Change Auditor for Skype for Business 7.3

Chat now with support

Search results

The Skype for Business event information (including key information like who, what, when, where, why, and the event origin information) can be viewed on the Event Details pane in the Change Auditor client. The following table provides a description of the event details provided for Skype for Business events.

Table 2. Event Details pane: Skype for Business events
ChangeAuditor	Description
Severity	Displays “Low”, “Medium”, or “High” depending on the event.
Who	Specifies the name of the user who initiated the change. NOTE: Due to the nature of some events, the “who” field will display the computer account rather than an individual user because it is the computer account that is actually making the change.
Where	Displays the domain controller or CMS SQL server where the change occurred.
What	Displays a description of the activity that occurred. NOTE: For lengthy descriptions, hover your cursor over the description field to view the entire event description.
When	Specifies the date and time when the change occurred.
Source	Displays ‘Change Auditor’ which is the application from which the event was retrieved.
Origin	Displays the NetBIOS name and IP address of the computer from which the event was generated.
Subsystem	Displays Skype for Business.
Action	Displays the action that was taken against the Active Directory object, such as Add Attribute, Add Object, Delete Attribute, Delete Object, Modify Attribute, Move Object.
Facility	Displays the event class facility to which the event belongs.
Attr	If an attribute has been added, deleted or modified, this field displays the name of the attribute.
Object	Displays the name of the object that was modified.
SSL/TLS	Indicates whether the LDAP operation is secured using the SSL (Secure Socket Layer) or TLS (Transport Layer Security) technology. NOTE: If changes are initiated within LSASS and not through the LDAP protocol itself, this field will not be captured.
Kerberos	Indicates whether the LDAP operation is signed using Kerberos-based encryption. NOTE: If changes are initiated within LSASS and not through the LDAP protocol itself, this field will not be captured.
From \| To	Displays the old value that was assigned to the object and the new value that is now assigned. NOTE: This information is not available for occurrence type events, such as when an object is created or deleted.