Unable to view Admin Audit Logs in EAC or EMS

Copper Contributor

Hi all,

 

I upgraded all our Exchange Servers from 2010 CU 22 to 2016 CU 10 in November 2018 with only one Exchange 2010 server remaining. Since the upgrade I have been unable to view any admin audit logs in EAC or EMS I can however view them in Event Viewer on the Exchange Servers. 

 

When I run the Get-AdminAuditConfig it displays the Exchange Version as 2010, when i check the Admin Audit Log Settings Properties in ADSI it displays msExchVersion: 44220983382016 (2010). 

The System Mailbox that holds the Admin Audit Logs displays msExchVersion: 88218628259840 (2013)

 

When I run the following command (Get-Mailbox -Arbitration | Get-MailboxFolderStatistics | where {$_.identity -like “*AdminAuditLogs”} | FL *), I can see the item count increasing which tells me that it is working. Under the oldest/newest item properties that are displayed from this command they are blank entries (I dont believe this is normal behavior).

 

I have been searching the internet for quite some time on this and I have found nothing remotely close to the issue I am having. My questions to the community are:

1. Is the 2010 Exchange version setting in the Admin Audit Log Config my potential problem?

2. Did the version not update to 2016 as I still run one Exchange 2010 server?

3. Can the version be changed to reflect Exchange 2016?

4. Why does my Audit Log mailbox display a 2013 version? (We have never had 2013 installed)

5. Has anyone experienced a similar issue when migrating from 2010 to 2016?

 

Thanks in advance.

 

P.S Yes the admin audit log is enabled

 

0 Replies