The group member is added automatically by system!

[Community Alums]

Hi everyone,

I have the situation where one of the user is added automatically to the group that granted him the admin role in which he is not allowed to have.

I checked the Event log and see this "sn_change_cab.group_member.added" is created by system to add this user to the group. Does anyone know what triggered this?

Thanks in advance!

[Mark Manders]

This comes from the fact that sys_property "glide.ui.schedule_slushbucket_save_for_group_roles" has been enabled. This means that background jobs take care of granting roles and groups to users, instead of foreground jobs. 

You can look for the event that did this (your screenshot shows it already) and see who triggered that event (the created by will be the person that added this user to that group).

https://www.servicenow.com/community/now-platform-forum/how-to-check-who-added-a-user-to-the-group/m...

[sethgross]

Hi Mark,

I have something similar, but instead of adding someone to a group, a group was created by System. Do you think I could find the answer to why, in the same area? There are no logsduring the time of creation that I can find unfortunately.

Thank you!

[Mark Manders]

It's always best to ask your own questions on the community rather then reply with a question on someone else's. Especially when your question isn't the same. Someone looking for the question you are asking will not find it when searching, because the question found is different.

And you are also not providing enough information to answer your question. A group created by system can be caused by any server side script or flow. Where are your groups normally created from? Who/what creates them? Is it an integration, or are the manually created? What happened at the time of creation? Is it related to a plugin being activated (OOB group?)? Do you have flows that look for a group and if they can't find it, create it? Or a scheduled job that is running? Groups are data and data isn't just being created. Without access to your instance or knowing what you have running on it and how things are configured, it's impossible to answer your question.

[Community Alums · Accepted solution]

Hi all,

To reply to my own question, we found that someone created a Flow to add the user to the admin group and click Test.