BlackBerry Forums Support Community
              

Closed Thread
 
LinkBack Thread Tools
Old 06-10-2007, 09:46 PM   #1 (permalink)
New Member
 
Join Date: Jun 2007
Model: 8700
PIN: N/A
Carrier: AT&T
Posts: 1
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default Audit Logs

Please Login to Remove!

I removed a user that was recently terminated and then a week later the user was added back to the BES. Where can I look to find out who added this user back. Huge Security issue and anyone's help would be greatly appreciated!!
Offline  
Old 06-10-2007, 10:03 PM   #2 (permalink)
x14
BlackBerry Extraordinaire
 
Join Date: Jul 2005
Location: NYC
Model: 9800
OS: 6.0.0.546
Carrier: AT&T
Posts: 2,344
Post Thanks: 0
Thanked 17 Times in 16 Posts
Default

User add/remove shows up in the Message Agent log. It won't show you who did it.
__________________
Exchange 2007/BES 5.0.2 MR2
Offline  
Old 06-22-2007, 06:38 PM   #3 (permalink)
Knows Where the Search Button Is
 
Join Date: Jul 2005
Model: 8300
Carrier: AT&T
Posts: 27
Post Thanks: 1
Thanked 0 Times in 0 Posts
Default

Here's a snippet of my script if you can figure out the SQL. It shows who added the user, I'm not sure if there's a way to find out who deleted the user (didn't check yet)

Code:
<?php
    /**
     * Returns an array of users who were added on MM/DD/YYYY (string) or between MM/DD/YYYY-MM/DD/YYYY (array)
     *
     * Example Output:
     * Array
     * (
     *     [0] => Array
     *         (
     *             [id] => 5775
     *             [username] => Doe, Jane
     *             [cn_username] => CN=Jane Doe/OU=Location/OU=EAST/O=Company
     *             [pin] => 12345678
     *             [created] => Apr 2 2007  2:36PM
     *             [password] =>
     *             [bes] => BES1
     *             [added_by] => XYZ_CORP\HelpDesk2
     *             [email] => jane.doe@company.com
     *         )
     *
     * @param mixed $timeframe
     * @return array
     */
    function get_added_list($timeframe)
    {
        // date format: Apr 20 2007
        $convert = 'convert(varchar(10),CreationTime,101)';
        if (is_array($timeframe))
        {
        $where = $convert . ' >= ' . "'".$timeframe[0]."'"
                  . ' AND ' . $convert . ' < ' . "'".$timeframe[1]."'";
        }
        else
        {
            $where = $convert . ' >= ' . "'".$timeframe."'"
                  . ' AND ' . $convert . ' < ' . "'".date('m/d/Y', strtotime('tomorrow', strtotime($timeframe)))."'";
        }

        $query = "SELECT
                	uc.id,
                	uc.DisplayName as username,
                	uc.UserName as cn_username,
                	uc.MailboxSMTPAddr as email,
                	uc.PIN as pin,
                	uc.CreationTime as created,
                	uc.KeyGenPassword as password,
                	uc.KeyGenExpiryTime as ea_timeout,
                	sc.MachineName as bes,
                	sch.SecDisplayName as added_by
                FROM UserConfig as uc
                INNER JOIN ServerConfig as sc
                	ON sc.id = uc.ServerConfigId
                INNER JOIN ServerConfigHistory as sch
                	ON uc.id = sch.UserConfigId
                WHERE $where and sch.operation = 'I'
                group by
                	uc.id,
                	uc.DisplayName,
                	uc.UserName,
                	uc.MailboxSMTPAddr,
                	uc.PIN,
                	uc.CreationTime,
                	uc.KeyGenPassword,
                	sc.MachineName,
                	sch.SecDisplayName,
                	uc.KeyGenExpiryTime
                ORDER BY bes, username";

        return $this->mssql_db->get_results($query,ARRAY_A);
    }
?>

Last edited by zerofill : 06-22-2007 at 06:42 PM.
Offline  
Closed Thread


Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On

Toshiba Strata CIX 100 MIPU16 1A V2E 16 Channel IP VOIP Telephone Expansion Card
$194.95
Toshiba Strata CIX 100 MIPU16 1A V2E 16 Channel IP VOIP Telephone Expansion Card pictureLG NORTEL IP8830 VoIP Phone N0199941
$60.0
LG NORTEL IP8830 VoIP Phone N0199941 picturePolycom SoundStation IP 6000 Conference VoIP Phone
$100.0
Polycom SoundStation IP 6000 Conference VoIP Phone pictureToshiba LIPU-X1A 16-Channel VoIP Interface Card / CTX - VGC
$49.95
Toshiba LIPU-X1A 16-Channel VoIP Interface Card / CTX - VGC pictureIP 550 Business VOIP Handset base IPitomy Large display multi-line Telecom Phone
$44.99
IP 550 Business VOIP Handset base IPitomy Large display multi-line Telecom Phone picture






Copyright 2004-2016 BlackBerryForums.com.
The names RIM and BlackBerry are registered Trademarks of BlackBerry Inc.