Chat now with support
Chat with Support

Change Auditor for Skype for Business 7.4 - User Guide

Skype for Business Auditing wizard

To audit Microsoft Skype for Business Server events, you need to define a Skype for Business auditing template for the Central Management Store to audit. You can also use this wizard to modify a previously defined template.

The following table provides a description of the fields and controls in the Skype for Business auditing wizard.

Template configuration options

Template Name: Enter a descriptive name for the template being created.

SQL Server: When you open the Skype for Business auditing wizard, the SQL Server and Instance hosting Central Management Store are retrieved from Active Directory and automatically populated on the page.

However, if the Microsoft Skype for Business Server and the coordinator are deployed in different Active Directory forests, enter the Central Management Store (CMS) SQL Server fully qualified domain name and select the SQL Instance type (Default or Named SQL Instance) to continue.

SQL Instance Credentials: Select the CMS SQL database authentication type and enter the credentials required to connect to the Central Management Store database server.

Test Database Credentials: (Optionally) Select to validate the credentials when the template is created to ensure that the database can be accessed.

Agent Configuration: The agent server is automatically populated with the SQL server name if the agent is deployed on it.

 

 

Skype for Business Searches and Reports

Skype for Business built-in searches

The terms ‘searches’ and ‘reports’ are used in conjunction to acquire the desired output. You run a ‘search’ and the results returned are referred to as a ‘report’. The built-in searches retrieve Microsoft Skype for Business Server activity captured by deployed agents enabling you to access valuable information from a variety of perspectives.

To see a complete list of built-in reports, see the Change Auditor Built-in Reports Reference Guide.

1
Click on the Searches tab.
Select the search definition and click the Run tool bar button at the top of the Searches page
NOTE: To modify a built-in search, see the Change Auditor User Guide.

Search results

The Skype for Business event information (including key information like who, what, when, where, why, and the event origin information) can be viewed on the Event Details pane in the Change Auditor client. The following table provides a description of the event details provided for Skype for Business events.

Severity

Displays “Low”, “Medium”, or “High” depending on the event.

Who

Specifies the name of the user who initiated the change.

Where

Displays the domain controller or CMS SQL server where the change occurred.

What

Displays a description of the activity that occurred.

When

Specifies the date and time when the change occurred.

Source

Displays ‘Change Auditor’ which is the application from which the event was retrieved.

Origin

Displays the NetBIOS name and IP address of the computer from which the event was generated.

Subsystem

Displays Skype for Business.

Action

Displays the action that was taken against the Active Directory object, such as Add Attribute, Add Object, Delete Attribute, Delete Object, Modify Attribute, Move Object.

Facility

Displays the event class facility to which the event belongs.

Attr

If an attribute has been added, deleted or modified, this field displays the name of the attribute.

Object

Displays the name of the object that was modified.

SSL/TLS

Indicates whether the LDAP operation is secured using the SSL (Secure Socket Layer) or TLS (Transport Layer Security) technology.

Kerberos

Indicates whether the LDAP operation is signed using Kerberos-based encryption.

From | To

Displays the old value that was assigned to the object and the new value that is now assigned.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating