Home

Unable to view Admin Audit Logs in EAC or EMS

%3CLINGO-SUB%20id%3D%22lingo-sub-770757%22%20slang%3D%22en-US%22%3EUnable%20to%20view%20Admin%20Audit%20Logs%20in%20EAC%20or%20EMS%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-770757%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20all%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20upgraded%20all%20our%20Exchange%20Servers%20from%202010%20CU%2022%20to%202016%20CU%2010%20in%20November%202018%20with%20only%20one%20Exchange%202010%20server%20remaining.%20Since%20the%20upgrade%20I%20have%20been%20unable%20to%20view%20any%20admin%20audit%20logs%20in%20EAC%20or%20EMS%20I%20can%20however%20view%20them%20in%20Event%20Viewer%20on%20the%20Exchange%20Servers.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWhen%20I%20run%20the%20Get-AdminAuditConfig%20it%20displays%20the%20Exchange%20Version%20as%202010%2C%20when%20i%20check%20the%20Admin%20Audit%20Log%20Settings%20Properties%20in%20ADSI%20it%20displays%20msExchVersion%3A%2044220983382016%20(2010).%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20System%20Mailbox%20that%20holds%20the%20Admin%20Audit%20Logs%20displays%20msExchVersion%3A%2088218628259840%20(2013)%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWhen%20I%20run%20the%20following%20command%20(%3CSPAN%3EGet-Mailbox%20-Arbitration%20%7C%20Get-MailboxFolderStatistics%20%7C%20where%20%7B%24_.identity%20-like%20%E2%80%9C*AdminAuditLogs%E2%80%9D%7D%20%7C%20FL%20*)%2C%20I%20can%20see%20the%20item%20count%20increasing%20which%20tells%20me%20that%20it%20is%20working.%20Under%20the%20oldest%2Fnewest%20item%20properties%20that%20are%20displayed%20from%20this%20command%20they%20are%20blank%20entries%20(I%20dont%20believe%20this%20is%20normal%20behavior).%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EI%20have%20been%20searching%20the%20internet%20for%20quite%20some%20time%20on%20this%20and%20I%20have%20found%20nothing%20remotely%20close%20to%20the%20issue%20I%20am%20having.%20My%20questions%20to%20the%20community%20are%3A%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%3CSPAN%3E1.%20Is%20the%202010%20Exchange%20version%20setting%20in%20the%20Admin%20Audit%20Log%20Config%20my%20potential%20problem%3F%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%3CSPAN%3E2.%20Did%20the%20version%20not%20update%20to%202016%20as%20I%20still%20run%20one%20Exchange%202010%20server%3F%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%3CSPAN%3E3.%20Can%20the%20version%20be%20changed%20to%20reflect%20Exchange%202016%3F%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%3CSPAN%3E4.%20Why%20does%20my%20Audit%20Log%20mailbox%20display%20a%202013%20version%3F%20(We%20have%20never%20had%202013%20installed)%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%3CSPAN%3E5.%20Has%20anyone%20experienced%20a%20similar%20issue%20when%20migrating%20from%202010%20to%202016%3F%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20in%20advance.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EP.S%20Yes%20the%20admin%20audit%20log%20is%20enabled%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-770757%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3E2016%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EExchange%20Server%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Matt_B010
Visitor

Hi all,

 

I upgraded all our Exchange Servers from 2010 CU 22 to 2016 CU 10 in November 2018 with only one Exchange 2010 server remaining. Since the upgrade I have been unable to view any admin audit logs in EAC or EMS I can however view them in Event Viewer on the Exchange Servers. 

 

When I run the Get-AdminAuditConfig it displays the Exchange Version as 2010, when i check the Admin Audit Log Settings Properties in ADSI it displays msExchVersion: 44220983382016 (2010). 

The System Mailbox that holds the Admin Audit Logs displays msExchVersion: 88218628259840 (2013)

 

When I run the following command (Get-Mailbox -Arbitration | Get-MailboxFolderStatistics | where {$_.identity -like “*AdminAuditLogs”} | FL *), I can see the item count increasing which tells me that it is working. Under the oldest/newest item properties that are displayed from this command they are blank entries (I dont believe this is normal behavior).

 

I have been searching the internet for quite some time on this and I have found nothing remotely close to the issue I am having. My questions to the community are:

1. Is the 2010 Exchange version setting in the Admin Audit Log Config my potential problem?

2. Did the version not update to 2016 as I still run one Exchange 2010 server?

3. Can the version be changed to reflect Exchange 2016?

4. Why does my Audit Log mailbox display a 2013 version? (We have never had 2013 installed)

5. Has anyone experienced a similar issue when migrating from 2010 to 2016?

 

Thanks in advance.

 

P.S Yes the admin audit log is enabled

 

Related Conversations