Remove Auditing from exchange mailbox

%3CLINGO-SUB%20id%3D%22lingo-sub-2541044%22%20slang%3D%22en-US%22%3ERemove%20Auditing%20from%20exchange%20mailbox%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2541044%22%20slang%3D%22en-US%22%3E%3CP%3EI%20am%20trying%20to%20move%20an%20account%20from%20Exchange%20On-Prem%20to%20Exchange%20Online.%20The%20migration%20failed%20to%20complete%20because%20there%20were%20too%20many%20items%20in%20a%20single%20folder.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20checked%20the%20ItemsInFolder%20for%20the%20affected%20user%20and%20found%20the%20%22AUDITS%22%20folder%20has%20over%203%20million%20items%20in%20it.%20I%20want%20to%20remove%20the%20items%20from%20the%20mailbox%2C%20and%20then%20restart%20the%20Auditing%20when%20the%20mailbox%20is%20in%20Office%20365.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20disabled%20auditing%20on%20the%20mailbox%20using%20the%20powershell%20command%20%22get-mailbox%20%3CUSER%3E%20%7C%20set-mailbox%20-AuditEnabled%20%24false%22.%20This%20does%20not%20remove%20the%20folder%2C%20and%20the%20Items%20in%20the%20folder%20continued%20to%20increase.%3C%2FUSER%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20set%20the%20time%20to%20keep%20audit%20items%20to%200%20by%20%22Get-Mailbox%20%3CUSER%3E%20%7C%20set-mailbox%20-AuditLogAgeLimit%200%22.%20After%20issuing%20this%20command%20I%20got%20a%20warning%20telling%20me%20that%20it%20will%20immediately%20delete%20all%20audit%20logs.%3C%2FUSER%3E%3C%2FP%3E%3CP%3EGREAT!%20That's%20what%20I%20want%2C%20but%20no%2C%20it%20doesn't%20delete%20the%20audit%20logs%2C%20and%20they%20continue%20to%20grow.%3C%2FP%3E%3CP%3EHow%20can%20I%20delete%20this%20folder%20or%20the%20contents%20of%20this%20folder%3F%20I%20seem%20to%20be%20going%20in%20circles.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-2541044%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EExchange%20Server%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EHybrid%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2675088%22%20slang%3D%22en-US%22%3ERe%3A%20Remove%20Auditing%20from%20exchange%20mailbox%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2675088%22%20slang%3D%22en-US%22%3EThanks%20for%20posting%20BrentStobbs%2C%20would%20be%20interested%20as%20well.%3CBR%20%2F%3E%3CBR%20%2F%3EAny%20updates%2C%20could%20you%20resolve%20the%20issue%20in%20the%20meanwhile%3F%3CBR%20%2F%3E%3CBR%20%2F%3EGreetings!%3C%2FLINGO-BODY%3E
Occasional Contributor

I am trying to move an account from Exchange On-Prem to Exchange Online. The migration failed to complete because there were too many items in a single folder.

 

I checked the ItemsInFolder for the affected user and found the "AUDITS" folder has over 3 million items in it. I want to remove the items from the mailbox, and then restart the Auditing when the mailbox is in Office 365.

 

I disabled auditing on the mailbox using the powershell command "get-mailbox <user> | set-mailbox -AuditEnabled $false". This does not remove the folder, and the Items in the folder continued to increase.

 

I set the time to keep audit items to 0 by "Get-Mailbox <user> | set-mailbox -AuditLogAgeLimit 0". After issuing this command I got a warning telling me that it will immediately delete all audit logs.

GREAT! That's what I want, but no, it doesn't delete the audit logs, and they continue to grow.

How can I delete this folder or the contents of this folder? I seem to be going in circles.

1 Reply
Thanks for posting BrentStobbs, would be interested as well.

Any updates, could you resolve the issue in the meanwhile?

Greetings!