Search-MailboxAuditLog -ShowDetails not showing all messages in Exchange Server 2016

Applies to: Exchange Server 2016 Enterprise EditionExchange Server 2016 Standard Edition

Symptoms


In a Microsoft Exchange Server 2016 environment, consider the following scenario:

  • You have a mailbox that has mailbox audit logging enabled.
  • You do a grouped operation (for example, that you delete multiple messages at one time would be audited).
  • You run the Search-MailboxAuditLog –ShowDetails cmdlet on the mailbox.

In this situation, you may not see all the messages that are included within the grouped operation in mailbox audit logs.

Cause


This issue occurs because the indexing of audit entry isn't correctly handled.

Resolution


For Exchange Server 2016, install Cumulative Update 9 or a later cumulative update for Exchange Server 2016.

Status


Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

References


Learn about the terminology that Microsoft uses to describe software updates.