As an admin, can I set an alert when someone impersonates me?

[qster]

We have multiple admins working in our system.  Call me paranoid but since they have the ability to impersonate so

1) I'd like to know if someone impersonates me, maybe an alert

2) I'd like to know how to tell if changes are done by someone impersonating another user. 

Thank you!

[Tudor]

Hi,

1. Yes, but you need to update the UI Macros that do this /sys_ui_macro_list.do?sysparm_query=nameLIKEimpers&sysparm_first_row=1&sysparm_view=&sysparm_choice_query_raw=&sysparm_list_header_search=true

or 

https://community.servicenow.com/community?id=community_question&sys_id=a2734f25dbd8dbc01dcaf3231f9619f8

https://community.servicenow.com/community?id=community_question&sys_id=b0a38b65dbd8dbc01dcaf3231f961967

2. Not sure that the OOTB provides this feature, however, you could potentially look in the logs when an impersonation started and when it ended and in that time frame look for all updates in the sys_update_xml table

Hope this helps!

 Tudor

[JP - Kyndryl]

Hi,

An event is logged at impersonation,  so you may set a notification based on that event.

Regards.

JP

[Allen Andreas]

Hello,

Commonly, I've seen a notification setup to trigger when the impersonate event is fired. This lets people, yourself, whomever, know.

That one downside is that when you @mention someone in a journal field, it also triggers this impersonation event, but you could review the log and see more details if needed to verify.

Please mark reply as Helpful/Correct, if applicable. Thanks!