cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
148
Views
0
Helpful
4
Replies
Beginner

Identify/Track Application User password change in CUCM

Is there a way to identify or track user password changes in CUCM, specifically application user password?

 

Checking the Audit logs, it shows a General Update entry confirming a change was made under the application user setting but doesn't say what exactly was changed. is there a way to get more granular details?

 

Example:

 

10:39:53.665 |LogMessage   UserID : XXXX  ClientAddress : 10.X.X.X Severity : 5  EventType : GeneralConfigurationUpdate  ResourceAccessed: CUCMAdmin  EventStatus : Success  CompulsoryEvent : No  AuditCategory : AdministrativeEvent  ComponentID : Cisco CUCM Administration  CorrelationID :   AuditDetails :  record in table applicationuserdevicemap with key field name = app_user updated  App ID: Cisco Tomcat Cluster ID:  Node ID: cucmpub

 

Thanks!

Everyone's tags (3)
4 REPLIES 4
Cisco Employee

Re: Identify/Track Application User password change in CUCM

The information is usually maintained under the "Cisco Audit Logs" and "Tomcat Security Logs". You might want to review both along with the time when the suspected password changed if that is possible. Those logs should list the specific userid that made the change if that is what you are after.

Nipun Singh Raghav
"We cannot solve our problems with the same thinking we used when we created them"
Beginner

Re: Identify/Track Application User password change in CUCM

We have reviewed the Audit Logs and only found a General Configuration Event type, it does mention a change was made to the application user however it doesn't specify what kind of change. Want to know if there is a way to get granular and view the exact setting that was modified.
VIP Advisor

Re: Identify/Track Application User password change in CUCM

Yes you can view it if you have it enabled. This link is very useful for it

https://www.netcraftsmen.com/audit-logs-on-cisco-unified-communications-manager-cucm/
Highlighted
Advisor

Re: Identify/Track Application User password change in CUCM

Hi,

 

I suppose you should be able to see the command utils reset_application_ui_administrator_password in Audit logs.

 

can you cross-check in logs.

 

regds,

aman

CreatePlease to create content
Content for Community-Ad
July's Community Spotlight Awards