Revoke itil role from users not logged in 60 days

[SN Rookie]

Hi All,

The requirement is to remove ITIL role from users who haven't logged in 60 days from groups (which provide itil access) and also those users who were given itil role explicitly. Before removing it should also give row count so that the numbers can be matched. Any help is highly appreciated.

Thanks

[Ct111]

Hi ServiceNow User,

var cnt =0;

var ga = new GlideAggregate('sys_user');

ga.addEncodedQuery('roles=itil^last_loginONLast 60 days@javascript:gs.daysAgoStart(60)@javascript:gs.daysAgoEnd(0)');

ga.addAggregate('COUNT');

ga.query();

while(ga.next())

{

cnt = ga.getAggregate('COUNT');

gs.print('Therefore the number of users who have itil role and not logged in since 2 months are'+cnt);

ga.roles = '';

}

Try the below code in background script and you will get the count as well the users who are not logged in since 60 days will have their roles revoked .

PLEASE mark my ANSWER as CORRECT if it served your purose.

[Bhawana Upreti]

Hello,

You can try with the given script.

var count=0;
var users =new GlideRecord('sys_user');
users.addQuery('last_login_time', '<', gs.daysAgo(60));
users.query();
while(users.next()){

var hasRole = new GlideRecord('sys_user_has_role');
hasRole.addQuery('user',users.sys_id);// try testing it in background script by hardcoding the sysid the of user who is fulfilling the condtion
hasRole.addQuery('role.name', 'itil');
hasRole.query();
if (hasRole.next()) {

count++; // count number of users who is having role and didn't log-in from last 60 days
hasRole.deleteRecord(); // remove roles from the role table
gs.print("Hello! User "+count+ " with sys-id " +users.sys_id + " is going to be removed" );
}


}

Thank you!

[SN Rookie]

Bhawna - I'm trying the below script but it's no deleting the record from role table. The count is correct which is 1, however it doesnt remove the entry from the table

var users = new GlideRecord('sys_user');
users.query();
while(users.next())

{
var hasRole = new GlideRecord('sys_user_has_role');
hasRole.addQuery('user', users.sys_id);
hasRole.addQuery('role.name', 'itil');
hasRole.addEncodedQuery('user.active=true^user.last_login_time<javascript:gs.beginningOfLastWeek()^role=282bf1fac6112285017366cb5f867469^inherited=true');
hasRole.query();
while (hasRole.next())
{
hasRole.deleteRecord();

}
}

[Bhawana Upreti]

Did you try with mine?