Cisco Video Endpoints logs

[hogils53559]

Hi 

i recently installed a video endpoint (webex room kit) in my environment, but recently there have been some reports that the endpoint will do a factory reset by the user

is it possible to see the logs of who issued the factory reset command on the endpoint based on the user credentials or whether it is issued by the user through touch 10 unit?

any help is appreciated

[Magnus Ohm]

No, you cannot since the factory reset via an unprotected Touch 10 is done as administrator. I recommend you to lock down the settings to prevent users from doing factory reset, by default these settings are available to anyone.

To challenge users trying to do a factory reset of the device you need to set a strong admin password on the device and set the configuration as follows:

xConfiguration UserInterface SettingsMenu Mode: Locked

If you want to hide IP information etc in the UI you can in addition apply this command:

xConfiguration UserInterface Security Mode: Strong

If you are provisioned via CUCM its better to bulk provisioning these settings to apply to all managed devices.

There is also a risk of the user doing a pin-hole factory reset though but its a bit trickier to perform.

/Magnus