Troubleshoot auditing not works

By | 22 August, 2014

Sometimes, when we turn on the auditing, we see that the audit not work or not return any result. Below are the step for troubleshooting :

1) Do the mailbox already enable the audit?
issue below command : Get-Mailbox -Identity ‘‘ | Format-List Audit*
If yes, continue step 2
If no, perform again the Set-Mailbox : Set-Mailbox -Identity ‘‘ -AuditEnabled $True

2) Do the audit folder created and have item?
issue command : Get-MailboxFolderStatistics -Identity “” | ? {$_.Name -eq “Audits” -and $_.FolderType -eq “Audits”} |Format-Table Identity, ItemsInFolder, FolderSize -AutoSize
If yes, continue step 3
If no, maybe there are no action taken yet for specific audit? You can check further by simulating in another test mailbox to check either no issue with your step.

3) Do the indexing are working fine for specific database?
issue command : Get-MailboxDatabaseCopyStatus * | where {$_.ContentIndexState -eq “Failed”}
If yes (have failed), check event viewer and consider to rebuild back the CI catalog folder. below are the step :
1. Stop the Windows Services: “Microsoft Exchange Search service”, “Microsoft Exchange Host Controller”
2. Delete the Existing CI catalog folder or move it to a new location.
3. Start the Services: “Microsoft Exchange Search service”, “Microsoft Exchange Host Controller” again.
If no, review the Event viewer and check any related event when you trigger the search function.Google may help you then 🙂

Useful Reference : http://windowsitpro.com/exchange-server-2010/mailbox-auditing-exchange-server-2010

Leave a Reply

Your email address will not be published. Required fields are marked *


The reCAPTCHA verification period has expired. Please reload the page.