topic Admin Audit log in Network Access Control https://community.cisco.com/t5/network-access-control/admin-audit-log/m-p/3553781#M536161 <HTML><HEAD></HEAD><BODY><P>We have had many endpoints that look like their identity group has been changed by someone or some script. Is there a report or log to look at that will show the user id of the person that made a change to a endpoint that is located in ISE.</P><P></P><P>Thanks,</P><P>Sam</P></BODY></HTML> Thu, 09 Feb 2017 23:03:50 GMT sholley 2017-02-09T23:03:50Z Admin Audit log https://community.cisco.com/t5/network-access-control/admin-audit-log/m-p/3553781#M536161 <HTML><HEAD></HEAD><BODY><P>We have had many endpoints that look like their identity group has been changed by someone or some script. Is there a report or log to look at that will show the user id of the person that made a change to a endpoint that is located in ISE.</P><P></P><P>Thanks,</P><P>Sam</P></BODY></HTML> Thu, 09 Feb 2017 23:03:50 GMT https://community.cisco.com/t5/network-access-control/admin-audit-log/m-p/3553781#M536161 sholley 2017-02-09T23:03:50Z Re: Admin Audit log https://community.cisco.com/t5/network-access-control/admin-audit-log/m-p/3553782#M536162 <HTML><HEAD></HEAD><BODY><P>Please run the change configuration audit report.</P><P><IMG alt="Screen Shot 2017-02-13 at 9.42.39 AM.png" class="image-1 jive-image" src="/legacyfs/online/fusion/104604_Screen Shot 2017-02-13 at 9.42.39 AM.png" style="height: 143px; width: 620px;" /></P></BODY></HTML> Mon, 13 Feb 2017 17:43:30 GMT https://community.cisco.com/t5/network-access-control/admin-audit-log/m-p/3553782#M536162 hslai 2017-02-13T17:43:30Z