I have Admin Audit log enabled in Exchange 2010 SP2 setup and has many changes in a specific date. But when I run audit report from ECP then the resulting xml file shows only below information instead of the ones which admins do in their day to day administration job:
Here is the only output line which is repeated 1000 of times:
<Event Caller="NT AUTHORITY\SYSTEM (powershell)" Cmdlet="Set-MailboxDatabase" ObjectModified="DB11" RunDate="2012-12-02T03:24:48+04:00" Succeeded="true" Error="None" OriginatingServer="PEXMBOX20104 (14.02.0297.000)"><CmdletParameters><Parameter Name="Identity" Value="DB11" /><Parameter Name="IsExcludedFromProvisioning" Value="True" /></CmdletParameters></Event>
What can be the reason?
