ItemSubject field is empty when you run the Search-MailboxAuditLog cmdlet together with the ShowDetails parameter in an Exchange Server 2010 environment

Applies to: Microsoft Exchange Server 2010 Service Pack 2Exchange Server 2010 EnterpriseExchange Server 2010 Standard

Symptoms


Consider the following scenario:
  • You enable mailbox audit logging for a mailbox in a Microsoft Exchange Server 2010 environment.
  • You perform some operations in the mailbox. For example, you soft delete an email message.
  • You run the Search-MailboxAuditLog cmdlet together with the ShowDetails parameter to retrieve the details of mailbox audit logging entries.
In this scenario, the cmdlet returns an empty value in the ItemSubject field for most operations.

Cause


This issue occurs because the cmdlet retrieves properties from a MailboxAuditLogRecord class object that does not contain the ItemSubject field.

Resolution


To resolve this issue, install the following update rollup:
2706690 Description of Update Rollup 4 for Exchange Server 2010 Service Pack 2

Status


Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

More Information


For more information about how to enable or disable mailbox audit logging for a mailbox, go to the following Microsoft website:For more information about mailbox audit logging, go to the following Microsoft website:For more information about the Search-MailboxAuditLog cmdlet, go to the following Microsoft website:For more information about how to search the mailbox audit logging entries for a mailbox, go to the following Microsoft website:For more information about the MailboxAuditLogRecord class, go to the following Microsoft website: