09-10-2018 10:51 AM - edited 03-17-2019 01:27 PM
Is there a way to identify or track user password changes in CUCM, specifically application user password?
Checking the Audit logs, it shows a General Update entry confirming a change was made under the application user setting but doesn't say what exactly was changed. is there a way to get more granular details?
Example:
10:39:53.665 |LogMessage UserID : XXXX ClientAddress : 10.X.X.X Severity : 5 EventType : GeneralConfigurationUpdate ResourceAccessed: CUCMAdmin EventStatus : Success CompulsoryEvent : No AuditCategory : AdministrativeEvent ComponentID : Cisco CUCM Administration CorrelationID : AuditDetails : record in table applicationuserdevicemap with key field name = app_user updated App ID: Cisco Tomcat Cluster ID: Node ID: cucmpub
Thanks!
09-10-2018 11:00 AM
09-10-2018 02:23 PM
09-10-2018 11:15 PM
09-10-2018 11:50 PM
Hi,
I suppose you should be able to see the command utils reset_application_ui_administrator_password in Audit logs.
can you cross-check in logs.
regds,
aman
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: