Determine who approve record via impersonation?

[Edwin Fuller]

I have users impersonating other users and approving records. Is there a way to find out who actually approve the record?

[randrews · Accepted solution]

any start of impersonation is logged in the syslogs you could create a filter for syslogs to show those events and check that day...

the start log will have a message of "Impersonation start:<username>   by: <username>

and end with

Impersonation end: <username>

if you really wanted to you could create a metric to capture these and then report on the table..

my bigger questions is   WHY is this happening... you should NEVER approve anything while impersonating that is a huge audit problem... and should be against policy.

if someone is unable to approve they should submit some kind of request to be set as a delegate for approvals ... i would suggest creating a catalog item for that.

the ONLY people that should have impersonate in production are senior developers.. and even they shouldn't ever approve an item, <they can make themselves an admin and approve it with appropriate notes/attachments as to why they approved>

[Jeff Boltz1]

That's why help is being asked to create this control.

[Allen Andreas]

Hi Jeff,

Not sure what you mean by your post. Do you have a question we can help you with?

Thanks!

[Jeff Boltz1]

Hi Allen,

Yes, is there a way to report on who approved something via impersonation?  The solution shows how to find who was impersonating, but can something be done to show who/if someone impersonated, then approved?

I agree with the sentiment on the post, but was looking for way to solution.

Consider this post, Report on approval by delegate - Now Platform - Question - ServiceNow Community, here there is a way using a BR to capture the delegate approving a record.  

I hope that makes sense.

Thanks,
Jeff