How to read the Admin Changes audit on a user record

When a permission flips and nobody owns up to it, the answer is usually sitting right on the user record. VICIdial keeps a per-user audit trail called Admin Changes for this User Record, and it's the first place to look when something on an account changed unexpectedly.

What the section records

Open a user in the admin and scroll down. The Admin Changes section lists every administrative change made to that one record. Each entry tells you four things: who made the change, the IP address they made it from, what changed, and when it changed. That combination is enough to reconstruct most "who touched this" questions without guessing.

• Who: the admin user who saved the change.
• From where: the source IP address of that admin.
• What: the field or setting that was altered.
• When: the timestamp of the change.

How to use it in a review

Say an Agent suddenly has access to a campaign they shouldn't, or someone's Agent API flag was enabled. Pull up their record, read the Admin Changes list, and find the entry where that setting flipped. The who and the IP together tell you whether it was a legitimate manager from the office or something that needs follow-up. Because the IP is captured, it pairs neatly with your IP whitelisting policy.

flowchart TD
  A[Setting changed unexpectedly] --> B[Open the user record]
  B --> C[Scroll to Admin Changes]
  C --> D[Find the entry for that field]
  D --> E{Who and IP expected}
  E -->|Yes| F[Legitimate change logged]
  E -->|No| G[Flag for follow up]

Note: the log is scoped to a single user record, so it answers "what happened to this account" rather than "what did this admin do across the system." If you need an admin's full activity, you'll pair this with the broader stats reports. It also won't capture downstream effects like a Scheduled callback that an agent later sets; it tracks administrative edits to the user record itself.

Why the IP column matters

The source IP turns a vague suspicion into something you can confirm. If your team only administers from the office, a change stamped with an unfamiliar address is an immediate red flag, even when the username looks legitimate, because a shared password could be in use from somewhere it shouldn't be. Cross-reference the recorded IP against the networks you actually trust. This is exactly where the audit log and IP whitelisting reinforce each other: the whitelist limits where changes can come from, and the log proves where they did come from.

Make reading the log a habit, not just an incident response. A quick scan of recent changes after a shift change or a new hire's first week catches mistakes early, before a wrong permission has a chance to cause a real problem. The timestamps also help you reconstruct a sequence when several settings changed together, so you can see whether one careless bulk edit or several separate ones caused the drift.

This audit is most useful when you've already organized people into clean teams. The users and groups multi-team guide explains how a User group keeps changes attributable, and when you do make an edit, follow the steps in how to modify a VICIdial user.

A managed VICIfast box gives you this audit trail on a clean admin from the first login, no setup required. See VICIfast pricing and provision a dedicated dialer in under 40 seconds.