BlackBerry Forums Support Community               

Closed Thread
 
LinkBack Thread Tools
Old 06-10-2007, 09:46 PM   #1 (permalink)
New Member
 
Join Date: Jun 2007
Model: 8700
PIN: N/A
Carrier: AT&T
Posts: 1
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default Audit Logs

Please Login to Remove!

I removed a user that was recently terminated and then a week later the user was added back to the BES. Where can I look to find out who added this user back. Huge Security issue and anyone's help would be greatly appreciated!!
Offline  
Old 06-10-2007, 10:03 PM   #2 (permalink)
x14
BlackBerry Extraordinaire
 
Join Date: Jul 2005
Location: NYC
Model: 9800
OS: 6.0.0.546
Carrier: AT&T
Posts: 2,344
Post Thanks: 0
Thanked 17 Times in 16 Posts
Default

User add/remove shows up in the Message Agent log. It won't show you who did it.
__________________
Exchange 2007/BES 5.0.2 MR2
Offline  
Old 06-22-2007, 06:38 PM   #3 (permalink)
Knows Where the Search Button Is
 
Join Date: Jul 2005
Model: 8300
Carrier: AT&T
Posts: 27
Post Thanks: 1
Thanked 0 Times in 0 Posts
Default

Here's a snippet of my script if you can figure out the SQL. It shows who added the user, I'm not sure if there's a way to find out who deleted the user (didn't check yet)

Code:
<?php
    /**
     * Returns an array of users who were added on MM/DD/YYYY (string) or between MM/DD/YYYY-MM/DD/YYYY (array)
     *
     * Example Output:
     * Array
     * (
     *     [0] => Array
     *         (
     *             [id] => 5775
     *             [username] => Doe, Jane
     *             [cn_username] => CN=Jane Doe/OU=Location/OU=EAST/O=Company
     *             [pin] => 12345678
     *             [created] => Apr 2 2007  2:36PM
     *             [password] =>
     *             [bes] => BES1
     *             [added_by] => XYZ_CORP\HelpDesk2
     *             [email] => jane.doe@company.com
     *         )
     *
     * @param mixed $timeframe
     * @return array
     */
    function get_added_list($timeframe)
    {
        // date format: Apr 20 2007
        $convert = 'convert(varchar(10),CreationTime,101)';
        if (is_array($timeframe))
        {
        $where = $convert . ' >= ' . "'".$timeframe[0]."'"
                  . ' AND ' . $convert . ' < ' . "'".$timeframe[1]."'";
        }
        else
        {
            $where = $convert . ' >= ' . "'".$timeframe."'"
                  . ' AND ' . $convert . ' < ' . "'".date('m/d/Y', strtotime('tomorrow', strtotime($timeframe)))."'";
        }

        $query = "SELECT
                	uc.id,
                	uc.DisplayName as username,
                	uc.UserName as cn_username,
                	uc.MailboxSMTPAddr as email,
                	uc.PIN as pin,
                	uc.CreationTime as created,
                	uc.KeyGenPassword as password,
                	uc.KeyGenExpiryTime as ea_timeout,
                	sc.MachineName as bes,
                	sch.SecDisplayName as added_by
                FROM UserConfig as uc
                INNER JOIN ServerConfig as sc
                	ON sc.id = uc.ServerConfigId
                INNER JOIN ServerConfigHistory as sch
                	ON uc.id = sch.UserConfigId
                WHERE $where and sch.operation = 'I'
                group by
                	uc.id,
                	uc.DisplayName,
                	uc.UserName,
                	uc.MailboxSMTPAddr,
                	uc.PIN,
                	uc.CreationTime,
                	uc.KeyGenPassword,
                	sc.MachineName,
                	sch.SecDisplayName,
                	uc.KeyGenExpiryTime
                ORDER BY bes, username";

        return $this->mssql_db->get_results($query,ARRAY_A);
    }
?>

Last edited by zerofill : 06-22-2007 at 06:42 PM.
Offline  
Closed Thread


Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On

Dental Files Starter Pack 5 x HyFlex CM Controlled Memory Niti File Starter Pack
$300.0
Dental Files Starter Pack 5 x HyFlex CM Controlled Memory Niti File Starter Pack pictureLeica TCRP1201 R300 Total Station Geo Surveying w/ Free SD Memory Card
$9100.0
Leica TCRP1201 R300 Total Station Geo Surveying w/ Free SD Memory Card pictureHobonichi Techo cover 2017 MEMORIES Original F/S Stationary from JAPAN
$69.99
Hobonichi Techo cover 2017 MEMORIES Original F/S Stationary  from JAPAN picture10pcs W25Q32FVSSIG W25Q32FVSIG 25Q32FVSIG 4M Memory Flash SOP-8 SMD
$2.09
10pcs W25Q32FVSSIG W25Q32FVSIG 25Q32FVSIG 4M Memory Flash SOP-8 SMD pictureTalkswitch CT.TS001 PBX 8 Line Telephone System w/ 64MB Memory Card
$145.0
Talkswitch CT.TS001 PBX 8 Line Telephone System w/ 64MB Memory Card picture






Copyright 2004-2016 BlackBerryForums.com.
The names RIM and BlackBerry are registered Trademarks of BlackBerry Inc.