How to find who has removed user from group?

[deeps]

Hi ,

        Some of the users are removed from certain group ,and would like to find the offender who has done that .

I tried to find in "sys_audit_role" and "sys_audit_delete" with no luck .

is there any other way we can find out the offender.

Help will be appreciated.

Regards

Deepti

[avinash kumar]

You can check the deleted record module and you will find the entry there. Created by is the person.

[Abhishek Raj3 · Accepted solution]

Hi Deeps,

Yes you can go to delete record and there you can see table name   Group member .when you will open you can see there payload and there you can see it is updated by admin.

This procedure you can follow to chcek the deleted record.

Thanks,

Abhishek

Please mark this response as correct and helpful via your post link https://community.servicenow.com/message/1123698#1123698 to help others with the same question

[deeps]

Thank you for the quick reply ..

[amlanpal]

Hi Deeps,

I hope you have activated Auditing for the User (sys_user) table. Please type sys_history_line.LIST in your navigation search to navigate History table. Then filter your search with Label as 'relation' and 'Old' as 'Group Member'. You will find the history data against the User record. The 'User Name' field contains the User who has removed the user from the Particular group. Find the below screenshots.

I hope this helps.Please mark correct/helpful based on impact