Revoke itil role from users not logged in 60 days

SN Rookie · ‎07-01-2018

Hi All,

The requirement is to remove ITIL role from users who haven't logged in 60 days from groups (which provide itil access) and also those users who were given itil role explicitly. Before removing it should also give row count so that the numbers can be matched. Any help is highly appreciated.

Thanks

Jay81 · ‎07-03-2018

Please try below script to delete user from support group

delete_user();
function delete_user()
{
var grp_role = new GlideRecord('sys_group_has_role');
grp_role.addQuery('role','282bf1fac6112285017366cb5f867469');
grp_role.query();
while(grp_role.next())
{
var gr_mem = new GlideRecord('sys_user_grmember');
gr_mem.addQuery('group',grp_role.group); gr_mem.addEncodedQuery("user.last_login_time<javascript:gs.daysAgoStart(60)^role=282bf1fac6112285017366cb5f867469^user.active=true");
gr_mem.query();
while(gr_mem.next())
{
gr_mem.deleteRecord();
gs.print("deleted users: " + gr_mem.user.getDisplayValue());

}

}
}

View solution in original post

SN Rookie · ‎07-02-2018

Bhawana - I tried but it seems the script would not remove inherited roles , which is what I require.

Sharique Azim · ‎07-02-2018

we have a scheduled job that runs every fortnight.

here is the script:

var gr = new GlideRecord('sys_user_has_role');
gr.addEncodedQuery('role=b8226d23b4323100c8684c93e51a4d2a^user.last_login_time<javascript:gs.daysAgoStart(60)'); //check your itil role sys_id
gr.deleteMultiple();

SN Rookie · ‎07-02-2018

Shariq, I tried your script but it still doesn't remove the entry from sys_user_has_role table. Am I doing something incorrect here?

Sharique Azim · ‎07-02-2018

i hope your scheduled job is configured correctly and run as is also set. can you please share a screenshot?

Jay81 · ‎07-02-2018

Try below script.

var gr = new GlideRecord('sys_user_has_role');
gr.addEncodedQuery("user.last_login_time<javascript:gs.daysAgoStart(60)^role=282bf1fac6112285017366cb5f867469^user.active=true"); //change itil role sysid

//gr.setLimit(1);
gr.query();
while(gr.next())
{
gs.print('userName:' + gr.user.name);
gr.deleteRecord();

}

PS: You can't delete records with inherited roles in sys_user_has_role table.

If your issue is resolved please mark the answer correct