Hello!

I can't enable mailbox audit logs. I use cmdlet Set-Mailbox -Identity "mailbox" -AuditEnabled $true and Get-Mailbox shows that audit is enabled. But when i check Get-Mailbox| Get-MailboxFoldersStatistics there is no "Audit" subfolder, and all audit searches also return no results. 

I am working now with several Exchange installations (five actually, and one is brand-new test lab) and checked the same in each organization. Result was the same!

I am stronly sure i miss something important, could you point it to me?

Hello

tip: try restart Microsoft Exchange Servicehost ser

I tried to wait the whole day without any effect. Checked bypass mailbox audit option. Also i rebooted server. Nothing changed.

Hi,

Please use the following command to check the Mailbox Audit Logging action setting.

Get-Mailbox Identity username | fl name,*audit*

Are there any administrator, delegate, and owner actions in the audit logging configuration for that mailbox? Please post them to check this issue.

If the settings above are configured correctly, only the administrator, delegate, and owner actions specified in the audit logging configuration for the mailbox are logged. And the Audits folder will show up after the administrator, delegate, and owner take the actions specified in the audit logging configuration.

By default, these actions in the audit logging configuration should be like this:

• AuditAdmin        : {Update, Move, MoveToDeletedItems, SoftDelete, HardDelete, FolderBind, SendAs, SendOnBehalf, Create}
• AuditDelegate   : {Update, SoftDelete, HardDelete, SendAs, Create}
• AuditOwner        : {}

By the way, which command do you use to search the audit log?

Mailbox audit logging procedures

https://technet.microsoft.com/en-us/library/ff461939%28v=exchg.150%29.aspx?f=255&MSPPError=-2147217396

Best Regards.

Hello. Thanks I forgot add AuditOwner records!