This article has been archived. It is offered "as is" and will no longer be updated.
In an Exchange 2007 environment, you may want to know who has accessed the message tracking logs. To do this, you can enable LogPipeLineExecutionDetails registry entry. Then, when a user runs the Get-MessageTrackingLog command in Exchange Management Shell (EMS), an Event ID 800 is logged in the Powershell log. However, the user name is not included the event. Instead, the following Event is logged in the PowerShell log:
Event Type: InformationEvent Source: PowerShellEvent Category: (8)Event ID: 800Date: <Date>Time: <Time>User: N/AComputer: <server name>Description:The description for Event ID ( 800 ) in Source ( PowerShell ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: get-messagetrackinglog -server 152433m2, DetailSequence=1 DetailTotal=1 SequenceNumber=75 HostName=ConsoleHost HostVersion=188.8.131.52 HostId=467ed744-9a87-407f-972b-25eca13dec7d EngineVersion=184.108.40.206 RunspaceId=0086a970-acd4-4f80-9167-843f996fd6ec PipelineId=8 ScriptName= CommandLine=get-messagetrackinglog <parameter> <value>, ParameterBinding(Get-MessageTrackingLog): name="<parameter>"; value="<value>"
Therefore, you cannot obtain any information about the authenticated user who ran the command.
To resolve this problem, install Update Rollup 5 for Exchange 2007 Service Pack 1. For more information about Update Rollup 5 for Exchange Server 2007 Service Pack 1, see the following Exchange Help topic:
On the Edit menu, point to New, and then click DWORD Value.
In the details pane, input the new value 2 Client Monitoring, and then press Enter.
Right-click 2 Client Monitoring, and then click Modify.
In the Edit DWORD Value dialog box, under Base, click Decimal.
In the Value data box, type the value 1, and then click OK.
Close Registry Editor.
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.
User information is not logged in Event ID 800 in the PowerShell log even though the hotfix is installed on the server. In other words, the Event ID 800 user information is the same as before the hotfix is installed. Instead, a message that resembles the following Event ID 7020 message is logged in the Application log after you install the hotfix, and you create the 2 Client Monitoring registry entry.
Event Type: InformationEvent Source: MSExchangeTransportLogSearchEvent Category: Client Monitoring Event ID: 7020Date: <date>Time: <time>User: N/AComputer: <ComputerName>Description:Client <domain\user> issued the following transport log search request: <?xml version="1.0" encoding="utf-8"?><LogQuery xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><Beginning>0001-01-01T00:00:00Z</Beginning><End>9999-12-31T22:59:59.9999999Z</End><Filter xsi:type="And"><Conditions /></Filter></LogQuery>For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
To enable Exchange-related command logging, run the following command: