Symptoms
Consider the following scenario in Microsoft Exchange Server 2019 or Exchange Server 2016:
-
You enable mailbox audit logging.
-
You create and then delete some number of items in the mailbox that's being audited.
-
You run Search-MailboxAuditLog -ResultSize where ResultSize is more than the number of events.
As a result, the ResultSize will only be honored if MaxHitsForFullTextIndexSearches has not been modified. If it has been modified, you can increase Outlook search results, and then the ResultSize will be capped at that same number. It's expected that the ResultSize should be honored regardless of the MaxHitsForFullTextIndexSearches setting, or the Outlook search results setting and the Search-MailboxAuditLog -ResultSize should use separate settings.
Resolution
To fix this issue, install one of the following updates:
For Exchange Server 2019, install the Cumulative Update 9 for Exchange Server 2019 or a later cumulative update for Exchange Server 2019.
For Exchange Server 2016, install the Cumulative Update 20 for Exchange Server 2016 or a later cumulative update for Exchange Server 2016.
References
Learn about the terminology that Microsoft uses to describe software updates.
