• Become a portal pro
• Download
• Print
• My Downloads ()

• Support
• Technical Documentation
• Change Auditor for Skype for Business 7.3
• Change Auditor for Skype for Business 7.3 - Event Reference Guide

Change Auditor for Skype for Business 7.3 - Event Reference Guide

Table of Contents  

Introduction Change Auditor for Skype for Business Events Log Events Built-in Reports

• Viewing Topics 1 - 4 of 4

×

Introduction

Many enterprises are adopting Microsoft Skype for Business as a standard IM and meeting client; therefore, monitoring and managing changes in Skype for Business has become critical. Change Auditor for Skype for Business allows you to audit configuration and security setting changes in Microsoft Skype for Business Server and Microsoft Lync Server, providing change notifications for Skype user setup, permissions and application configuration from the Microsoft Skype for Business Server and Microsoft Lync Server Central Management Store (CMS).

NOTE: Change Auditor for Skype for Business auditing is only available when Microsoft Skype for Business Server and Microsoft Lync Server have been deployed on-premises according to Microsoft’s deployment requirements and the Change Auditor for Skype for Business license is applied. Contact your Sales Representative for more information on obtaining Change Auditor for Skype for Business.

This guide lists the events captured by Change Auditor for Skype for Business. Separate event reference guides are provided that list the core Change Auditor events (when any Change Auditor license is applied) and the events captured when the different auditing modules are licensed.

Change Auditor for Skype for Business Events

This section lists the audited events captured by Change Auditor for Skype for Business. They are listed in alphabetical order by facility. To view a complete list of all the events, open the Audit Events page on the Administration Tasks tab in the client. This page also displays the facility to which the event belongs, the severity assigned to each event, if the event is enabled or disabled, and the type of license that is required to capture each event.

NOTE: Starting with Change Auditor 6.9, the Lync Administration facility has been renamed to Skype for Business Administration facility and the administration events are found under the Skype for Business subsystem.

IMPORTANT: When expecting large numbers of events, it may be necessary to increase the Max Events per Connection setting in the client (Agent Configuration on the Administration Tasks tab) to avoid an ever-increasing backlog of events waiting to be sent from the agent to the coordinator database.

NOTE: Due to the nature of some events, the “who” field may display the computer account rather than an individual user because it is the computer account that is actually making the change.

Skype for Business Administration

The following administration events are generated by activities performed on the security settings in Active Directory:

 

Table 1. Skype for Business Administration events

Event	Description	Severity
Connection point created	Created when a Skype for Business Server connection point is created.	Medium
Connection point deleted	Created when a Skype for Business Server connection point is deleted.	Medium
User enabled attribute changed	Created when a user is enabled or disabled for Skype for Business Server.	Medium
User enabled options changed	Created when the options enabled for a user change.	Medium
User line server changed	Session Initiation Protocol (SIP) is a IP telephony signaling protocol used to connect, monitor, and disconnect Instant Messaging (IM) and VOIP sessions between SIP devices. A change to the Session Initiator Protocol (SIP) URL of the CSTAP-SIP gateway server triggers this event.	Medium
User policy changed	Created when the global user policies list for a user is changed.	Medium
User primary address changed	Session Initiation Protocol (SIP) is a IP telephony signaling protocol used to connect, monitor, and disconnect Instant Messaging (IM) and VOIP sessions between SIP devices. Changing primary SIP address of a user triggers this event.	Medium
User SIP or Phone URI changed	Session Initiation Protocol (SIP) is a IP telephony signaling protocol used to connect, monitor, and disconnect Instant Messaging (IM) and VOIP sessions between SIP devices. Changing the SIP or TEL URL of the phone the user controls triggers this event.	Medium
Member added to Skype for Business administration group	This event is triggered when a member is added to one of the following Skype for Business administration groups: • CSAdministrator • CSArchivingAdministrator • CSHelpDesk • CSLocationAdministrator • CSResponseGroupAdministrator • CSServerAdministrator • CSUserAdministrator • CSViewOnlyAdministrator • CSVoiceAdministrator	High
Member removed from Skype for Business administration group	This event is triggered when a member is removed from one of the following Skype for Business administration groups: • CSAdministrator • CSArchivingAdministrator • CSHelpDesk • CSLocationAdministrator • CSResponseGroupAdministrator • CSServerAdministrator • CSUserAdministrator • CSViewOnlyAdministrator • CSVoiceAdministrator	High
Topology: Back end server changed	This event is triggered when the Skype for Business Server topology back end server attribute is changed.	Medium

Skype for Business Configuration

The following events are generated by changes to the management data (such as topology, configuration and policy information) in the Central Management Store (CMS) SQL Server. The CMS is implemented as a SQL database and the name of the database is XDS.

 

Event	Description	Severity
Topology: Active URL changed	Skype for Business uses simple URLs that allow users to join meetings and administrators to locate administrative tools. Multiple simple URLs can be defined for each of the following components; but only one can be active for each: • Meet (URL for conferences) • Dial-in (URL for Dial-in Conference settings) • Admin (URL for Administratve Control Panel) Changes made to any of the active URLs trigger this event.	High
Topology: Central Management Sever changed	The Central Management Server is the server responsible for replicating the server configuration information to all other servers in the deployment. Only one Front End Pool in the deployment can have a Central Management Server. Adding or removing a server from the Front End Pool that contains the Central Management Server triggers this event. NOTE: Change Auditor does not monitor when the Front End Pool, which contains the Central Management Server, itself has been changed.	Medium
Topology: Default SIP domain changed	Session Initiation Protocol (SIP) is an IP telephony signaling protocol used to connect, monitor, and disconnect Instant Messaging (IM) and VOIP sessions between SIP devices. SIP devices are identified by their SIP addresses such as: sip:number@sip_domain. A SIP domain represents a place-holder for a collection of SIP addresses that share a common home. The default SIP domain is the domain used by Skype for Business when one is not explicitly specified. A change to the default SIP domain triggers this event.	High
Topology: Pool changed	A pool consists of multiple servers all running the same server role. Adding or removing a Skype for Business pool from a site triggers this event. NOTE: Change Auditor audits the following pools: Standard Edition Front End servers, Enterprise Edition Front End pools, Director pools, Mediation pools, Persistent Chat pools, Edge pools, Trusted application servers, Video Interop Server pools, SQL Server Stores, File Stores, PTSN Gateways, Trunks, Office Web Apps Servers, and Survival Branch Appliances.	High
Topology: Pool server collection changed	A pool consists of multiple servers all running the same server role. Adding or removing a Skype for Business server from a pool in the topology triggers this event.	Medium
Topology: SIP domains changed	Session Initiation Protocol (SIP) is a IP telephony signaling protocol used to connect, monitor, and disconnect Instant Messaging (IM) and VOIP sessions between SIP devices. SIP devices are identified by their SIP addresses such as: sip:number@sip_domain. A SIP domain represents a place-holder for a collection of SIP addresses that share a common home. Adding or removing a SIP domain from the topology triggers this event.	Medium
Topology: Simple URL changed	Simple URLs allow users to join meetings and administrators to locate administrative tools. The simple URLs include: • Meet (URL for conferences) • Dial-in (URL for Dial-in Conference settings) • Admin (URL for Administrative Control Panel) A change made to a Skype for Business simple URL triggers this event.	Medium
Topology: Site changed	Making a change to the Skype for Business site (Central site/Branch site) triggers this event.	High
Voice: Dial Plan changed	Dial plans translate phone numbers into a standard (E.164) format to enable call routing. The scope defines the level at which the plan is applied (user/pool/site/global level). Adding or removing a dial plan in a scope triggers this event.	High
Voice: Dial Plan - Conferencing Region changed	The conferencing region associated with a dial-in plan ensures correct access numbers are assigned when organizers set up a conference. Making a change to the dial-in conferencing region associated with a dial-in plan triggers this event.	High
Voice: Dial Plan - External Access Prefix changed	The external access prefix refers to the configured character ( #,*, and 0-9) users enter to access an external line. Making a change to the external access prefix associated with a dial plan triggers this event.	High
Voice: Dial Plan - Normalization Rule changed	Normalization rules define the requirements for converting (or translating) numbers to a standard (E.164) format. Adding or removing a rule from the normalization rule list triggers this event.	High
Voice: Dial Plan - Normalization Rule - Pattern to Match changed	Normalization rules format dial strings to the standard E.164 required for Skype for Business call routing. Pattern to Match contains the pattern for dialed numbers. Updating any of the following properties of the pattern triggers this event: starting digits, length, digits to remove, and digits to add.	High
Voice: Dial Plan - Normalization Rule - Translation Rule has changed	Normalization rules format dial strings to the standard E.164 required for Skype for Business call routing. Translation rules contain patterns for E.164 phone numbers. Changing the pattern of the phone number triggers this event.	High
Voice: Dial Plan - Normalization Rule - Internal Extension changed	Normalization rules format dial strings to the standard E.164 required for Skype for Business call routing. Applying the internal extension option to a normalization rule means that the translated phone number will be internal to the organization. Changing the internal extension option of a Normalization rule triggers this event.	High
Voice: Dial Plan - Optimize Device Dialing option changed	Skype for Business provides an option to optimize device dialing by adding the external access prefix to calls made outside of the organization. Making a change to the Optimize Device Dialing option of a dial plan triggers this event.	High
Voice: Voice Policy changed	Voice policies define Enterprise Voice-related features and public switched telephone network (PSTN) usage records that determine authorized call types. Adding or removing a policy to a user, site, or organization triggers this event.	High
Voice: Voice Policy - Calling Feature changed	Voice policies determine what calling features are enabled or disabled. Changes made to the following features trigger this event: Enable Call Forwarding, Enable PSTN Rerouting, Enable Simultaneous Ringing of Phones, Enable Bandwidth Policy verride, Enable Call Parking, Enable Call Transfer, Enable Call Delegation, Enable Malicious Call Tracking, Enable Team Call, Enable Voice Mail Escape Timer, Prevent PSTN Toll Bypass, and Voice Deployment Mode.	High
Voice: Voice Policy - PSTN Usage changed	Public switched telephone network (PSTN) usage records associate a voice policy with a route to control which users are allowed to use specific routes. Adding or removing a PSTN usage to a list of PSTN usages records triggers this event.	High
Voice: Voice Policy - PSTN Voicemail Escape Timer changed	PSTN Voicemail Escape Timer option controls the amount of time to elapse before Skype for Business routes messages to the organization's voicemail. Making a change to the amount of time triggers this event.	Medium
Voice: Voice Policy - Call Forwarding and Simultaneous Ringing Policy changed	Voice Policy Call Forwarding and Simultaneous Ringing PSTN Usages policy determines how call forwarding and simultaneous ringing of phones are routed. Valid options are: • Internal only: Route only to internal users • Voice Policy Usage: Route using Voice Policy PSTN Usage • Custom Usage: Route using custom PSTN Usages Changing options in Call Forwarding and Simultaneous Ringing PSTN Usage triggers this event	High
Voice: Voice Policy - Call Forwarding and Simultaneous Ringing Custom PSTN changed	Voice Policy - Call Forwarding and Simultaneous Ringing PSTN Usages policy determines how call forwarding and simultaneous ringing of phones are routed. A custom PSTN usage may be specified that is different from the voice policy’s PSTN usage. Adding or removing a Custom PSTN Usage triggers this event.	High
Voice: Route has changed	Voice routes contain instructions on how to route calls from Enterprise Voice users to phone numbers on the public switched telephone network (PSTN) or a private branch exchange (PBX). Adding or removing a voice route triggers this event.	High
Voice: Route - Matching Pattern changed	The matching pattern specifies the phone numbers that apply to a route. Numbers matching this pattern will be routed according to the rest of the routing settings. Making changes to the matching pattern triggers this event.	High
Voice: Route - Suppress Caller ID changed	The Suppress Caller ID option determines whether a caller's ID will be revealed on outbound calls. Enabling or disabling this option triggers this event.	Medium
Voice: Route - Alternate Caller Number changed	When the Suppress Call ID option is enabled, an alternate call ID may be specified. Making a change to the number that will display to the recipients as caller ID triggers this event.	Medium
Voice: Route - Trunk changed	Skype for Business supports associations between gateways and Mediation Server pools through trunks. Adding or removing a trunk in a voice route triggers this event.	High
Voice: Route - PSTN Usage changed	PSTN usages records associate routes and voice policies to control which users are allowed to use specific routes. Adding or removing a PSTN usage to a voice route triggers this event.	High
Voice: Route - Configuration Enable Location Based Routing at the Global Scope changed	Location based routing allows administrators to control call routing based on the location of both the user placing the call and the user receiving the call. Making changes to the Global Location Based Routing option triggers this event.	High
Voice: Route - Priority changed	Route priority determines the order routes will be applied when more than one route is possible for an outbound call. Making a change to a route's priority triggers this event.	High
Voice: Trunk Configuration changed	A trunk can be configured between a Mediation Server and one or more peers (such as a PSTN gateway, IP-PBX, or SBC at the service provider) to provide public switched telephone network (PSTN) connectivity for Enterprise Voice clients and devices. Adding or removing a trunk configuration to the global/site/pool scope triggers this event.	High
Voice: Trunk Configuration - Policy changed	Trunk configuration policies define the relationship between the Mediation Server and its peers. Making a change in the following policies on a trunk configuration triggers this event: • Concentrated Topology (Centralized media processing) • Enable Bypass (Enable Media bypass) • Enable Mobile Trunk Support • Enable Session Timer • Enable Signal Boost • Remove Plus From Uri • RTCP Active Calls • RTCP Calls On Hold • Enable PIDFLO Support • Enable RTP Latching • Enable Online Voice • Forward Call History • Forward PAI (Enable forward P-Asserted-Identity data) • Enable Fast Failover Timer (Enable outbound routing failover timer) • Enable Location Restriction NOTE: Some policy names differ between the Skype for Business control panel and PowerShell. This document uses the PowerShell terminology. The term used in the Skype for Business control panel is included within brackets	High
Voice: Trunk Configuration - Max Early Dialogs changed	Administrators can configure the number of forked responses that a PSTN gateway, IP-PBX, or SBC at the service provider can receive to an invite that it sent to the Mediation Server. Altering this value on a trunk configuration triggers this event.	High
Voice: Trunk Configuration - Network Site ID changed	Trunk configuration settings can be associated with a network site through the network site ID. Changing the network site ID associated with the trunk configuration triggers this event.	High
Voice: Trunk Configuration - PSTN Usage changed	A collection of Public Switched Telephone Network (PSTN) usages can be assigned to a trunk configuration used for inter trunk routing. Adding or removing a PSTN usage triggers this event.	High
Voice: Trunk Configuration - Translation Rule changed	Translation rules normalize numbers to the required format for the trunking peer such as PSTN gateway, PBX, or SBC at the service provider. Translation rules are applied to calling and called phone numbers. Adding or removing a translation rule to/from the calling number or called number's translation rule list triggers this event.	High
Voice: Trunk Configuration - Translation Rule Pattern to Match changed	Translation rules normalize numbers to the required format for the trunking peer such as PSTN gateway, PBX, or SBC at the service provider. Pattern to Match is the regular expression that defines the number pattern to which the translation will be applied. Changing a calling or called number's translation rule's pattern to match triggers this event.	High
Voice: Trunk Configuration - Translation Rule - Translation Pattern changed	Translation rules normalize numbers to the required format for the trunking peer such as PSTN gateway, PBX, or SBC at the service provider. Translation Pattern is a regular expression that will be applied to the number matching the pattern to prepare that number for outbound routing. Changing a calling number or called number's translation rule's translation pattern triggers this event.	High
Voice: Trunk Configuration - SIP Response Code Translation Rule - List changed	SIP trunking enables the Skype for Business Server Enterprise Voice network to connect with a PSTN network. SIP Response Code Translation Rule list represents the rules that allow administrators to map SIP response codes with values between 400 and 699 received over a trunk to new values more consistent with Skype for Business Serve. Adding or removing a SIP response code rule to a trunk configuration triggers this event.	High
Voice: Trunk Configuration - SIP Response Code Translation Rule - Received Response Code changed	SIP trunking enables the Skype for Business Server Enterprise Voice network to connect with a PSTN network. The SIP response code translation rules format and map the the gateway SIP code to a format required by Skype for Business Server. Changing the received response code value triggers this event.	High
Voice: Trunk Configuration - SIP Response Code - Translation Rule Received ISUP Cause Value changed	SIP trunking enables the Enterprise Voice network to connect with a PSTN network. The SIP response code translation rules format and map the gateway SIP to a format required by Skype for Business Server. Changing the value of the ISDN User Part (ISUP) code that must be present in the SIP response message used by a gateway when responding to an invite message triggers this event.	High
Voice: Trunk Configuration - SIP Response Code - Translation Rule -Translated Response Code changed	SIP trunking enables the Enterprise Voice network to connect with a PSTN network. The SIP response code translation rules format and map the gateway SIP to a format required by Skype for Business Server. Changing the received response code value triggers this event.	High
Voice: Trunk Configuration -Encryption Support Level changed	The level of encryption determines the amount of protection for the traffic between the Mediation Server and the PSTN Gateway, IP-PBX, or SBC at the service provider. Making a change to the level of encryption (Required, Optional, or Not Supported) triggers this event.	High
Voice: Trunk Configuration - Support Referral changed	Support referral is a way to do call transfers. The available options include: • None: Call transfers are not allowed on the trunk. • Enable sending refer to the gateway: Trunk supports receiving refer requests from the Mediation Server. • Enable refer using third-party call control: Third party protocol can be used to allow transferred calls to bypass the hosted site. Changing the support referral trigger this event.	High

 

Log Events

When event logging for Skype for Business is enabled in Change Auditor, Skype for Business administration audited events will also be written to a Windows event log, named Change Auditor for Skype for Business. This event log can then be gathered by InTrust for further processing and reporting.

 

NOTE:   • Event Logging is supported only for Skype for Business Administration facility; it is not supported for the Skype for Business Configuration facility. • To enable event logging, select the Event Logging tool bar button on the Agent Configuration page (Administration Tasks tab), and select the type of event logging to be enabled.

Change Auditor for Skype for Business event log

The following table lists the log events captured when Skype for Business event logging is enabled. They are listed in numeric order by event ID.

 

Table 2. Change Auditor for Skype for Business event log events

Event ID	Description
10	The enabled attribute changed for user <UserName>
11	The SIP or Phone URI changed for user <UserName>
12	The primary address changed for user <UserName>
16	The enabled options changed for user <UserName>
17	User <MemberNameCN> added to Skype for Business administration group <GroupNameCN>
18	User <MemberNameCN> removed from Skype for Business administration group <GroupNameCN>
19	The policy changed for user <UserName>
20	The line server changed for user <UserName>
21	The topology back-end server changed for user <UserName>
22	Connection point created
23	Connection point removed

Built-in Reports

Change Auditor provides predefined reports which allow you to quickly retrieve valuable change information from a variety of perspectives.

NOTE: The terms ‘searches’ and ‘reports’ are used in conjunction to acquire the desired output. You run a ‘search’ and the results returned are referred to as a ‘report’.

To run a built-in search:

1	Click on the Searches tab or select the View | Searches menu command to open the Searches page.

2	Expand and select the appropriate folder in the explorer view (left pane) to display the list of search definitions stored in the selected folder. For example, selecting the Shared | Built-in | Skype for Business will display all the built-in searches available for Skype for Business.

3	In the right-hand pane, locate the search to be run and use one of the following methods to run the selected search:

•	Double-click a search definition

•	Right-click a search definition and select the Run menu command

•	Select the search definition and click the Run tool bar button at the top of the Searches page

4	A new Search Results Page will be displayed populated with the audited events that met the search criteria defined in the selected search definition.

NOTE: To modify a built-in search or create a custom Skype for Business search, see the Change Auditor User Guide.

Skype for Business built-in reports

NOTE: Lync built-in reports have been deprecated and new Skype for Business buit-in reports have been added. The new Skype for Business searches are located under the Skype for Business folder.

The following built-in reports are available with Change Auditor for Skype for Business:

•	All member changes in Skype for Business administration groups in the last 7 days

•	All Skype for Business administration events in the last 7 days

•	All Skype for Business Central Management Store (CMS) changes in the last 3 months

•	All Skype for Business configuration events in the last 7 days

•	All Skype for Business connection point events in the last 7 days

•	All Skype for Business events in the last 7 days

•	All Skype for Business topology changes in the last 7 days

•	All Skype for Business user events in the last 7 days

•	All Skype for Business voice changes in the last 7 days

•  Previous
• Viewing Topics 1 - 4 of 4
• Next 

Search this document Search all documents

Self Service Tools

Knowledge Base

Notifications & Alerts

Product Support

Software Downloads

Technical Documentation

User Forums

Video Tutorials

RSS Feed

Contact Us

Licensing Assistance

Technical Support

View All

×

 Welcome to Quest Support

You can find online support help for Quest *product* on an affiliate support site. Click continue to be directed to the correct support content and assistance for *product*.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating

© ALL RIGHTS RESERVED. Terms of Use Privacy Cookie Preference Center