install and get-adminauditlog works out of the box.

Will.
0
 
LVL 31

Author Comment

by:Gareth Gudger
ID: 40611150
Yep. The ExtensionAgent is enabled.

Yea its strange. I have used this before in greenfield and coexistence scenarios. And you are right it is enabled by default. And the lab is fairly new. So I'm a little baffled. This is the first time ever I have seen it not work.

One thing I did just notice though is that while I can pull the entire admin audit log from 2010, as soon as I enter parameters I get nothing in return. So for example if I used -StartDate or -Cmdlets. I have seen others post on the forums about that symptom as well but with no real solution ever posted.

I'm going to build another exchange admin as well. Just to see.
0
 
LVL 31

Accepted Solution

by:
Gareth Gudger earned 0 total points
ID: 40611169
So I created a new Exchange Admin and its fine..... weird!!!

Far as I can tell both have the same rights.... oh well. Will research that a bit later.
0
Optimizing Cloud Backup for Low Bandwidth

With cloud storage prices going down a growing number of SMBs start to use it for backup storage. Unfortunately, business data volume rarely fits the average Internet speed. This article provides an overview of main Internet speed challenges and reveals backup best practices.

 
LVL 53

Expert Comment

by:Will Szymkowski
ID: 40611540
That is bizarre. Did you create a fresh new account or did you copy an existing account. If you didn't copy the account I would be curious if it would work the same.

Will.
0
 
LVL 31

Author Comment

by:Gareth Gudger
ID: 40611567
I just threw Organization Management onto one of my regular users and it worked.

Would be interesting to see what a copy did.
0
 
LVL 31

Author Closing Comment

by:Gareth Gudger
ID: 40620772
New Admin fixed the issue.
0

Featured Post

NAS Cloud Backup Strategies

This article explains backup scenarios when using network storage. We review the so-called “3-2-1 strategy” and summarize the methods you can use to send NAS data to the cloud

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Local Continuous Replication is a cost effective and quick way of backing up Exchange server data. The following article describes the steps required to configure Local Continuous Replication. Also, the article tells you how to restore from a backup…
Scam emails are a huge burden for many businesses. Spotting one is not always easy. Follow our tips to identify if an email you receive is a scam.
In this video we show how to create a mailbox database in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Servers >> Data…
how to add IIS SMTP to handle application/Scanner relays into office 365.

770 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question