Need to find out who changed the ipPhone attribute on user accounts in Active Directory.
Create a custom report that uses the Event Descriptions filter for ipPhone:
Select and refresh the custom report.
Run a SQL query against the Active Administrator database that will return all records where the ipPhone attribute has been changed:
Select * from tblalertlog where actiontext like '%ipphone%'