ItemSubject field is empty when you run the Search-MailboxAuditLog cmdlet together with the ShowDetails parameter in an Exchange Server 2010 environment

Symptoms

Consider the following scenario:

You enable mailbox audit logging for a mailbox in a Microsoft Exchange Server 2010 environment.
You perform some operations in the mailbox. For example, you soft delete an email message.
You run the Search-MailboxAuditLog cmdlet together with the ShowDetails parameter to retrieve the details of mailbox audit logging entries.

In this scenario, the cmdlet returns an empty value in the ItemSubject field for most operations.

This issue occurs because the cmdlet retrieves properties from a MailboxAuditLogRecord class object that does not contain the ItemSubject field.

To resolve this issue, install the following update rollup:

2706690 Description of Update Rollup 4 for Exchange Server 2010 Service Pack 2

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

For more information about how to enable or disable mailbox audit logging for a mailbox, go to the following Microsoft website:

For more information about mailbox audit logging, go to the following Microsoft website:

For more information about the Search-MailboxAuditLog cmdlet, go to the following Microsoft website:

For more information about how to search the mailbox audit logging entries for a mailbox, go to the following Microsoft website:

For more information about the MailboxAuditLogRecord class, go to the following Microsoft website:

Keywords: kbqfe, kbfix, kbexpertiseinter, kbsurveynew, kb

Article Info