Change Auditor for Skype for Business 7.1.1

Introduction Change Auditor for Skype for Business Events Log Events Built-in Reports

Introduction

Many enterprises are adopting Microsoft Skype for Business as a standard IM and meeting client; therefore, monitoring and managing changes in Skype for Business has become critical. Change Auditor for Skype for Business allows you to audit configuration and security setting changes in Microsoft Skype for Business Server and Microsoft Lync Server, providing change notifications for Skype user setup, permissions and application configuration from the Microsoft Skype for Business Server and Microsoft Lync Server Central Management Store (CMS).


	NOTE: Change Auditor for Skype for Business auditing is only available when Microsoft Skype for Business Server and Microsoft Lync Server have been deployed on-premises according to Microsoft’s deployment requirements and the Change Auditor for Skype for Business license is applied. Contact your Sales Representative for more information on obtaining Change Auditor for Skype for Business.

This guide lists the events captured by Change Auditor for Skype for Business. Separate event reference guides are provided that list the core Change Auditor events (when any Change Auditor license is applied) and the events captured when the different auditing modules are licensed.

Change Auditor for Skype for Business Events

This section lists the audited events captured by Change Auditor for Skype for Business. They are listed in alphabetical order by facility. To view a complete list of all the events, open the Audit Events page on the Administration Tasks tab in the client. This page also displays the facility to which the event belongs, the severity assigned to each event, if the event is enabled or disabled, and the type of license that is required to capture each event.


	NOTE: Starting with Change Auditor 6.9, the Lync Administration facility has been renamed to Skype for Business Administration facility and the administration events are found under the Skype for Business subsystem.


	IMPORTANT: When expecting large numbers of events, it may be necessary to increase the Max Events per Connection setting in the client (Agent Configuration on the Administration Tasks tab) to avoid an ever-increasing backlog of events waiting to be sent from the agent to the coordinator database.


	NOTE: Due to the nature of some events, the “who” field may display the computer account rather than an individual user because it is the computer account that is actually making the change.

Skype for Business Administration

The following administration events are generated by activities performed on the security settings in Active Directory:

Table 1. Skype for Business Administration events

Event

Description

Severity

Connection point created

Created when a Skype for Business Server connection point is created.

Medium

Connection point deleted

Created when a Skype for Business Server connection point is deleted.

Medium

User enabled attribute changed

Created when a user is enabled or disabled for Skype for Business Server.

Medium

User enabled options changed

Created when the options enabled for a user change.

Medium

User line server changed

Session Initiation Protocol (SIP) is a IP telephony signaling protocol used to connect, monitor, and disconnect Instant Messaging (IM) and VOIP sessions between SIP devices. A change to the Session Initiator Protocol (SIP) URL of the CSTAP-SIP gateway server triggers this event.

Medium

User policy changed

Created when the global user policies list for a user is changed.

Medium

User primary address changed

Session Initiation Protocol (SIP) is a IP telephony signaling protocol used to connect, monitor, and disconnect Instant Messaging (IM) and VOIP sessions between SIP devices.

Changing primary SIP address of a user triggers this event.

Medium

User SIP or Phone URI changed

Session Initiation Protocol (SIP) is a IP telephony signaling protocol used to connect, monitor, and disconnect Instant Messaging (IM) and VOIP sessions between SIP devices.

Changing the SIP or TEL URL of the phone the user controls triggers this event.

Medium

Member added to Skype for Business administration group

This event is triggered when a member is added to one of the following Skype for Business administration groups:

•

CSAdministrator

•

CSArchivingAdministrator

•

CSHelpDesk

•

CSLocationAdministrator

•

CSResponseGroupAdministrator

•

CSServerAdministrator

•

CSUserAdministrator

•

CSViewOnlyAdministrator

•

CSVoiceAdministrator

High

Member removed from Skype for Business administration group

This event is triggered when a member is removed from one of the following Skype for Business administration groups:

•

CSAdministrator

•

CSArchivingAdministrator

•

CSHelpDesk

•

CSLocationAdministrator

•

CSResponseGroupAdministrator

•

CSServerAdministrator

•

CSUserAdministrator

•

CSViewOnlyAdministrator

•

CSVoiceAdministrator

High

Topology: Back end server changed

This event is triggered when the Skype for Business Server topology back end server attribute is changed.

Medium

Skype for Business Configuration

The following events are generated by changes to the management data (such as topology, configuration and policy information) in the Central Management Store (CMS) SQL Server. The CMS is implemented as a SQL database and the name of the database is XDS.

Event

Description

Severity

Topology: Active URL changed

Skype for Business uses simple URLs that allow users to join meetings and administrators to locate administrative tools.

Multiple simple URLs can be defined for each of the following components; but only one can be active for each:

•

Meet (URL for conferences)

•

Dial-in (URL for Dial-in Conference settings)

•

Admin (URL for Administratve Control Panel)

Changes made to any of the active URLs trigger this event.

High

Topology: Central Management Sever changed

The Central Management Server is the server responsible for replicating the server configuration information to all other servers in the deployment. Only one Front End Pool in the deployment can have a Central Management Server.

Adding or removing a server from the Front End Pool that contains the Central Management Server triggers this event.

NOTE: Change Auditor does not monitor when the Front End Pool, which contains the Central Management Server, itself has been changed.

Medium

Topology: Default SIP domain changed

Session Initiation Protocol (SIP) is an IP telephony signaling protocol used to connect, monitor, and disconnect Instant Messaging (IM) and VOIP sessions between SIP devices. SIP devices are identified by their SIP addresses such as: sip:number@sip_domain.

A SIP domain represents a place-holder for a collection of SIP addresses that share a common home.

The default SIP domain is the domain used by Skype for Business when one is not explicitly specified. A change to the default SIP domain triggers this event.

High

Topology: Pool changed

A pool consists of multiple servers all running the same server role. Adding or removing a Skype for Business pool from a site triggers this event.

NOTE: Change Auditor audits the following pools: Standard Edition Front End servers, Enterprise Edition Front End pools, Director pools, Mediation pools, Persistent Chat pools, Edge pools, Trusted application servers, Video Interop Server pools, SQL Server Stores, File Stores, PTSN Gateways, Trunks, Office Web Apps Servers, and Survival Branch Appliances.

High

Topology: Pool server collection changed

A pool consists of multiple servers all running the same server role. Adding or removing a Skype for Business server from a pool in the topology triggers this event.

Medium

Topology: SIP domains changed

Session Initiation Protocol (SIP) is a IP telephony signaling protocol used to connect, monitor, and disconnect Instant Messaging (IM) and VOIP sessions between SIP devices. SIP devices are identified by their SIP addresses such as: sip:number@sip_domain.

A SIP domain represents a place-holder for a collection of SIP addresses that share a common home.

Adding or removing a SIP domain from the topology triggers this event.

Medium

Topology: Simple URL changed

Simple URLs allow users to join meetings and administrators to locate administrative tools. The simple URLs include:

•

Meet (URL for conferences)

•

Dial-in (URL for Dial-in Conference settings)

•

Admin (URL for Administrative Control Panel)

A change made to a Skype for Business simple URL triggers this event.

Medium

Topology: Site changed

Making a change to the Skype for Business site (Central site/Branch site) triggers this event.

High

Voice: Dial Plan changed

Dial plans translate phone numbers into a standard (E.164) format to enable call routing. The scope defines the level at which the plan is applied (user/pool/site/global level). Adding or removing a dial plan in a scope triggers this event.

High

Voice: Dial Plan - Conferencing Region changed

The conferencing region associated with a dial-in plan ensures correct access numbers are assigned when organizers set up a conference. Making a change to the dial-in conferencing region associated with a dial-in plan triggers this event.

High

Voice: Dial Plan - External Access Prefix changed

The external access prefix refers to the configured character
( #,*, and 0-9) users enter to access an external line.

Making a change to the external access prefix associated with a dial plan triggers this event.

High

Voice: Dial Plan - Normalization Rule changed

Normalization rules define the requirements for converting (or translating) numbers to a standard (E.164) format. Adding or removing a rule from the normalization rule list triggers this event.

High

Voice: Dial Plan - Normalization Rule - Pattern to Match changed

Normalization rules format dial strings to the standard E.164 required for Skype for Business call routing. Pattern to Match contains the pattern for dialed numbers. Updating any of the following properties of the pattern triggers this event: starting digits, length, digits to remove, and digits to add.

High

Voice: Dial Plan - Normalization Rule - Translation Rule has changed

Normalization rules format dial strings to the standard E.164 required for Skype for Business call routing. Translation rules contain patterns for E.164 phone numbers. Changing the pattern of the phone number triggers this event.

High

Voice: Dial Plan - Normalization Rule - Internal Extension changed

Normalization rules format dial strings to the standard E.164 required for Skype for Business call routing. Applying the internal extension option to a normalization rule means that the translated phone number will be internal to the organization. Changing the internal extension option of a Normalization rule triggers this event.

High

Voice: Dial Plan - Optimize Device Dialing option changed

Skype for Business provides an option to optimize device dialing by adding the external access prefix to calls made outside of the organization. Making a change to the Optimize Device Dialing option of a dial plan triggers this event.

High

Voice: Voice Policy changed

Voice policies define Enterprise Voice-related features and public switched telephone network (PSTN) usage records that determine authorized call types. Adding or removing a policy to a user, site, or organization triggers this event.

High

Voice: Voice Policy - Calling Feature changed

Voice policies determine what calling features are enabled or disabled. Changes made to the following features trigger this event: Enable Call Forwarding, Enable PSTN Rerouting, Enable Simultaneous Ringing of Phones, Enable Bandwidth Policy verride, Enable Call Parking, Enable Call Transfer, Enable Call Delegation, Enable Malicious Call Tracking, Enable Team Call, Enable Voice Mail Escape Timer, Prevent PSTN Toll Bypass, and Voice Deployment Mode.

High

Voice: Voice Policy - PSTN Usage changed

Public switched telephone network (PSTN) usage records associate a voice policy with a route to control which users are allowed to use specific routes. Adding or removing a PSTN usage to a list of PSTN usages records triggers this event.

High

Voice: Voice Policy - PSTN Voicemail Escape Timer changed

PSTN Voicemail Escape Timer option controls the amount of time to elapse before Skype for Business routes messages to the organization's voicemail. Making a change to the amount of time triggers this event.

Medium

Voice: Voice Policy - Call Forwarding and Simultaneous
Ringing Policy changed

Voice Policy Call Forwarding and Simultaneous Ringing PSTN Usages policy determines how call forwarding and simultaneous ringing of phones are routed.

Valid options are:

•

Internal only: Route only to internal users

•

Voice Policy Usage: Route using Voice Policy PSTN Usage

•

Custom Usage: Route using custom PSTN Usages

Changing options in Call Forwarding and Simultaneous Ringing PSTN Usage triggers this event

High

Voice: Voice Policy - Call Forwarding and Simultaneous Ringing Custom PSTN changed

Voice Policy - Call Forwarding and Simultaneous Ringing PSTN Usages policy determines how call forwarding and simultaneous ringing of phones are routed. A custom PSTN usage may be specified that is different from the voice policy’s PSTN usage. Adding or removing a Custom PSTN Usage triggers this event.

High

Voice: Route has changed

Voice routes contain instructions on how to route calls from Enterprise Voice users to phone numbers on the public switched telephone network (PSTN) or a private branch exchange (PBX). Adding or removing a voice route triggers this event.

High

Voice: Route - Matching Pattern changed

The matching pattern specifies the phone numbers that apply to a route. Numbers matching this pattern will be routed according to the rest of the routing settings. Making changes to the matching pattern triggers this event.

High

Voice: Route - Suppress Caller ID changed

The Suppress Caller ID option determines whether a caller's ID will be revealed on outbound calls. Enabling or disabling this option triggers this event.

Medium

Voice: Route - Alternate Caller Number changed

When the Suppress Call ID option is enabled, an alternate call ID may be specified. Making a change to the number that will display to the recipients as caller ID triggers this event.

Medium

Voice: Route - Trunk changed

Skype for Business supports associations between gateways and Mediation Server pools through trunks. Adding or removing a trunk in a voice route triggers this event.

High

Voice: Route - PSTN Usage changed

PSTN usages records associate routes and voice policies to control which users are allowed to use specific routes. Adding or removing a PSTN usage to a voice route triggers this event.

High

Voice: Route - Configuration Enable Location Based Routing at the Global Scope changed

Location based routing allows administrators to control call routing based on the location of both the user placing the call and the user receiving the call. Making changes to the Global Location Based Routing option triggers this event.

High

Voice: Route - Priority changed

Route priority determines the order routes will be applied when more than one route is possible for an outbound call. Making a change to a route's priority triggers this event.

High

Voice: Trunk Configuration changed

A trunk can be configured between a Mediation Server and one or more peers (such as a PSTN gateway, IP-PBX, or SBC at the service provider) to provide public switched telephone network (PSTN) connectivity for Enterprise Voice clients and devices. Adding or removing a trunk configuration to the global/site/pool scope triggers this event.

High

Voice: Trunk Configuration - Policy changed

Trunk configuration policies define the relationship between the Mediation Server and its peers. Making a change in the following policies on a trunk configuration triggers this event:

•

Concentrated Topology (Centralized media processing)

•

Enable Bypass (Enable Media bypass)

•

Enable Mobile Trunk Support

•

•

•

•

•

•

Enable PIDFLO Support

•

Enable RTP Latching

•

Enable Online Voice

•

Forward Call History

•

Forward PAI (Enable forward P-Asserted-Identity data)

•

Enable Fast Failover Timer (Enable outbound routing failover timer)

•

Enable Location Restriction

NOTE: Some policy names differ between the Skype for Business control panel and PowerShell. This document uses the PowerShell terminology. The term used in the Skype for Business control panel is included within brackets

High

Voice: Trunk Configuration - Max Early Dialogs changed

Administrators can configure the number of forked responses that a PSTN gateway, IP-PBX, or SBC at the service provider can receive to an invite that it sent to the Mediation Server. Altering this value on a trunk configuration triggers this event.

High

Voice: Trunk Configuration - Network Site ID changed

Trunk configuration settings can be associated with a network site through the network site ID. Changing the network site ID associated with the trunk configuration triggers this event.

High

Voice: Trunk Configuration - PSTN Usage changed

A collection of Public Switched Telephone Network (PSTN) usages can be assigned to a trunk configuration used for inter trunk routing. Adding or removing a PSTN usage triggers this event.

High

Voice: Trunk Configuration - Translation Rule changed

Translation rules normalize numbers to the required format for the trunking peer such as PSTN gateway, PBX, or SBC at the service provider. Translation rules are applied to calling and called phone numbers. Adding or removing a translation rule to/from the calling number or called number's translation rule list triggers this event.

High

Voice: Trunk Configuration - Translation Rule Pattern to Match changed

Translation rules normalize numbers to the required format for the trunking peer such as PSTN gateway, PBX, or SBC at the service provider. Pattern to Match is the regular expression that defines the number pattern to which the translation will be applied. Changing a calling or called number's translation rule's pattern to match triggers this event.

High

Voice: Trunk Configuration - Translation Rule - Translation Pattern changed

Translation rules normalize numbers to the required format for the trunking peer such as PSTN gateway, PBX, or SBC at the service provider. Translation Pattern is a regular expression that will be applied to the number matching the pattern to prepare that number for outbound routing. Changing a calling number or called number's translation rule's translation pattern triggers this event.

High

Voice: Trunk Configuration - SIP Response Code Translation Rule - List changed

SIP trunking enables the Skype for Business Server Enterprise Voice network to connect with a PSTN network. SIP Response Code Translation Rule list represents the rules that allow administrators to map SIP response codes with values between 400 and 699 received over a trunk to new values more consistent with Skype for Business Serve. Adding or removing a SIP response code rule to a trunk configuration triggers this event.

High

Voice: Trunk Configuration - SIP Response Code Translation Rule - Received Response Code changed

SIP trunking enables the Skype for Business Server Enterprise Voice network to connect with a PSTN network. The SIP response code translation rules format and map the the gateway SIP code to a format required by Skype for Business Server. Changing the received response code value triggers this event.

High

Voice: Trunk Configuration - SIP Response Code - Translation Rule Received ISUP Cause Value changed

SIP trunking enables the Enterprise Voice network to connect with a PSTN network. The SIP response code translation rules format and map the gateway SIP to a format required by Skype for Business Server. Changing the value of the ISDN User Part (ISUP) code that must be present in the SIP response message used by a gateway when responding to an invite message triggers this event.

High

Voice: Trunk Configuration - SIP Response Code - Translation Rule -Translated Response Code changed

High

Voice: Trunk Configuration -Encryption Support Level changed

The level of encryption determines the amount of protection for the traffic between the Mediation Server and the PSTN Gateway, IP-PBX, or SBC at the service provider. Making a change to the level of encryption (Required, Optional, or Not Supported) triggers this event.

High

Voice: Trunk Configuration - Support Referral changed

Support referral is a way to do call transfers. The available options include:

•

None: Call transfers are not allowed on the trunk.

•

Enable sending refer to the gateway: Trunk supports receiving refer requests from the Mediation Server.

•

Enable refer using third-party call control: Third party protocol can be used to allow transferred calls to bypass the hosted site.

Changing the support referral trigger this event.

High

Log Events

When event logging for Skype for Business is enabled in Change Auditor, Skype for Business administration audited events will also be written to a Windows event log, named Change Auditor for Skype for Business. This event log can then be gathered by InTrust and Quest Knowledge Portal for further processing and reporting.

NOTE:

•

Event Logging is supported only for Skype for Business Administration facility; it is not supported for the Skype for Business Configuration facility.

•

To enable event logging, select the Event Logging tool bar button on the Agent Configuration page (Administration Tasks tab), and select the type of event logging to be enabled.

Change Auditor for Skype for Business event log

The following table lists the log events captured when Skype for Business event logging is enabled. They are listed in numeric order by event ID.

Table 2. Change Auditor for Skype for Business event log events
Event ID	Description
10	The enabled attribute changed for user <UserName>
11	The SIP or Phone URI changed for user <UserName>
12	The primary address changed for user <UserName>
16	The enabled options changed for user <UserName>
17	User <MemberNameCN> added to Skype for Business administration group <GroupNameCN>
18	User <MemberNameCN> removed from Skype for Business administration group <GroupNameCN>
19	The policy changed for user <UserName>
20	The line server changed for user <UserName>
21	The topology back-end server changed for user <UserName>
22	Connection point created
23	Connection point removed

Built-in Reports

Change Auditor provides predefined reports which allow you to quickly retrieve valuable change information from a variety of perspectives.


	NOTE: The terms ‘searches’ and ‘reports’ are used in conjunction to acquire the desired output. You run a ‘search’ and the results returned are referred to as a ‘report’.

To run a built-in search:

Click on the Searches tab or select the View | Searches menu command to open the Searches page.

Expand and select the appropriate folder in the explorer view (left pane) to display the list of search definitions stored in the selected folder. For example, selecting the Shared | Built-in | Skype for Business will display all the built-in searches available for Skype for Business.

In the right-hand pane, locate the search to be run and use one of the following methods to run the selected search:

•

Double-click a search definition

•

Right-click a search definition and select the Run menu command

•

Select the search definition and click the Run tool bar button at the top of the Searches page

A new Search Results Page will be displayed populated with the audited events that met the search criteria defined in the selected search definition.


	NOTE: To modify a built-in search or create a custom Skype for Business search, see the Change Auditor User Guide.

Skype for Business built-in reports


	NOTE: Lync built-in reports have been deprecated and new Skype for Business buit-in reports have been added. The new Skype for Business searches are located under the Skype for Business folder.

The following built-in reports are available with Change Auditor for Skype for Business:

•

All member changes in Skype for Business administration groups in the last 7 days

•

All Skype for Business administration events in the last 7 days

•

All Skype for Business Central Management Store (CMS) changes in the last 3 months

•

All Skype for Business configuration events in the last 7 days

•

All Skype for Business connection point events in the last 7 days

•