Article ID: 2507066 - Last Review: July 28, 2011 - Revision: 4.0

Administrator audit logging is disabled unexpectedly during an Exchange Server 2010 SP1 installation

View products that this article applies to.
System TipThis article applies to a different operating system than the one you are using. Article content that may not be relevant to you is disabled.
Expand all | Collapse all

SYMPTOMS

Consider the following scenario:
  • You enable administrator audit logging on a Microsoft Exchange Server 2010 server.
  • You successfully update the Active Directory schema on this server by using Exchange Server 2010 Service Pack 1 (SP1) build.
In this scenario, administrator audit logging on this server is disabled unexpectedly.

Note Administrator audit logging was enabled before you installed Exchange Server 2010 SP1 on this server.
Back to the top

CAUSE

This issue occurs because the ExchangeVersion attribute for administrator audit logging in the Activity Directory directory service is changed after the Activity Directory schema is updated. 
Back to the top

RESOLUTION

To resolve this issue, install the following update rollup:
2579150  (http://support.microsoft.com/kb/2579150/ ) Description of Update Rollup 4 for Exchange Server 2010 Service Pack 1
Back to the top

WORKAROUND

To work around this issue, save the following script as a .ps1 file, and then execute the .ps1 file in the Exchange Management Shell on the server:
$agent = Get-CmdletExtensionAgent "Admin Audit Log Agent"; 
if ($agent -eq $null) 
{ 
Write-Host "Please run this script on an Exchange Server 2010 SP1 update rollup 4 box!" -ForegroundColor Green; 
} 
else 
{ 
Write-Host "Current object version of Admin Audit Log Agent is "$agent.ExchangeVersion.ToString() -ForegroundColor Green; 
if ($agent.ExchangeVersion.Major -gt 1) 
{ 
Write-Host "Changing the object version into 1.10 (14.0.100.0)" -ForegroundColor Green; 
$entry = [adsi]("LDAP://" + $agent.DistinguishedName); 
$entry.msExchVersion = "1170120890224640"; 
$entry.CommitChanges(); 
 
Get-CmdletExtensionAgent $agent.Name | fl name, *version, issystem; 
} 
}
Back to the top

STATUS

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.
Back to the top

MORE INFORMATION

For more information about administrator audit logging, visit the following Microsoft website:
General information about administrator audit logging (http://technet.microsoft.com/en-us/library/dd335052.aspx)
For more information about how to enable administrator audit logging, visit the following Microsoft website:
How to enable administrator audit logging (http://technet.microsoft.com/en-us/library/dd298041.aspx)
Back to the top
APPLIES TO
  • Microsoft Exchange Server 2010 Service Pack 1, when used with:
    • Microsoft Exchange Server 2010 Enterprise
    • Microsoft Exchange Server 2010 Standard
Back to the top
Keywords: 
kbqfe kbfix kbsurveynew kbexpertiseinter KB2507066
Back to the top