Remove Audit Items in Exchange Mailbox

Question

I am trying to move an account from Exchange On-Prem to Exchange Online. The migration failed to complete because there were too many items in a single folder.

I checked the ItemsInFolder for the affected user and found the "AUDITS" folder has over 3 million items in it. I want to remove the items from the mailbox, and then restart the Auditing when the mailbox is in Office 365.

I disabled auditing on the mailbox using the powershell command "get-mailbox <user> | set-mailbox -AuditEnabled $false". This does not remove the folder, and the Items in the folder continued to increase.

I set the time to keep audit items to 0 by "Get-Mailbox <user> | set-mailbox -AuditLogAgeLimit 0". After issuing this command I got a warning telling me that it will immediately delete all audit logs.

GREAT! That's what I want, but no, it doesn't delete the audit logs, and they continue to grow.

How can I delete this folder or the contents of this folder? I seem to be going in circles.

Answer 1

Hi @Brent Stobbs ,

After setting -AuditLogAgeLimit to "0", the change indeed takes effect immediately, but the audit log entries are removed the next time the Managed Folder Assistant processes the mailbox. See the description for the -AuditLogAgeLimit parameter in this document:

So we can run the command below to process the mailbox immediately:

Start-ManagedFolderAssistant -Identity <user>  

Then wait for a few minutes and check if it works.

Below is the test procedure in my lab environment, as we can see from the image, after manually running the Start-ManagedFolderAssistant cmdlet, the items in the Audit folder are removed:

---

If an Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.