Symptoms
Consider the following scenario:
-
You enable mailbox audit logging for a mailbox in a Microsoft Exchange Server 2010 environment.
-
You perform some operations in the mailbox. For example, you soft delete an email message.
-
You run the Search-MailboxAuditLog cmdlet together with the ShowDetails parameter to retrieve the details of mailbox audit logging entries.
In this scenario, the cmdlet returns an empty value in the ItemSubject field for most operations.
Cause
This issue occurs because the cmdlet retrieves properties from a MailboxAuditLogRecord class object that does not contain the ItemSubject field.
Resolution
To resolve this issue, install the following update rollup:
2706690 Description of Update Rollup 4 for Exchange Server 2010 Service Pack 2
Status
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.
More Information
For more information about how to enable or disable mailbox audit logging for a mailbox, go to the following Microsoft website:
How to enable or disable mailbox audit logging for a mailboxFor more information about mailbox audit logging, go to the following Microsoft website:
General information about mailbox audit loggingFor more information about the Search-MailboxAuditLog cmdlet, go to the following Microsoft website:
General information about the Search-MailboxAuditLog cmdletFor more information about how to search the mailbox audit logging entries for a mailbox, go to the following Microsoft website:
How to search the mailbox audit logging entries for a mailboxFor more information about the MailboxAuditLogRecord class, go to the following Microsoft website:
