Search-AdminAuditLog or Search-MailboxAuditLog with parameter returns empty results in Exchange Server

Applies to: Exchange Server 2013 EnterpriseExchange Server 2013 Standard EditionExchange Server 2016 Standard Edition More

Symptoms


When you run the Search-AdminAuditLog or Search-MailboxAuditLog cmdlets in Exchange Management Shell together with a Cmdlets or Parameters parameter to filter the results, an empty result set is returned. Even if you run the Search-AdminAuditLog cmdlet without parameters, the full results may not be returned as expected.
This issue occurs in Exchange Server 2013 and Exchange Server 2016.

Workaround


To work around this issue, set language and regional settings for the system and network service accounts to English (United States).

  1. Set English (United States) as the primary language.
    1. In Control Panel, open Language.
    2. Add the language of English (United States).
    3. Click Options for the added language.
    4. Click Download and install language pack if it appears.
    5. Click Make this the primary language.
  2. Copy the regional settings.
    1. In Control Panel, open Region.
    2. Click the Administrative tab.
    3. On the Administrative tab, click Copy settings.
    4. In the Welcome screen and new user accounts settings dialog box, click to select Welcome screen and system accounts, and then click OK.
      Note The system accounts include the network service account.
  3. Restart Exchange Server.

To verify that the language and reginal setting is correct, open a Windows PowerShell window and run the Get-UICulture command. The command should return en-US on the Name column.

Note The MSExchangeDelivery service may not start with Exchange Server. If the service doesn't start, follow these steps:

  1. Change the logon account of the service to Local System.
  2. Revert the logon account to Network Service.
  3. Start the service.

Status


Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.