Search-AdminAuditLog The attempt to search the administrator audit log failed. Please try again later

When running the command Search-AdminAuditLog you receive the following error:

The attempt to search the administrator audit log failed. Please try again later.


 
This is because the query is not valid. For example the below would be an invalid query and would produce the error.
 
Search-AdminAuditLog -StartDate 05/16/2012 -EndDate 05/16/2012 -ObjectID "jyoung"

An example of a correct query syntax to query who's made changes to a mailbox called John Doe would be like below.

[PS] C:\Users\jyoung.CORP\Desktop>Search-AdminAuditLog -Cmdlets Set-Mailbox -objectids "corp.dom/Corporate Locations/Reston/John Doe" -StartDate 05/10/2012 -EndDate 05/12/2012 -IsSuccess $true

When searchng for the target mailbox John Doe you must use the complete CN like in my example corp.dom\corporate... you can't use just the username, alias etc.
Another option is to just do a complete dump and export to txt file and do a search against the txt file.

search-adminauditlog > c:\log.txt

James Chong
MCITP |EA |EMA; MCSE M+, S+
Security+, Project+, ITIL
msexchangetips.blogspot.com