Incoming Call Route Changing On Its Own?

[norteld]

Hello everybody. I am having a pretty strange issue with an IP Office at a customer's office. They have 4 analog lines setup in incoming call route "0" which is programmed to ring a group of phones. Today, for the third time now, the incoming call route is all of the sudden going straight to their voicemail. I logged in through the Avaya Manager and sure enough, incoming call route 0 is set to go to voicemail. The other times this has happened I have changed it back to the hunt group it's supposed to be ringing, but for some reason it ends up going back to voicemail. The first time it did this was after 3 or 4 days, and this time it was after about a week and a half, and everytime it had been changed when the staff comes in first thing in the morning. I am changing it back again right now, but has anyone seen this or have any idea why this might be happening? The system has been installed for about a year and a half and never had any problems until a couple of weeks ago. The software version is 8.1 Essential. As always, I greatly appreciate any and all help you guys can give me. Thanks!

 

[smokinjoe2938]

go to the audit trail to see if someone is making these changes, maybe an ex employee that somehow has access to the system.

acss sme acis sme acss cm 5.2.1 acss cm and cmm acss aura messaging.

 

[amriddle01]

Indeed, or someone keeps an old config open in Manager and keeps sending unrelated changes back, unwittingly undoing all changes made since their config was taken

 

[norteld]

I checked the Audit Trail and there was a record of someone making the change to the incoming call route using the "Operator" account. They have no idea who it may have been, but I changed the passwords on all accounts so hopefully that will keep this from happening again. Thank you so much smokinjoe!

 

[amriddle01]

It tells you the IP address of who it was, the MAC address and the user logged in the PC

 

[IPGuru]

just to check
You do not have this system connected to the Internet do you?


A Maintenance contract is essential, not a Luxury.
Do things on the cheap & it will cost you dear

 

[norteld]

Yes, the system is connected to the internet. I'm confident that changing the passwords and removing all of the privileges from the Operator account (which nobody uses anyway) will keep this from happening again.

 

[amriddle01]

What about Phone Manager? Do all user have complex passwords? If not the people that were using the Operator account will initiate calls to very expensive corrupt countries using your hansdsets (out of hours) and then transfer it to themselves leaving you with a large bill,
FYI they can do a lot of damage with monitor/other tools too

 

[smokinjoe2938]

also look at all extensions on system and look at the forwarding tab to make sure someone hasn't configured a call forward to outside of system.The fact that someone has already made changes would set alarm bells off, so I would look everything over very closely!!!!!

acss sme acis sme acss cm 5.2.1 acss cm and cmm acss aura messaging.

 

[norteld]

Hmmm, I didn't know that people could make calls that way. I will be sure to stop by and check the forwarding setting on all phones. Is there anything else I should check while I'm at it? amriddle01, by complex passwords do you mean the voicemail passwords? I know the IP Office, but it is still one of the "other" systems I work on and not my specialty. I appreciate the advice and will definitely keep these things in mind on any future IP Offices I work on. Thanks again!

 

[smokinjoe2938]

disable all accounts not in use such as operator etc... also make admin account a strong password and lock down the security password

acss sme acis sme acss cm 5.2.1 acss cm and cmm acss aura messaging.