Hi, I have issue running New-MailboxAuditLogSearch command, it is failing because one the powered off mailbox servers. Can I exclude this mailbox server from the search or is there any way to search only specific mailbox servers? The same error when I run "Export Mailbox Audit Logs" in ECP Cannot open mailbox /o=ORG/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Configuration/cn=Servers/cn=MBX-SERVER-NAME/cn=Microsoft System Attendant I need to run this to audit one mailbox access, the IP address from where it is being accessed. http://tariqjaber.com/blog

Hi The New-MailboxAuditLogSearch cmdlet performs an asynchronous search of mailbox audit logs for the specified mailboxes and sends the search results by e-mail to the specified recipients. Are special mailboxes or specified recipient box on your server which is power off? Maybe you need to describe mailbox server which is power off. Terence Yu TechNet Community Support