Hi!

We have two exchange servers in our company, ex2010 and ex2013. I set the audit logging to true for some mailbox, but if i run a report at the ex2013 to a specific a mailbox no data at the log. But! if i run a report at the ex2010 ecp website i get information from the same mailbox (folderbind etc..). I try run a report via shell at the ex2013, no data, same as the gui. The specific mailboxes migrated from ex2010 to ex2013.

• Edited by ToniSlow Tuesday, March 24, 2015 11:49 AM

Hi ToniSlow,

Thank you for your question.

We could run the following command to make sure the mailbox has been moved to Exchange 2013:

Get-Mailbox <username> | FL

Then we could check the item of database if this database is on Exchange 2013.

By my understanding, when we move mailbox to Exchange 2013, the mailbox audit logs for that mailbox are also moved because they're located in the mailbox.

If there are any questions regarding this issue, please be free to let me know. 

Best Regard,

Jim

Hi Jim!

I check the user with the command, and the mailbox is in the ex2013 database. I don't know why i can see the auditlog only the ex2010 ecp website or ex2010 management shell. At the ex2013 no audilog via gui or via management shell.

Hi Tonishow,

We could check which DCs were connected by Exchange 2010 and Exchange 2013. we make sure the sync among DCs have completed. Then we could check if issue persist.

If there are any questions regarding this issue, please be free to let me know. 

Best Regard,

Jim

Could you try to run this command from any exchange 2k10 or 2k13 server and see what happens, Just change the user , start and end date parameter accordingly.

Search-MailboxAuditLog -Identity "User" -logontype Admin,Delegate -StartDate "date" -EndDate "date" -ShowDetails -ResultSize 100 | select operation,FolderPathName