How to find who had added user to the group after the user was removed from the group

[Nafeesa bashir]

Hi

Recently a user was added to our group which was not done by my team or manager. then i removed the user from the group.

Now i want to know who had added the user to the group because i missed to check it while removing that user.

Please help me here.

[Dr Atul G- LNG]

Hi @Nafeesa bashir 

Did you try with history

https://www.servicenow.com/community/developer-forum/how-to-check-who-added-or-removed-group-member-...

 But issue is if table is not audited then it is tough to know who added user in group

[Mark Manders · Accepted solution]

Check in the payload of your deleted records. The record is there as it was before you deleted it, so the 'sys_created_by' of the sys_user_grmember record will be the person that added the user to the group:

<?xml version="1.0" encoding="UTF-8"?><sys_user_grmember><group display_value="Service Desk" name="Service Desk">d625dccec0a8016700a222a0f7900d06</group><points>0</points><scrum_role/><sys_created_by>glide.maint</sys_created_by><sys_created_on>2015-12-14 00:15:21</sys_created_on><sys_id>d6266b1fc0a8016700a112121c900054</sys_id><sys_mod_count>0</sys_mod_count><sys_updated_by>glide.maint</sys_updated_by><sys_updated_on>2015-12-14 00:15:21</sys_updated_on><user display_value="David Loo">5137153cc611227c000bbd1bd8cd2007</user></sys_user_grmember>

This is the payload from a user I just deleted from a group on my own instance.