Is there a way to identify or track user password changes in CUCM, specifically application user password?
Checking the Audit logs, it shows a General Update entry confirming a change was made under the application user setting but doesn't say what exactly was changed. is there a way to get more granular details?
10:39:53.665 |LogMessage UserID : XXXX ClientAddress : 10.X.X.X Severity : 5 EventType : GeneralConfigurationUpdate ResourceAccessed: CUCMAdmin EventStatus : Success CompulsoryEvent : No AuditCategory : AdministrativeEvent ComponentID : Cisco CUCM Administration CorrelationID : AuditDetails : record in table applicationuserdevicemap with key field name = app_user updated App ID: Cisco Tomcat Cluster ID: Node ID: cucmpub
I suppose you should be able to see the command utils reset_application_ui_administrator_password in Audit logs.
can you cross-check in logs.