Chat now with support
Chat with Support

Change Auditor for Skype for Business 7.3 - Event Reference Guide

Introduction

Many enterprises are adopting Microsoft Skype for Business as a standard IM and meeting client; therefore, monitoring and managing changes in Skype for Business has become critical. Change Auditor for Skype for Business allows you to audit configuration and security setting changes in Microsoft Skype for Business Server and Microsoft Lync Server, providing change notifications for Skype user setup, permissions and application configuration from the Microsoft Skype for Business Server and Microsoft Lync Server Central Management Store (CMS).

This guide lists the events captured by Change Auditor for Skype for Business. Separate event reference guides are provided that list the core Change Auditor events (when any Change Auditor license is applied) and the events captured when the different auditing modules are licensed.

Change Auditor for Skype for Business Events

This section lists the audited events captured by Change Auditor for Skype for Business. They are listed in alphabetical order by facility. To view a complete list of all the events, open the Audit Events page on the Administration Tasks tab in the client. This page also displays the facility to which the event belongs, the severity assigned to each event, if the event is enabled or disabled, and the type of license that is required to capture each event.

The following administration events are generated by activities performed on the security settings in Active Directory:

Connection point created

Created when a Skype for Business Server connection point is created.

Medium

Connection point deleted

Created when a Skype for Business Server connection point is deleted.

Medium

User enabled attribute changed

Created when a user is enabled or disabled for Skype for Business Server.

Medium

User enabled options changed

Created when the options enabled for a user change.

Medium

User line server changed

Session Initiation Protocol (SIP) is a IP telephony signaling protocol used to connect, monitor, and disconnect Instant Messaging (IM) and VOIP sessions between SIP devices. A change to the Session Initiator Protocol (SIP) URL of the CSTAP-SIP gateway server triggers this event.

Medium

User policy changed

Created when the global user policies list for a user is changed.

Medium

User primary address changed

Session Initiation Protocol (SIP) is a IP telephony signaling protocol used to connect, monitor, and disconnect Instant Messaging (IM) and VOIP sessions between SIP devices.

Changing primary SIP address of a user triggers this event.

Medium

User SIP or Phone URI changed

Session Initiation Protocol (SIP) is a IP telephony signaling protocol used to connect, monitor, and disconnect Instant Messaging (IM) and VOIP sessions between SIP devices.

Changing the SIP or TEL URL of the phone the user controls triggers this event.

Medium

Member added to Skype for Business administration group

This event is triggered when a member is added to one of the following Skype for Business administration groups:

High

Member removed from Skype for Business administration group

This event is triggered when a member is removed from one of the following Skype for Business administration groups:

High

Topology: Back end server changed

This event is triggered when the Skype for Business Server topology back end server attribute is changed.

Medium

The following events are generated by changes to the management data (such as topology, configuration and policy information) in the Central Management Store (CMS) SQL Server. The CMS is implemented as a SQL database and the name of the database is XDS.

 

Topology: Active URL changed

Skype for Business uses simple URLs that allow users to join meetings and administrators to locate administrative tools.

Multiple simple URLs can be defined for each of the following components; but only one can be active for each:

Changes made to any of the active URLs trigger this event.

High

Topology: Central Management Sever changed

The Central Management Server is the server responsible for replicating the server configuration information to all other servers in the deployment. Only one Front End Pool in the deployment can have a Central Management Server.

Adding or removing a server from the Front End Pool that contains the Central Management Server triggers this event.

Medium

Topology: Default SIP domain changed

Session Initiation Protocol (SIP) is an IP telephony signaling protocol used to connect, monitor, and disconnect Instant Messaging (IM) and VOIP sessions between SIP devices. SIP devices are identified by their SIP addresses such as: sip:number@sip_domain.

A SIP domain represents a place-holder for a collection of SIP addresses that share a common home.

The default SIP domain is the domain used by Skype for Business when one is not explicitly specified. A change to the default SIP domain triggers this event.

High

Topology: Pool changed

A pool consists of multiple servers all running the same server role. Adding or removing a Skype for Business pool from a site triggers this event.

High

Topology: Pool server collection changed

A pool consists of multiple servers all running the same server role. Adding or removing a Skype for Business server from a pool in the topology triggers this event.

Medium

Topology: SIP domains changed

Session Initiation Protocol (SIP) is a IP telephony signaling protocol used to connect, monitor, and disconnect Instant Messaging (IM) and VOIP sessions between SIP devices. SIP devices are identified by their SIP addresses such as: sip:number@sip_domain.

A SIP domain represents a place-holder for a collection of SIP addresses that share a common home.

Adding or removing a SIP domain from the topology triggers this event.

Medium

Topology: Simple URL changed

Simple URLs allow users to join meetings and administrators to locate administrative tools. The simple URLs include:

A change made to a Skype for Business simple URL triggers this event.

Medium

Topology: Site changed

Making a change to the Skype for Business site (Central site/Branch site) triggers this event.

High

Voice: Dial Plan changed

Dial plans translate phone numbers into a standard (E.164) format to enable call routing. The scope defines the level at which the plan is applied (user/pool/site/global level). Adding or removing a dial plan in a scope triggers this event.

High

Voice: Dial Plan - Conferencing Region changed

The conferencing region associated with a dial-in plan ensures correct access numbers are assigned when organizers set up a conference. Making a change to the dial-in conferencing region associated with a dial-in plan triggers this event.

High

Voice: Dial Plan - External Access Prefix changed

The external access prefix refers to the configured character
( #,*, and 0-9) users enter to access an external line.

Making a change to the external access prefix associated with a dial plan triggers this event.

High

Voice: Dial Plan - Normalization Rule changed

Normalization rules define the requirements for converting (or translating) numbers to a standard (E.164) format. Adding or removing a rule from the normalization rule list triggers this event.

High

Voice: Dial Plan - Normalization Rule - Pattern to Match changed

Normalization rules format dial strings to the standard E.164 required for Skype for Business call routing. Pattern to Match contains the pattern for dialed numbers. Updating any of the following properties of the pattern triggers this event: starting digits, length, digits to remove, and digits to add.

High

Voice: Dial Plan - Normalization Rule - Translation Rule has changed

Normalization rules format dial strings to the standard E.164 required for Skype for Business call routing. Translation rules contain patterns for E.164 phone numbers. Changing the pattern of the phone number triggers this event.

High

Voice: Dial Plan - Normalization Rule - Internal Extension changed

Normalization rules format dial strings to the standard E.164 required for Skype for Business call routing. Applying the internal extension option to a normalization rule means that the translated phone number will be internal to the organization. Changing the internal extension option of a Normalization rule triggers this event.

High

Voice: Dial Plan - Optimize Device Dialing option changed

Skype for Business provides an option to optimize device dialing by adding the external access prefix to calls made outside of the organization. Making a change to the Optimize Device Dialing option of a dial plan triggers this event.

High

Voice: Voice Policy changed

Voice policies define Enterprise Voice-related features and public switched telephone network (PSTN) usage records that determine authorized call types. Adding or removing a policy to a user, site, or organization triggers this event.

High

Voice: Voice Policy - Calling Feature changed

Voice policies determine what calling features are enabled or disabled. Changes made to the following features trigger this event: Enable Call Forwarding, Enable PSTN Rerouting, Enable Simultaneous Ringing of Phones, Enable Bandwidth Policy verride, Enable Call Parking, Enable Call Transfer, Enable Call Delegation, Enable Malicious Call Tracking, Enable Team Call, Enable Voice Mail Escape Timer, Prevent PSTN Toll Bypass, and Voice Deployment Mode.

High

Voice: Voice Policy - PSTN Usage changed

Public switched telephone network (PSTN) usage records associate a voice policy with a route to control which users are allowed to use specific routes. Adding or removing a PSTN usage to a list of PSTN usages records triggers this event.

High

Voice: Voice Policy - PSTN Voicemail Escape Timer changed

PSTN Voicemail Escape Timer option controls the amount of time to elapse before Skype for Business routes messages to the organization's voicemail. Making a change to the amount of time triggers this event.

Medium

Voice: Voice Policy - Call Forwarding and Simultaneous
Ringing Policy changed

Voice Policy Call Forwarding and Simultaneous Ringing PSTN Usages policy determines how call forwarding and simultaneous ringing of phones are routed.

Valid options are:

Changing options in Call Forwarding and Simultaneous Ringing PSTN Usage triggers this event

High

Voice: Voice Policy - Call Forwarding and Simultaneous Ringing Custom PSTN changed

Voice Policy - Call Forwarding and Simultaneous Ringing PSTN Usages policy determines how call forwarding and simultaneous ringing of phones are routed. A custom PSTN usage may be specified that is different from the voice policy’s PSTN usage. Adding or removing a Custom PSTN Usage triggers this event.

High

Voice: Route has changed

Voice routes contain instructions on how to route calls from Enterprise Voice users to phone numbers on the public switched telephone network (PSTN) or a private branch exchange (PBX). Adding or removing a voice route triggers this event.

High

Voice: Route - Matching Pattern changed

The matching pattern specifies the phone numbers that apply to a route. Numbers matching this pattern will be routed according to the rest of the routing settings. Making changes to the matching pattern triggers this event.

High

Voice: Route - Suppress Caller ID changed

The Suppress Caller ID option determines whether a caller's ID will be revealed on outbound calls. Enabling or disabling this option triggers this event.

Medium

Voice: Route - Alternate Caller Number changed

When the Suppress Call ID option is enabled, an alternate call ID may be specified. Making a change to the number that will display to the recipients as caller ID triggers this event.

Medium

Voice: Route - Trunk changed

Skype for Business supports associations between gateways and Mediation Server pools through trunks. Adding or removing a trunk in a voice route triggers this event.

High

Voice: Route - PSTN Usage changed

PSTN usages records associate routes and voice policies to control which users are allowed to use specific routes. Adding or removing a PSTN usage to a voice route triggers this event.

High

Voice: Route - Configuration Enable Location Based Routing at the Global Scope changed

Location based routing allows administrators to control call routing based on the location of both the user placing the call and the user receiving the call. Making changes to the Global Location Based Routing option triggers this event.

High

Voice: Route - Priority changed

Route priority determines the order routes will be applied when more than one route is possible for an outbound call. Making a change to a route's priority triggers this event.

High

Voice: Trunk Configuration changed

A trunk can be configured between a Mediation Server and one or more peers (such as a PSTN gateway, IP-PBX, or SBC at the service provider) to provide public switched telephone network (PSTN) connectivity for Enterprise Voice clients and devices. Adding or removing a trunk configuration to the global/site/pool scope triggers this event.

High

Voice: Trunk Configuration - Policy changed

Trunk configuration policies define the relationship between the Mediation Server and its peers. Making a change in the following policies on a trunk configuration triggers this event:

High

Voice: Trunk Configuration - Max Early Dialogs changed

Administrators can configure the number of forked responses that a PSTN gateway, IP-PBX, or SBC at the service provider can receive to an invite that it sent to the Mediation Server. Altering this value on a trunk configuration triggers this event.

High

Voice: Trunk Configuration - Network Site ID changed

Trunk configuration settings can be associated with a network site through the network site ID. Changing the network site ID associated with the trunk configuration triggers this event.

High

Voice: Trunk Configuration - PSTN Usage changed

A collection of Public Switched Telephone Network (PSTN) usages can be assigned to a trunk configuration used for inter trunk routing. Adding or removing a PSTN usage triggers this event.

High

Voice: Trunk Configuration - Translation Rule changed

Translation rules normalize numbers to the required format for the trunking peer such as PSTN gateway, PBX, or SBC at the service provider. Translation rules are applied to calling and called phone numbers. Adding or removing a translation rule to/from the calling number or called number's translation rule list triggers this event.

High

Voice: Trunk Configuration - Translation Rule Pattern to Match changed

Translation rules normalize numbers to the required format for the trunking peer such as PSTN gateway, PBX, or SBC at the service provider. Pattern to Match is the regular expression that defines the number pattern to which the translation will be applied. Changing a calling or called number's translation rule's pattern to match triggers this event.

High

Voice: Trunk Configuration - Translation Rule - Translation Pattern changed

Translation rules normalize numbers to the required format for the trunking peer such as PSTN gateway, PBX, or SBC at the service provider. Translation Pattern is a regular expression that will be applied to the number matching the pattern to prepare that number for outbound routing. Changing a calling number or called number's translation rule's translation pattern triggers this event.

High

Voice: Trunk Configuration - SIP Response Code Translation Rule - List changed

SIP trunking enables the Skype for Business Server Enterprise Voice network to connect with a PSTN network. SIP Response Code Translation Rule list represents the rules that allow administrators to map SIP response codes with values between 400 and 699 received over a trunk to new values more consistent with Skype for Business Serve. Adding or removing a SIP response code rule to a trunk configuration triggers this event.

High

Voice: Trunk Configuration - SIP Response Code Translation Rule - Received Response Code changed

SIP trunking enables the Skype for Business Server Enterprise Voice network to connect with a PSTN network. The SIP response code translation rules format and map the the gateway SIP code to a format required by Skype for Business Server. Changing the received response code value triggers this event.

High

Voice: Trunk Configuration - SIP Response Code - Translation Rule Received ISUP Cause Value changed

SIP trunking enables the Enterprise Voice network to connect with a PSTN network. The SIP response code translation rules format and map the gateway SIP to a format required by Skype for Business Server. Changing the value of the ISDN User Part (ISUP) code that must be present in the SIP response message used by a gateway when responding to an invite message triggers this event.

High

Voice: Trunk Configuration - SIP Response Code - Translation Rule -Translated Response Code changed

SIP trunking enables the Enterprise Voice network to connect with a PSTN network. The SIP response code translation rules format and map the gateway SIP to a format required by Skype for Business Server. Changing the received response code value triggers this event.

High

Voice: Trunk Configuration -Encryption Support Level changed

The level of encryption determines the amount of protection for the traffic between the Mediation Server and the PSTN Gateway, IP-PBX, or SBC at the service provider. Making a change to the level of encryption (Required, Optional, or Not Supported) triggers this event.

High

Voice: Trunk Configuration - Support Referral changed

Support referral is a way to do call transfers. The available options include:

Changing the support referral trigger this event.

High

 

Log Events

When event logging for Skype for Business is enabled in Change Auditor, Skype for Business administration audited events will also be written to a Windows event log, named Change Auditor for Skype for Business. This event log can then be gathered by InTrust for further processing and reporting.

NOTE:  
To enable event logging, select the Event Logging tool bar button on the Agent Configuration page (Administration Tasks tab), and select the type of event logging to be enabled.

The following table lists the log events captured when Skype for Business event logging is enabled. They are listed in numeric order by event ID.

10

The enabled attribute changed for user <UserName>

11

The SIP or Phone URI changed for user <UserName>

12

The primary address changed for user <UserName>

16

The enabled options changed for user <UserName>

17

User <MemberNameCN> added to Skype for Business administration group <GroupNameCN>

18

User <MemberNameCN> removed from Skype for Business administration group <GroupNameCN>

19

The policy changed for user <UserName>

20

The line server changed for user <UserName>

21

The topology back-end server changed for user <UserName>

22

Connection point created

23

Connection point removed

Built-in Reports

Change Auditor provides predefined reports which allow you to quickly retrieve valuable change information from a variety of perspectives.

1
Click on the Searches tab or select the View | Searches menu command to open the Searches page.
Select the search definition and click the Run tool bar button at the top of the Searches page

The following built-in reports are available with Change Auditor for Skype for Business:

Self Service Tools
Knowledge Base
Notifications & Alerts
Product Support
Software Downloads
Technical Documentation
User Forums
Video Tutorials
RSS Feed
Contact Us
Licensing Assistance
Technical Support
View All
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating