Notice: This website is an unofficial Microsoft Knowledge Base (hereinafter KB) archive and is intended to provide a reliable access to deleted content from Microsoft KB. All KB articles are owned by Microsoft Corporation. Read full disclaimer for more details.

Administrator audit logging is disabled unexpectedly during an Exchange Server 2010 SP1 installation


Symptoms

Consider the following scenario:
  • You enable administrator audit logging on a Microsoft Exchange Server 2010 server.
  • You successfully update the Active Directory schema on this server by using Exchange Server 2010 Service Pack 1 (SP1) build.
In this scenario, administrator audit logging on this server is disabled unexpectedly.

Note Administrator audit logging was enabled before you installed Exchange Server 2010 SP1 on this server.

↑ Back to the top


Cause

This issue occurs because the ExchangeVersion attribute for administrator audit logging in the Activity Directory directory service is changed after the Activity Directory schema is updated. 

↑ Back to the top


Resolution

To resolve this issue, install the following update rollup:
2579150 Description of Update Rollup 4 for Exchange Server 2010 Service Pack 1

↑ Back to the top


Workaround

To work around this issue, save the following script as a .ps1 file, and then execute the .ps1 file in the Exchange Management Shell on the server:
$agent = Get-CmdletExtensionAgent "Admin Audit Log Agent"; 
if ($agent -eq $null)
{
Write-Host "Please run this script on an Exchange Server 2010 SP1 update rollup 4 box!" -ForegroundColor Green;
}
else
{
Write-Host "Current object version of Admin Audit Log Agent is "$agent.ExchangeVersion.ToString() -ForegroundColor Green;
if ($agent.ExchangeVersion.Major -gt 1)
{
Write-Host "Changing the object version into 1.10 (14.0.100.0)" -ForegroundColor Green;
$entry = [adsi]("LDAP://" + $agent.DistinguishedName);
$entry.msExchVersion = "1170120890224640";
$entry.CommitChanges();

Get-CmdletExtensionAgent $agent.Name | fl name, *version, issystem;
}
}

↑ Back to the top


Status

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

↑ Back to the top


More Information

For more information about administrator audit logging, visit the following Microsoft website:For more information about how to enable administrator audit logging, visit the following Microsoft website:

↑ Back to the top


Keywords: kbqfe, kbfix, kbsurveynew, kbexpertiseinter, kb

↑ Back to the top

Article Info
Article ID : 2507066
Revision : 2
Created on : 9/25/2018
Published on : 9/25/2018
Exists online : False
Views : 297