Identify/Track Application User password change in CUCM

[syruspayne]

Is there a way to identify or track user password changes in CUCM, specifically application user password?

Checking the Audit logs, it shows a General Update entry confirming a change was made under the application user setting but doesn't say what exactly was changed. is there a way to get more granular details?

Example:

10:39:53.665 |LogMessage   UserID : XXXX  ClientAddress : 10.X.X.X Severity : 5  EventType : GeneralConfigurationUpdate  ResourceAccessed: CUCMAdmin  EventStatus : Success  CompulsoryEvent : No  AuditCategory : AdministrativeEvent  ComponentID : Cisco CUCM Administration  CorrelationID :   AuditDetails :  record in table applicationuserdevicemap with key field name = app_user updated  App ID: Cisco Tomcat Cluster ID:  Node ID: cucmpub

Thanks!

[R0g22]

The information is usually maintained under the "Cisco Audit Logs" and "Tomcat Security Logs". You might want to review both along with the time when the suspected password changed if that is possible. Those logs should list the specific userid that made the change if that is what you are after.

[syruspayne]

We have reviewed the Audit Logs and only found a General Configuration Event type, it does mention a change was made to the application user however it doesn't specify what kind of change. Want to know if there is a way to get granular and view the exact setting that was modified.

[Mohammed al Baqari]

Yes you can view it if you have it enabled. This link is very useful for it

https://www.netcraftsmen.com/audit-logs-on-cisco-unified-communications-manager-cucm/

[Aman Soi]

Hi,

I suppose you should be able to see the command utils reset_application_ui_administrator_password in Audit logs.

can you cross-check in logs.

regds,

aman