I don’t trust automatic audit enablement for new mailboxes… So I prefer to follow the classic steps of running Set-Mailbox -AuditEnabled $True for now… call me old-fashioned!

…because the Microsoft article https://learn.microsoft.com/en-us/purview/audit-mailboxes no longer states any difference for E3/E5 licensed mailboxes in this regard as they used to do a few months back.

Ah, that was a bug I fixed a while ago… I wonder if caching is causing a problem?

Hi Tony – I was referring to the leading dollar sign (“$”) rather than a trailing “s”.

…UserPrincipalName).$DefaultAuditSet

vs.

…UserPrincipalName).DefaultAuditSet

There is no ‘s’ on the end of DefaultAuditSet in what I see on screen… Maybe a copy and paste issue?

I don’t think the “$” should be on the “DefaultAuditSet” at the end of line 8:

[array]$DefaultAuditSet = (Get-Mailbox -Identity $User.UserPrincipalName).$DefaultAuditSet

It should probably be:

[array]$DefaultAuditSet = (Get-Mailbox -Identity $User.UserPrincipalName).DefaultAuditSet