Password Users System Administrator

[yana7]

In my instance, the system administrator account's password has changed in the "Updated by" field, which shows "Guest." Why is that?

[sandeepdutt]

Hi @yana7 ,

This is Clearly means that the user updated the record is an unauthenticated User.

So, It could be because of various reasons , i would check if any Scheduled Jobs, Business rules which might have run as Guest user and i will also check if any inbound email action which has triggered this.

I will chekc the Transactional logs (syslog) to verify .

[Aditya_hublikar]

Hello @yana7 ,

The sys_updated_by field is populated from the current session/user context. If the password update was performed by a process that is running without an authenticated user context, ServiceNow can record the updater as guest .

A scheduled/background process may update the sys_user record without a logged-in user, which can result in Guest being shown as the updater. Similarly, a script or automation, such as a Business Rule, Flow, or Script Action, may update the password under a Guest/system context. An integration or API can also update the user record, potentially causing Guest to appear in the Updated by field

If this helps you then mark it as helpful and accept as solution.

Regards,
Aditya