Jul 23 2019 04:55 PM
Hi all,
I upgraded all our Exchange Servers from 2010 CU 22 to 2016 CU 10 in November 2018 with only one Exchange 2010 server remaining. Since the upgrade I have been unable to view any admin audit logs in EAC or EMS I can however view them in Event Viewer on the Exchange Servers.
When I run the Get-AdminAuditConfig it displays the Exchange Version as 2010, when i check the Admin Audit Log Settings Properties in ADSI it displays msExchVersion: 44220983382016 (2010).
The System Mailbox that holds the Admin Audit Logs displays msExchVersion: 88218628259840 (2013)
When I run the following command (Get-Mailbox -Arbitration | Get-MailboxFolderStatistics | where {$_.identity -like “*AdminAuditLogs”} | FL *), I can see the item count increasing which tells me that it is working. Under the oldest/newest item properties that are displayed from this command they are blank entries (I dont believe this is normal behavior).
I have been searching the internet for quite some time on this and I have found nothing remotely close to the issue I am having. My questions to the community are:
1. Is the 2010 Exchange version setting in the Admin Audit Log Config my potential problem?
2. Did the version not update to 2016 as I still run one Exchange 2010 server?
3. Can the version be changed to reflect Exchange 2016?
4. Why does my Audit Log mailbox display a 2013 version? (We have never had 2013 installed)
5. Has anyone experienced a similar issue when migrating from 2010 to 2016?
Thanks in advance.
P.S Yes the admin audit log is enabled