Remove Audit Items in Exchange Mailbox

Brent Stobbs 21 Reputation points
2021-07-13T03:17:27.093+00:00

I am trying to move an account from Exchange On-Prem to Exchange Online. The migration failed to complete because there were too many items in a single folder.

I checked the ItemsInFolder for the affected user and found the "AUDITS" folder has over 3 million items in it. I want to remove the items from the mailbox, and then restart the Auditing when the mailbox is in Office 365.

I disabled auditing on the mailbox using the powershell command "get-mailbox <user> | set-mailbox -AuditEnabled $false". This does not remove the folder, and the Items in the folder continued to increase.

I set the time to keep audit items to 0 by "Get-Mailbox <user> | set-mailbox -AuditLogAgeLimit 0". After issuing this command I got a warning telling me that it will immediately delete all audit logs.

GREAT! That's what I want, but no, it doesn't delete the audit logs, and they continue to grow.

How can I delete this folder or the contents of this folder? I seem to be going in circles.

Exchange Server Management
Exchange Server Management
Exchange Server: A family of Microsoft client/server messaging and collaboration software.Management: The act or process of organizing, handling, directing or controlling something.
7,322 questions
0 comments No comments
{count} votes

Accepted answer
  1. Yuki Sun-MSFT 40,781 Reputation points
    2021-07-14T02:48:40.963+00:00

    Hi @Brent Stobbs ,

    After setting -AuditLogAgeLimit to "0", the change indeed takes effect immediately, but the audit log entries are removed the next time the Managed Folder Assistant processes the mailbox. See the description for the -AuditLogAgeLimit parameter in this document:
    114413-1.png

    So we can run the command below to process the mailbox immediately:

    Start-ManagedFolderAssistant -Identity <user>  
    

    Then wait for a few minutes and check if it works.

    Below is the test procedure in my lab environment, as we can see from the image, after manually running the Start-ManagedFolderAssistant cmdlet, the items in the Audit folder are removed:
    114375-2.png


    If an Answer is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.


0 additional answers

Sort by: Most helpful