Troubleshooting

Cause:

The user credentials provided in the Organization Settings page do not have sufficient privilege.

Resolution:

The user credential provided should satisfy the below criteria.

Cause:

This error could be due to any of the following reasons.

1. Domain Controllers are down.
2. Servers not available.
3. Firewall has been enabled, and port 389 is closed.
4. The server is busy.

Resolution:

Exchange Reporter Plus uses port 389 for LDAP connection. If firewall is enabled, ensure that the port 389 is added to the exception list.

Cause:

Unable to establish a connection to remote powershell.

Resolution:

1. Make sure that the credentials provided in the organization settings page is correct and that they have sufficient privileges.
2. Make sure that the machine in which Exchange Reporter Plus in installed is connected to the network.
3. Make sure that the machine in which Exchange Reporter Plus is installed and the Exchange server are on the same domain. If they are on different domains, then make sure that there is trust between the domains.

General steps to check whether remote PowerShell can be connected from the product installed machine:

1. Enter your user credentials for the Exchange Server to which you wish to connect: $UserCredential = Get-Credential
2. Type in the following cmdlet to establish a session:
   $session=New-PSSession -ConfigurationName 'Microsoft.Exchange' -ConnectionUri 'http://<Server Name>/powershell' -Authentication kerberos -Credential $UserCredential
3. Open your session using the: Import-PSSession $session cmdlet.
4. End the session with: Remove-PSSession $session cmdlet. If you do not end the session, then the session time continues to run out.

Note: If you have followed the correct procedure, then look for resolution steps.

Cause:

Windows Remote Management Framework is not installed.

Resolution:

Download and install WinRM 2.0 using the link: https://www.microsoft.com/en-in/download/details.aspx?id=20430

First, check if the users have been blocked from auditing by following the steps given below:

1. Go to the Auditing tab in the top pane.
2. Click on the Audit Configuration option on the left side.
3. Navigate to Exchange Server → Mailbox Based Auditing.
4. Look for the Users with Bypass Auditing section at the bottom. See if the user with the error is included or not.

Cause:

1. Diagnostic Logging has not been configured due to the unavailability of PowerShell.
2. If configured, the desired audit event has not yet occurred.

Resolution:

1. To configure Diagnostic Logging, open Exchange Management Shell on any one of the Exchange Servers and execute the below command after replacing with the server name.

‘%SERVER_NAME%\MSExchangeIS\9000 Private\Logons’ | Set-EventLogLevel -Level ‘Expert’

 
2. After automatic configuration of Diagnostic Logging, the desired audit event would not have occurred. As a result there will be no data registered into the application logs. Please wait for any events to be recorded in the logs and for event collection to happen. In case of real-time events, data will be fetched immediately after the event has occurred.

Possible Cause:

Server (containing the "Arbitration mailbox") may be unreachable or non - operational

Server (containing the "Arbitration mailbox") may be unreachable or non - operational owing to compromised Domain Controller(s), unavailability of servers, closure of Port 389 or an enabled firewall.

Resolution:

Exchange Reporter Plus uses port 389 for LDAP connection. If firewall is enabled, ensure that the port 389 is added to the exception list.

If failure prevails follow the next probable cause.

Cause:

The current credentials do not have sufficient privilege.

Resolution:

The user credential provided should satisfy the below criteria.

	Single domain forest	Multiple domain forest
Exchange Management Shell available	The user credential should be added to the following groups. Exchange Organization Management Domain Admins	The user credential should be added to the following groups. Exchange Organization Management Enterprise Admins
Exchange Management Shell unavailable	The user credential should be added to the Domain Admins group. Domain Admins	The user credential should be added to the following groups. Exchange Organization Management Enterprise Admins

Cause:

The product would not be installed in the Exchange forest. Hence even after providing credentials with right privilege, Default Domain Controller policy will fail to configure automatically.

Resolution:

Configure Default Domain Controller Policy manually.

 

i) Log on to the domain controller using an administrative account.

ii) If Windows 2008, open Group Policy Management from Start -> Administrative tools.

iii) If Windows 2003, select Default Domain Controller Security Settings from Start -> Administrative tools.

iv) Navigate to ForestName -> Domains -> DomainName -> Group Policy Objects -> Default Domain Controller Policy and right click to Edit it.

v) Navigate to Computer Configuration -> Policies-> Windows Settings -> Security Settings -> Local Policies.

vi) Select Audit Policy.

vii) In the right pane, double click the following policy and enable "Success" and "Failure" settings.

• Audit directory service access
• Audit object access.

viii) Click Ok.

Cause:

i. The desired audit events have not occurred. Hence there is no data currently available.

ii. The desired audit events have occurred. But the event collection is yet to happen.

iii. The Event Log Policy settings is configured for a small log size and "Overwrite events as needed" is enabled.

Resolution:

i. Exchange Reporter Plus has swept through the logs but the desired events have not occurred at the time of sweep. Wait for the desired audit events to be recorded in the event logs.

ii. Exchange Reporter Plus has a default ‘Event Fetch Interval’ of 2 hours for collecting the data from the logs periodically. Manually initiate the event collection process by clicking on the ‘Run Now’ link to immediately collect the data. For real-time events, there is no need to initiate the event collection manually. The data will be collected once the events are recorded to the logs.

iii. Ensure that the event log size is large enough so that the event log data will not get lost.

Cause:

The desired audit events are not available for the selected time period and chosen filter values.

Resolution:

Select a different time period and filter value to see the data in the reports.

Search-AdminAuditLog -StartDate 09/17/2018 -EndDate 10/02/2018 -ResultSize 100

Search-MailboxAuditLog -ShowDetails -StartDate 1/1/2016 -EndDate 3/1/2016 -ResultSize 100

When above-given Cmdlets return no value in the Exchange Management Shell or Remote PowerShell sessions, it means data is not available for mailbox auditing in the server itself. Please wait for the event to occur so that the logs can be generated.