Unauthorized voicemail access issue

[Kent Drugge]

CUCM CUC 11.5 - Someone has been accessing Unity mailboxes and changing the Recorded Name. It's not rude, but annoying. But How ? I don't know how to backtrack this. The pin is not changed. The greeting is typically unity default for staff. Some staff do use their ext # as the pin, but others do not and I don't know how someone is accessing and changing the Name recording. Any tips on how I can check mailbox logins or something to find a source. Using CDR data doesn't help. Thanks,

[jonathan.salter]

Is you goal to stop it or find out who is doing it?

[Kent Drugge]

Hi Jonathan,

I did want to find out who it was. I believe the mailboxes that got changed were because users had pins matching the ext # or the mailbox never got set up and it was the default code. I wondered if there was some logging that would tell who accessed a mailbox or ?  Thanks,

[Maren Mahoney]

The CDR data should show the MAC address of the device making the call to Unity Connection when a greeting is changed. Can that be cross-referenced back to CUCM?

[Kent Drugge]

Hi Maran, I can see what calls are made to unity easy enough, I'm trying to see who has logged in, using the PIN to access a voice mailbox to change the greetings. Thank you for your reply.

[Maren Mahoney]

Right. And if you can see the call in the CDR, and note the MAC address of the phone that made that call, you can see from what physical phone that call was made. This should give you an indication of who the caller was. That's the only way I can think of to note who might be using an ID/PIN not their own to log into someone else's voicemail box.