Chat now with support
Chat with Support

Change Auditor for Skype for Business 7.4 - User Guide

Skype for Business Auditing wizard

To audit Microsoft Skype for Business Server events, you need to define a Skype for Business auditing template for the Central Management Store to audit. You can also use this wizard to modify a previously defined template.

The following table provides a description of the fields and controls in the Skype for Business auditing wizard.

* 
NOTE: A red flashing icon indicates that you have not yet entered the required information. Hovering your cursor over this icon displays a tool tip explaining what to enter.
Table 1. Skype for Business
Page
Description

Template configuration options

Template Name: Enter a descriptive name for the template being created.

SQL Server: When you open the Skype for Business auditing wizard, the SQL Server and Instance hosting Central Management Store are retrieved from Active Directory and automatically populated on the page.

However, if the Microsoft Skype for Business Server and the coordinator are deployed in different Active Directory forests, enter the Central Management Store (CMS) SQL Server fully qualified domain name and select the SQL Instance type (Default or Named SQL Instance) to continue.

SQL Instance Credentials: Select the CMS SQL database authentication type and enter the credentials required to connect to the Central Management Store database server.

•
Login ID: The CMS database Login ID.
•
Password: The CMS database password.
•
Domain: The CMS database domain.

Test Database Credentials: (Optionally) Select to validate the credentials when the template is created to ensure that the database can be accessed.

NOTE: If a trust does not exist between the CMS SQL Server's domain and the coordinator's domain where the client is connected, the test for Windows Authentication may fail even though the CMS do credentials are valid.

Agent Configuration: The agent server is automatically populated with the SQL server name if the agent is deployed on it.

 

 

Skype for Business Searches and Reports

•
Skype for Business built-in searches
•
Search results

Skype for Business built-in searches

The terms ‘searches’ and ‘reports’ are used in conjunction to acquire the desired output. You run a ‘search’ and the results returned are referred to as a ‘report’. The built-in searches retrieve Microsoft Skype for Business Server activity captured by deployed agents enabling you to access valuable information from a variety of perspectives.

To see a complete list of built-in reports, see the Change Auditor Built-in Reports Reference Guide.

To run a built-in search:
1
Click on the Searches tab.
2
Expand and select the appropriate folder in the explorer view (left pane) to display the list of search definitions stored in the selected folder. For example, selecting the Shared | Built-in | Skype for Business will display all the available built-in searches.
3
In the right-hand pane, locate the search to be run and use one of the following methods to run the selected search:
•
Double-click a search definition
•
Right-click a search definition and select the Run menu command
•
Select the search definition and click the Run tool bar button at the top of the Searches page
4
A new Search Results Page will be displayed populated with the audited events that met the search criteria defined in the selected search definition.
* 
NOTE: To modify a built-in search, see the Change Auditor User Guide.

Search results

The Skype for Business event information (including key information like who, what, when, where, why, and the event origin information) can be viewed on the Event Details pane in the Change Auditor client. The following table provides a description of the event details provided for Skype for Business events.

 
Table 2. Event Details pane: Skype for Business events
ChangeAuditor
Description

Severity

Displays “Low”, “Medium”, or “High” depending on the event.

Who

Specifies the name of the user who initiated the change.

NOTE: Due to the nature of some events, the “who” field will display the computer account rather than an individual user because it is the computer account that is actually making the change.

Where

Displays the domain controller or CMS SQL server where the change occurred.

What

Displays a description of the activity that occurred.

NOTE: For lengthy descriptions, hover your cursor over the description field to view the entire event description.

When

Specifies the date and time when the change occurred.

Source

Displays ‘Change Auditor’ which is the application from which the event was retrieved.

Origin

Displays the NetBIOS name and IP address of the computer from which the event was generated.

Subsystem

Displays Skype for Business.

Action

Displays the action that was taken against the Active Directory object, such as Add Attribute, Add Object, Delete Attribute, Delete Object, Modify Attribute, Move Object.

Facility

Displays the event class facility to which the event belongs.

Attr

If an attribute has been added, deleted or modified, this field displays the name of the attribute.

Object

Displays the name of the object that was modified.

SSL/TLS

Indicates whether the LDAP operation is secured using the SSL (Secure Socket Layer) or TLS (Transport Layer Security) technology.

NOTE: If changes are initiated within LSASS and not through the LDAP protocol itself, this field will not be captured.

Kerberos

Indicates whether the LDAP operation is signed using Kerberos-based encryption.

NOTE: If changes are initiated within LSASS and not through the LDAP protocol itself, this field will not be captured.

From | To

Displays the old value that was assigned to the object and the new value that is now assigned.

NOTE: This information is not available for occurrence type events, such as when an object is created or deleted.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating