Troubleshooting Unity Connection voicemail login and PIN failures

See also

Sources

1. 1
   With Administrator Must Unlock checked in an authentication rule, a locked-out user cannot regain access until an administrator unlocks the account; Cisco advises checking it only where an administrator is readily available or the system is prone to toll fraud.

   Security Guide for Cisco Unity Connection Release 15 - Passwords, PINs, and Authentication Rule Management · section: Defining Authentication Rules to Specify Password, PIN, and Lockout Policies (Lockout Duration / Administrator Must Unlock) · Checked 2026-10-02
2. 2
   When the default application administration account is locked by password expiry or too many failed attempts, the CLI command utils cuc reset password unlocks it and changes its password.

   Troubleshooting Guide for Cisco Unity Connection Release 15 - Troubleshooting User and Administrator Access · section: Administration Accounts Unable to Sign-In to Serviceability · Checked 2026-10-02
3. 3
   Unity Connection handles calls from an alternate extension number or URI the same way as calls from the primary extension, provided the phone system passes ANI or caller ID to Unity Connection.

   System Administration Guide for Cisco Unity Connection Release 15 - User Settings · section: Alternate Extensions · Checked 2026-10-02
4. 4
   Administrators can add up to 9 alternate extensions per user, and users can add up to 10 more if their class of service lets them manage user-defined alternate extensions.

   System Administration Guide for Cisco Unity Connection Release 15 - User Settings · section: Alternate Extensions · Checked 2026-10-02
5. 5
   Alternate extensions have their own advanced conversation settings, and Cisco's example is a mobile phone set to use voice recognition and not be asked for a PIN.

   System Administration Guide for Cisco Unity Connection Release 15 - User Settings · section: Alternate Extensions · Checked 2026-10-02
6. 6
   Unity Connection authentication rules set the failed sign-in limit, lockout duration, credential expiry, minimum length and history for phone PINs and web passwords, and the failed sign-in setting governs the phone interface, Cisco PCA and Connection Administration.

   Security Guide for Cisco Unity Connection Release 15 - Passwords, PINs, and Authentication Rule Management · section: Defining Authentication Rules to Specify Password, PIN, and Lockout Policies · Checked 2026-10-02
7. 7
   Unity Connection identifies a caller as a user by matching the calling number against primary and alternate extensions only within the call's initial search scope; an extension in a partition outside that search space is not identified as the user.

   System Administration Guide for Cisco Unity Connection Release 15 - Call Management · section: Call Routing Tables (search scope and caller identification) · Checked 2026-10-02
8. 8
   The Minimum Number of Character Changes between Successive Credentials setting applies to web application passwords only, not phone PINs, and defaults to 1.

   Security Guide for Cisco Unity Connection Release 15 - Passwords, PINs, and Authentication Rule Management · section: Defining Authentication Rules to Specify Password, PIN, and Lockout Policies (Minimum Number of Character Changes) · Checked 2026-10-02
9. 9
   A maximum concurrent sessions limit (default zero, disabled) can be set; beyond it a new telephony session is disconnected and a new Visual Voicemail or IMAP login is denied.

   Security Guide for Cisco Unity Connection Release 15 - Passwords, PINs, and Authentication Rule Management · section: Restricting the Maximum Concurrent Sessions · Checked 2026-10-02
10. 10
    The Unity Connection 15 security guide recommends not enabling Never Expires and suggests web passwords expire after 120 days and phone PINs after 180 days, after which users are prompted to change the credential at next sign-in.

    Security Guide for Cisco Unity Connection Release 15 - Passwords, PINs, and Authentication Rule Management · section: Defining Authentication Rules to Specify Password, PIN, and Lockout Policies (Credential Expires After) · Checked 2026-10-02
11. 11
    The predefined direct routing rule Attempt Sign-In routes calls identified as coming from users to the sign-in conversation.

    System Administration Guide for Cisco Unity Connection Release 15 - Call Management · section: Call Routing Tables (predefined direct routing rules) · Checked 2026-10-02
12. 12
    The Unity Connection 15 troubleshooting guide directs administrators to confirm Use DTMF KPML and Use DTMF RFC 2833 are checked under Telephony Integrations > Port Group > Edit > Advanced Settings when key presses are not recognised.

    Troubleshooting Guide for Cisco Unity Connection Release 15 - Troubleshooting User and Administrator Access · section: Unity Connection Not Responding to Key Presses · Checked 2026-10-02
13. 13
    When Unity Connection is integrated with Unified CM over SCCP and calls arrive through IOS VoIP dial-peer gateways, the troubleshooting guide attributes ignored key presses to DTMF not being relayed and gives dtmf-relay h245-alphanumeric as the gateway fix.

    Troubleshooting Guide for Cisco Unity Connection Release 15 - Troubleshooting User and Administrator Access · section: Unity Connection Not Responding to Key Presses · Checked 2026-10-02
14. 14
    If a user hangs up before completing enrollment, the first-time enrollment conversation plays again at the next sign-in.

    User Guide for the Cisco Unity Connection Phone Interface (Release 15) - Enrolling as a Cisco Unity Connection User · section: Enrolling as a Cisco Unity Connection User · Checked 2026-10-02
15. 15
    First-time enrollment by phone starts with an ID and temporary PIN from the administrator and includes recording a name, recording a greeting, changing the PIN and choosing directory listing.

    User Guide for the Cisco Unity Connection Phone Interface (Release 15) - Enrolling as a Cisco Unity Connection User · section: Enrolling as a Cisco Unity Connection User · Checked 2026-10-02
16. 16
    The Unity Connection event EvtSubAccountInactive indicates the account was made inactive by the inactivity timeout rather than by failed sign-in attempts.

    Troubleshooting Guide for Cisco Unity Connection Release 15 - Troubleshooting User and Administrator Access · section: User Account Locked Over TUI/VUI Interface · Checked 2026-10-02
17. 17
    The Unity Connection event EvtSubAccLockedMaxHack indicates that a user exceeded the maximum number of sign-in attempts.

    Troubleshooting Guide for Cisco Unity Connection Release 15 - Troubleshooting User and Administrator Access · section: User Account Locked Over TUI/VUI Interface · Checked 2026-10-02
18. 18
    Cisco's Unity Connection 15 security guide recommends locking user accounts after three failed sign-in attempts.

    Security Guide for Cisco Unity Connection Release 15 - Passwords, PINs, and Authentication Rule Management · section: Defining Authentication Rules to Specify Password, PIN, and Lockout Policies (Failed Sign-In Attempts) · Checked 2026-10-02
19. 19
    Calls forwarded to Unity Connection are handled by the forwarded routing table, whose predefined Attempt Forward rule sends calls from user extensions to the user's greeting rather than to sign-in.

    System Administration Guide for Cisco Unity Connection Release 15 - Call Management · section: Call Routing Tables (forwarded routing rules) · Checked 2026-10-02
20. 20
    A CiscoHAProxyServiceDown entry in CiscoSysLog indicates the HAProxy service needs restarting when Unity Connection web applications are inaccessible.

    Troubleshooting Guide for Cisco Unity Connection Release 15 - Troubleshooting User and Administrator Access · section: Cannot Access Web Applications on Unity Connection · Checked 2026-10-02
21. 21
    Unity Connection's inactivity timeout disables user accounts after a configured number of days without use and is disabled (zero) by default.

    Security Guide for Cisco Unity Connection Release 15 - Passwords, PINs, and Authentication Rule Management · section: Configuring Inactivity Timeout · Checked 2026-10-02
22. 22
    Users who cannot reach Cisco PCA can use the Web Inbox at http://<server>/inbox and link from there to the other Unity Connection web tools.

    Troubleshooting Guide for Cisco Unity Connection Release 15 - Troubleshooting Cisco Personal Communications Assistant (PCA) · section: Users cannot Access Cisco PCA Pages · Checked 2026-10-02
23. 23
    If the calling number delivered to Unity Connection differs in format from the configured alternate extension (for example +E.164 versus a national number), the caller is probably not identified and falls through to the Opening Greeting instead of sign-in.inferred

    System Administration Guide for Cisco Unity Connection Release 15 - Call Management · section: Call Routing Tables (search scope and caller identification; Opening Greeting rule) · Checked 2026-10-02
24. 24
    Because the phone PIN and the web password are separate credentials with separate password settings, unlocking a user's web application password probably does not clear a phone PIN lockout, and the reverse; check the state of each one separately.inferred

    Security Guide for Cisco Unity Connection Release 15 - Passwords, PINs, and Authentication Rule Management · section: About the PINs and Passwords Users Use to Access Unity Connection Applications · Checked 2026-10-02
25. 25
    Unity Connection authentication rules do not govern web application passwords when LDAP authentication is enabled or under Unified CM Business Edition, because Unity Connection does not perform that authentication; users sign in with their LDAP or CMBE password.

    Security Guide for Cisco Unity Connection Release 15 - Passwords, PINs, and Authentication Rule Management · section: Web Application (Cisco PCA) Passwords / Defining Authentication Rules (LDAP note) · Checked 2026-10-02
26. 26
    When Unity Connection is integrated with an LDAP directory, the user's web application password and its password settings are controlled by the LDAP server, not Unity Connection.

    System Administration Guide for Cisco Unity Connection Release 15 - User Settings · section: Change Password / Password Settings note · Checked 2026-10-02
27. 27
    Cisco recommends a minimum phone PIN length of six or more digits, and a change to Minimum Credential Length takes effect only when a user next changes the credential.

    Security Guide for Cisco Unity Connection Release 15 - Passwords, PINs, and Authentication Rule Management · section: Defining Authentication Rules to Specify Password, PIN, and Lockout Policies (Minimum Credential Length) · Checked 2026-10-02
28. 28
    In Unity Connection 15, users who do not hear the sign-in prompt when calling voicemail are documented as either matching an incorrect direct call routing rule or having their extension fall outside the search scope set by the routing rule.

    Troubleshooting Guide for Cisco Unity Connection Release 15 - Troubleshooting User and Administrator Access · section: Users Do Not Hear Sign-in Prompt · Checked 2026-10-02
29. 29
    The predefined Opening Greeting rule is always the last entry in both the direct and forwarded routing tables and sends unidentified callers to the Opening Greeting call handler.

    System Administration Guide for Cisco Unity Connection Release 15 - Call Management · section: Call Routing Tables (predefined rules) · Checked 2026-10-02
30. 30
    If a user's extension overlaps an extension in another partition in the same search space, Unity Connection identifies the call as coming from the first object found in the search space's partition order.

    System Administration Guide for Cisco Unity Connection Release 15 - Call Management · section: Call Routing Tables (search scope and caller identification) · Checked 2026-10-02
31. 31
    Users who reach Cisco PCA but cannot open the Messaging Assistant lack the class of service setting Allow Users to Use the Messaging Assistant.

    Troubleshooting Guide for Cisco Unity Connection Release 15 - Troubleshooting Cisco Personal Communications Assistant (PCA) · section: Users cannot Access Unity Connection Web Tools from Cisco PCA · Checked 2026-10-02
32. 32
    The Cisco PCA error Sign-In Status – Account Has Been Locked is attributed to the user exceeding the failed sign-in limit set on System Settings > Authentication Rules.

    Troubleshooting Guide for Cisco Unity Connection Release 15 - Troubleshooting Cisco Personal Communications Assistant (PCA) · section: Error: Sign-In Status – Account Has Been Locked · Checked 2026-10-02
33. 33
    To unlock a web sign-in, an administrator opens Users > Edit Password Settings for the user, chooses Web Application in the Choose Password menu, and selects Unlock Password.

    Troubleshooting Guide for Cisco Unity Connection Release 15 - Troubleshooting Cisco Personal Communications Assistant (PCA) · section: Error: Sign-In Status – Account Has Been Locked · Checked 2026-10-02
34. 34
    The Cisco PCA URL http://<server>/ciscopca is case-sensitive, and an incorrectly capitalised URL is a documented cause of users being unable to reach Cisco PCA pages.

    Troubleshooting Guide for Cisco Unity Connection Release 15 - Troubleshooting Cisco Personal Communications Assistant (PCA) · section: Users cannot Access Cisco PCA Pages · Checked 2026-10-02
35. 35
    The error Bad response from CUCM. Reason: Requested resource is not available when updating a phone PIN points to the primary AXL server: check its username and password on Edit AXL Servers, that it is operational, and that its certificate validates or Ignore Certificate Errors is checked.

    Troubleshooting Guide for Cisco Unity Connection Release 15 - Troubleshooting User and Administrator Access · section: Error While Updating Phone PIN · Checked 2026-10-02
36. 36
    A Unity Connection user's phone PIN and Cisco PCA web password are separate, unsynchronised credentials, and first-time phone enrollment does not prompt for a web password change.

    Security Guide for Cisco Unity Connection Release 15 - Passwords, PINs, and Authentication Rule Management · section: About the PINs and Passwords Users Use to Access Unity Connection Applications · Checked 2026-10-02
37. 37
    A 401 Unauthorized error during PIN synchronization is resolved by confirming the PIN synchronization checkbox is enabled and the Unified CM application user has the AXL role.

    How to Enable Common PIN for CUCM and UCXN · section: Troubleshoot · Checked 2026-10-02
38. 38
    A Certificate not verified error when enabling PIN synchronization is resolved by checking that the certificates were exchanged and Unity Connection is reachable.

    How to Enable Common PIN for CUCM and UCXN · section: Troubleshoot · Checked 2026-10-02
39. 39
    On Unified CM, PIN synchronization is enabled under System > Application Servers by selecting the Unity Connection application server and checking Enable End User PIN Synchronization.

    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Integrate Cisco Applications · section: Enable PIN Synchronization (procedure) · Checked 2026-10-02
40. 40
    Unified CM documentation says that after PIN synchronization is enabled, administrators must force users to change their PIN for synchronization to take effect.

    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Integrate Cisco Applications · section: Enable PIN Synchronization (note) · Checked 2026-10-02
41. 41
    The common PIN feature shared between Unified CM and Unity Connection requires Unified CM 11.5 and Unity Connection 11.5 or later.

    How to Enable Common PIN for CUCM and UCXN · section: Prerequisites / Components Used · Checked 2026-10-02
42. 42
    PIN synchronization requires a valid Unity Connection certificate uploaded to tomcat-trust in Unified CM OS Administration, and a running publisher with completed database replication.

    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Integrate Cisco Applications · section: Enable PIN Synchronization (prerequisites) · Checked 2026-10-02
43. 43
    PIN synchronization requires the user ID in Unity Connection to match the user ID in Unified CM.

    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Integrate Cisco Applications · section: Enable PIN Synchronization (prerequisites) · Checked 2026-10-02
44. 44
    To use the Port Status Monitor tool for sign-in routing diagnosis, Unity Connection 15 requires checking Enable Remote Port Status Monitor Output under System Settings > Advanced > Conversations and listing the IP addresses allowed to connect.

    Troubleshooting Guide for Cisco Unity Connection Release 15 - Troubleshooting User and Administrator Access · section: Users Do Not Hear Sign-in Prompt (Port Status Monitor procedure) · Checked 2026-10-02
45. 45
    Predefined routing rules cannot be deleted, but Attempt Sign-In can be reordered relative to custom rules added to the direct table, so a custom rule placed above it can intercept user calls.

    System Administration Guide for Cisco Unity Connection Release 15 - Call Management · section: Call Routing Tables (predefined rules; changing rule order) · Checked 2026-10-02
46. 46
    Stored Number of Previous Credentials defaults to 5, and a new PIN or password matching one in that history is rejected.

    Security Guide for Cisco Unity Connection Release 15 - Passwords, PINs, and Authentication Rule Management · section: Defining Authentication Rules to Specify Password, PIN, and Lockout Policies (Stored Number of Previous Credentials) · Checked 2026-10-02
47. 47
    The Reset Failed Sign-In Attempts Every N Minutes setting clears the failed-attempt count unless the account is already locked, and the security guide recommends 30 minutes.

    Security Guide for Cisco Unity Connection Release 15 - Passwords, PINs, and Authentication Rule Management · section: Defining Authentication Rules to Specify Password, PIN, and Lockout Policies (Reset Failed Sign-In Attempts) · Checked 2026-10-02
48. 48
    Routing rules are evaluated top to bottom and the first rule whose conditions all match routes the call; a condition field left blank matches everything.

    System Administration Guide for Cisco Unity Connection Release 15 - Call Management · section: Call Routing Tables (rule evaluation; creating rules) · Checked 2026-10-02
49. 49
    For the missing sign-in prompt symptom, the Unity Connection 15 troubleshooting guide lists diagnostic traces Arbiter levels 14-16, Routing Rules level 11 and CDE level 4.

    Troubleshooting Guide for Cisco Unity Connection Release 15 - Troubleshooting User and Administrator Access · section: Users Do Not Hear Sign-in Prompt · Checked 2026-10-02
50. 50
    The Cisco PCA error Site is Unavailable is attributed to the Cisco Tomcat service not running; verify with RTMT or utils service list and restart with utils service restart Cisco Tomcat.

    Troubleshooting Guide for Cisco Unity Connection Release 15 - Troubleshooting Cisco Personal Communications Assistant (PCA) · section: Error: Site is Unavailable; section: Verifying Tomcat Service Running · Checked 2026-10-02
51. 51
    A user calling Unity Connection from a phone other than their own desk phone presses * when Connection answers and then enters their ID and PIN.

    User Guide for the Cisco Unity Connection Phone Interface (Release 15) - Enrolling as a Cisco Unity Connection User · section: Enrolling as a Cisco Unity Connection User (calling Connection) · Checked 2026-10-02
52. 52
    With trivial checking enabled, Unity Connection rejects a phone PIN that matches the numeric spelling of the user's first or last name or contains the user's primary or alternate extensions or their reverse.

    Security Guide for Cisco Unity Connection Release 15 - Passwords, PINs, and Authentication Rule Management · section: Defining Authentication Rules (Check For Trivial Passwords; non-trivial phone PIN criteria) · Checked 2026-10-02
53. 53
    A non-trivial Unity Connection PIN may not use repeated digit groups such as 408408, only two distinct digits, a digit more than twice in a row, ascending or descending runs, or straight, vertical or diagonal keypad lines such as 147 or 159.

    Security Guide for Cisco Unity Connection Release 15 - Passwords, PINs, and Authentication Rule Management · section: Defining Authentication Rules (non-trivial phone PIN criteria) · Checked 2026-10-02
54. 54
    A user whose account is locked over the Unity Connection telephone or voice user interface hears that the account is locked and cannot be opened and is told to contact the system administrator.

    Troubleshooting Guide for Cisco Unity Connection Release 15 - Troubleshooting User and Administrator Access · section: User Account Locked Over TUI/VUI Interface · Checked 2026-10-02
55. 55
    To resolve a TUI/VUI account lock, the Unity Connection 15 guide gives two remedies: uncheck Locked by Administrator under Edit User Basics > Password Settings, or set Voicemail Application Access to Active on Edit User Basics.

    Troubleshooting Guide for Cisco Unity Connection Release 15 - Troubleshooting User and Administrator Access · section: User Account Locked Over TUI/VUI Interface · Checked 2026-10-02
56. 56
    For password-based Visual Voicemail, a locked or disabled Unity Connection account can surface as Please enter a valid username and password pair even when the credentials are valid; the audit log shows Failed to Login to VMREST.

    Troubleshooting Guide for Cisco Unity Connection Release 15 - Troubleshooting User and Administrator Access · section: Troubleshooting Sign-in Problems with Visual Voicemail (Password-based) · Checked 2026-10-02
57. 57
    For PIN-based Visual Voicemail sign-in, a locked account produces a message telling the user the account is locked and to contact the administrator, and the audit log entry Failed to Login to Cisco Unity Connection VMWS indicates lockout from exceeded attempts.

    Troubleshooting Guide for Cisco Unity Connection Release 15 - Troubleshooting User and Administrator Access · section: Troubleshooting Sign-in Problems with Visual Voicemail (PIN-based) · Checked 2026-10-02
58. 58
    The error Account has been disabled in Cisco PCA, Unity Connection Administration or Web Inbox is resolved by setting Voicemail Application Access to Active on the user's Edit User Basics page; the audit log records that the user had not logged in for the configured inactivity days.

    Troubleshooting Guide for Cisco Unity Connection Release 15 - Troubleshooting User and Administrator Access · section: User Account Disabled Over Web Applications · Checked 2026-10-02
59. 59
    When no Unity Connection web application can be signed in to, the Release 15 guide says to check the Cisco HAProxy service (RTMT Critical Services or utils service list), restart it with utils service restart Cisco HAProxy, and if the problem persists do the same for Cisco Tomcat.

    Troubleshooting Guide for Cisco Unity Connection Release 15 - Troubleshooting User and Administrator Access · section: Cannot Access Web Applications on Unity Connection · Checked 2026-10-02

Documents

Cite this page

WarmTransfer. (2026, October 2). Troubleshooting Unity Connection voicemail login and PIN failures. WarmTransfer. https://warmtransfer.net/knowledge/unity-connection-login-troubleshooting

@misc{warmtransfer-unity-connection-login-troubleshooting,
  title  = {Troubleshooting Unity Connection voicemail login and PIN failures},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/unity-connection-login-troubleshooting},
  note   = {Verified 2026-10-02}
}