Home

Unable to view Admin Audit Logs in EAC or EMS

%3CLINGO-SUB%20id%3D%22lingo-sub-770757%22%20slang%3D%22en-US%22%3EUnable%20to%20view%20Admin%20Audit%20Logs%20in%20EAC%20or%20EMS%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-770757%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20all%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20upgraded%20all%20our%20Exchange%20Servers%20from%202010%20CU%2022%20to%202016%20CU%2010%20in%20November%202018%20with%20only%20one%20Exchange%202010%20server%20remaining.%20Since%20the%20upgrade%20I%20have%20been%20unable%20to%20view%20any%20admin%20audit%20logs%20in%20EAC%20or%20EMS%20I%20can%20however%20view%20them%20in%20Event%20Viewer%20on%20the%20Exchange%20Servers.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWhen%20I%20run%20the%20Get-AdminAuditConfig%20it%20displays%20the%20Exchange%20Version%20as%202010%2C%20when%20i%20check%20the%20Admin%20Audit%20Log%20Settings%20Properties%20in%20ADSI%20it%20displays%20msExchVersion%3A%2044220983382016%20(2010).%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20System%20Mailbox%20that%20holds%20the%20Admin%20Audit%20Logs%20displays%20msExchVersion%3A%2088218628259840%20(2013)%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWhen%20I%20run%20the%20following%20command%20(%3CSPAN%3EGet-Mailbox%20-Arbitration%20%7C%20Get-MailboxFolderStatistics%20%7C%20where%20%7B%24_.identity%20-like%20%E2%80%9C*AdminAuditLogs%E2%80%9D%7D%20%7C%20FL%20*)%2C%20I%20can%20see%20the%20item%20count%20increasing%20which%20tells%20me%20that%20it%20is%20working.%20Under%20the%20oldest%2Fnewest%20item%20properties%20that%20are%20displayed%20from%20this%20command%20they%20are%20blank%20entries%20(I%20dont%20believe%20this%20is%20normal%20behavior).%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EI%20have%20been%20searching%20the%20internet%20for%20quite%20some%20time%20on%20this%20and%20I%20have%20found%20nothing%20remotely%20close%20to%20the%20issue%20I%20am%20having.%20My%20questions%20to%20the%20community%20are%3A%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%3CSPAN%3E1.%20Is%20the%202010%20Exchange%20version%20setting%20in%20the%20Admin%20Audit%20Log%20Config%20my%20potential%20problem%3F%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%3CSPAN%3E2.%20Did%20the%20version%20not%20update%20to%202016%20as%20I%20still%20run%20one%20Exchange%202010%20server%3F%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%3CSPAN%3E3.%20Can%20the%20version%20be%20changed%20to%20reflect%20Exchange%202016%3F%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%3CSPAN%3E4.%20Why%20does%20my%20Audit%20Log%20mailbox%20display%20a%202013%20version%3F%20(We%20have%20never%20had%202013%20installed)%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%3CSPAN%3E5.%20Has%20anyone%20experienced%20a%20similar%20issue%20when%20migrating%20from%202010%20to%202016%3F%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20in%20advance.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EP.S%20Yes%20the%20admin%20audit%20log%20is%20enabled%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-770757%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3E2016%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EExchange%20Server%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Matt_B010
Occasional Contributor

Hi all,

 

I upgraded all our Exchange Servers from 2010 CU 22 to 2016 CU 10 in November 2018 with only one Exchange 2010 server remaining. Since the upgrade I have been unable to view any admin audit logs in EAC or EMS I can however view them in Event Viewer on the Exchange Servers. 

 

When I run the Get-AdminAuditConfig it displays the Exchange Version as 2010, when i check the Admin Audit Log Settings Properties in ADSI it displays msExchVersion: 44220983382016 (2010). 

The System Mailbox that holds the Admin Audit Logs displays msExchVersion: 88218628259840 (2013)

 

When I run the following command (Get-Mailbox -Arbitration | Get-MailboxFolderStatistics | where {$_.identity -like “*AdminAuditLogs”} | FL *), I can see the item count increasing which tells me that it is working. Under the oldest/newest item properties that are displayed from this command they are blank entries (I dont believe this is normal behavior).

 

I have been searching the internet for quite some time on this and I have found nothing remotely close to the issue I am having. My questions to the community are:

1. Is the 2010 Exchange version setting in the Admin Audit Log Config my potential problem?

2. Did the version not update to 2016 as I still run one Exchange 2010 server?

3. Can the version be changed to reflect Exchange 2016?

4. Why does my Audit Log mailbox display a 2013 version? (We have never had 2013 installed)

5. Has anyone experienced a similar issue when migrating from 2010 to 2016?

 

Thanks in advance.

 

P.S Yes the admin audit log is enabled

 

Related Conversations
Tabs and Dark Mode
cjc2112 in Discussions on
35 Replies
Extentions Synchronization
Deleted in Discussions on
3 Replies
flashing a white screen while open new tab
Deleted in Discussions on
14 Replies
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies
How to Prevent Teams from Auto-Launch
chenrylee in Microsoft Teams on
29 Replies