[cisco-voip] Minor investigation help

[Wes Sisk]

Do you have video Surveillance? :)

no real way to find out who pressed the CFA button.  Finger print kit?

For CCMUser access, you can use IIS logs to see the IP address of 
devices accessing the the CCMUser pages and making update.
IIS logs:
c:\winnt\system32\logfiles\w3svc1\

/Wes

Robert wrote:
> I have a little mystery to solve...
>
> A user came back to her desk to find her prime line had been forwarded
> to voicemail. Obviously, that is very simple to do by pressing CFwdALL
> then Messages. The user did not know about that method. She uses her
> CCMUser page to forward other lines on her phone. She pulled that up and
> verified that it was forwarded there as well, and unforwarded it at that
> time. Shortly after that, she called me to see if we can figure out who
> forwarded her phone.
>
> I am confident that she did not accidentally forward it herself. My
> question is, how could I see who did forward that extension? My thought
> is that someone did it from her phone as a prank.
>
> Any suggestions how I might determine at least whether it was done at
> her phone or by a CCMUser page?
>
> Thanks,
>
> Robert
>
> _______________________________________________
> cisco-voip mailing list
> cisco-voip at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-voip
>