Role Management - Inheritance issue.

[Ramkumar Thanga]

Hi,

We assigned the image_admin role to the knowledge role. As a result, users who already had the knowledge role inherited the image_admin role.

Later, we removed the image_admin role from the knowledge role. While the image_admin role was correctly removed for some users who had inherited it via knowledge, it was not removed for most users.

Upon checking the inheritance map, I found that there is no longer a relationship between those users and the image_admin role. However, the corresponding records in the sys_user_has_role table still show the inheritance flag as true.

According to a KB article I found, this can occur if the removal transaction was interrupted (e.g., due to a timeout or cancellation), preventing the cleanup from being fully completed.

To resolve this, I need to identify and remove the image_admin role for users who inherited it specifically via the knowledge role.

Is there a way to identify users who were granted the image_admin role through the knowledge role?

Thanks,
Ram

[mujeebqasimi]

yes. Filter sys_user_has_role by role = image_admin, inherited = true, and inherited_from = <sys_id of the knowledge role>
https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0965712&utm_source=chatgpt.co...

[Ramkumar Thanga]

Hi @mujeebqasimi , we don't have such field  inherited_from in the table sys_user_has_role.

Thanks!

[mujeebqasimi]

true. what you can do is pull up the role = image_admin with inherited = true, then check the inheritance map column, it’ll show if they got it from knowledge. also if you add the inh_count column and it shows 0, that means it’s an orphan record and can be cleaned up.

[mujeebqasimi]

true,
let's do it like this with inh_count

for your instance, you can use Role = image_admin AND Inherited = true then Inheritance map on a row 

if it shows knowledge → image_admin, that user truly gets it from knowledge.

if the map is empty and inh_count = 0, it’s an orphan (stuck record).

for fix you might need ServiceNow support.