Hello, I have installed Exchange 2010 SP1 with the latest updates. When I am running the command Search-AdminAuditLog -StartDate 4/4/2011 -EndDate 4/5/2011 The system returned The attempt to search the administrator audit log failed. Please try again later. at Microsoft.Exchange.Management.SystemConfigurationTasks.AdminAuditLogSearchWorker.Search() at Microsoft.Exchange.Management.SystemConfigurationTasks.SearchAdminAuditLog.WriteResult[T](IEnumerable`1 dataObjects)Admin audit log search criteria: OrganizationId= StartDateUtc=4/3/2011 10:09:24 PM EndDateUtc=4/4/2011 10:09:24 PM Cmdlets Parameters ObjectIds UserIds Succeeded=0 [PS] C:\Windows\system32>Get-AdminAuditLogConfig RunspaceId : d02c9f82-6ec6-4c78-a48e-4058bdeffb48 AdminAuditLogEnabled : True TestCmdletLoggingEnabled : True AdminAuditLogCmdlets : {*} AdminAuditLogParameters : {*} AdminAuditLogExcludedCmdlets : {} AdminAuditLogAgeLimit : 90.00:00:00 AdminDisplayName : ExchangeVersion : 0.10 (14.0.100.0) Name : Admin Audit Log Settings DistinguishedName : CN=Admin Audit Log Settings,CN=Global Settings,CN=FirstOrganization,CN=Microsoft Exchang e,CN=Services,CN=Configuration,DC=DOMAINNAME,DC=local Identity : Admin Audit Log Settings Guid : d31cfd73-2ae4-4c83-b7d0-85ec0e0e5612 ObjectCategory : Domainname.local/Configuration/Schema/ms-Exch-Admin-Audit-Log-Config ObjectClass : {top, msExchAdminAuditLogConfig} WhenChanged : 4/5/2011 1:33:09 AM WhenCreated : 12/3/2009 2:43:51 PM WhenChangedUTC : 4/4/2011 10:33:09 PM WhenCreatedUTC : 12/3/2009 12:43:51 PM OrganizationId : OriginatingServer : DC01.domainname.local IsValid : True Seems Exchange 2010 SP1 Admin Audit Log Search not working with parameters. Any help?

“Search-AdminAuditLog” cmdlet will fail with this error when content indexing is not running; MSExchangeSearch (Indexer) service is stopped Please check if exchange search is working properly Diagnose Exchange Search Issues James Luo TechNet Subscriber Support in forum If you have any feedback on our support, please contact tngfb@microsoft.com Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

MSExchangeSearch (Indexer) service is started with Automatic startup type and run as Local System.