An error occurred while trying to access the audit log

Question

Hi All I am getting below error when executing this syntax.

Write-ErrorMessage : |Microsoft.Exchange.Data.ApplicationLogic.AuditLogException|An error occurred while trying to access the audit log. For more details, see the inner exception.

Search-MailboxAuditLog user1@contoso.com -LogonTypes Owner,Delegate,Admin -ShowDetails | Export-CSV C:\temp\output.csv –NoTypeInformation -Encoding utf8

Search-MailboxAuditLog user1@contoso.com -operations HardDelete,SoftDelete,MoveToDeletedItems -LogonTypes Owner,Delegate,Admin -ShowDetails | Export-CSV C:\temp\output.csv –NoTypeInformation -Encoding UTF8

Answer 1

Hi,Roger Roger

Based on your question, I understand that you are experiencing an error when running the command.

You could provide more information about the error so that I can take the next step in troubleshooting.

After my tests, the command you provided has no syntax errors and is able to export the .csv file successfully. My test results are shown below.

Regarding your error message, you could try the following steps:

1. The Search-MailboxAuditLog cmdlet may be deprecated. You will need to switch to a Search-UnifiedAuditLog cmdlet. For more information, please check Important Announcement: Deprecation of AdminAuditLog and MailboxAuditLog Cmdlets - Microsoft Community Hub
2. Ensure that the account performing the action has the required permissions to access the audit log. For permissions needed, please see Find the permissions required to run any Exchange cmdlet | Microsoft Learn. You also could test with another admin account and check if the issue persists.
3. Check that the parameters are spelled correctly. Ensure that the e-mail address or the path where the file is stored is entered correctly.
4. Did you get the error with other commands, such as Get-MessageTrackingLog ?

If my answer is helpful to you, please mark it as the answer so that other users can refer to it. Thank you for your support and understanding.