Google
Search WWW Search msexchangetips.blogspot.com

Friday, May 18, 2012

Search-AdminAuditLog The attempt to search the administrator audit log failed. Please try again later

When running the command Search-AdminAuditLog you receive the following error:

The attempt to search the administrator audit log failed. Please try again later.


 
This is because the query is not valid. For example the below would be an invalid query and would produce the error.
 
Search-AdminAuditLog -StartDate 05/16/2012 -EndDate 05/16/2012 -ObjectID "jyoung"

An example of a correct query syntax to query who's made changes to a mailbox called John Doe would be like below.

[PS] C:\Users\jyoung.CORP\Desktop>Search-AdminAuditLog -Cmdlets Set-Mailbox -objectids "corp.dom/Corporate Locations/Reston/John Doe" -StartDate 05/10/2012 -EndDate 05/12/2012 -IsSuccess $true

When searchng for the target mailbox John Doe you must use the complete CN like in my example corp.dom\corporate... you can't use just the username, alias etc.
Another option is to just do a complete dump and export to txt file and do a search against the txt file.

search-adminauditlog > c:\log.txt

James Chong
MCITP |EA |EMA; MCSE M+, S+
Security+, Project+, ITIL
msexchangetips.blogspot.com 

3 Comments:

Anonymous Denny said...

Hi James,
This is Denny from zohno.com. I am the creator of this free automated
employee provisioning/termination app. Will you please write a review for
my app? Since my app is free, I don't really have other ways to spread the
word. This would means a lot.

Here is the link to the app.
http://gallery.technet.microsoft.com/Z-Hire-Employee-Provisionin-e4854d6b

1:11 PM  
Anonymous Denny said...

here is our site Zohno

1:12 PM  
Blogger smuggler don said...

it will be very effective and highly confidential.this will be more effective and informative.it will be very useful to us....
Viagra
Viagra
Viagra
Viagra
Viagra
Viagra
Viagra

5:00 AM  

Post a Comment

<< Home

xml:lang="en" lang="en"> MS Exchange Tips: Search-AdminAuditLog The attempt to search the administrator audit log failed. Please try again later