Unauthorised Change

[RaymundA]

Hi all,

I raised a Change Request for Windows Server patching for the usual Microsoft patch Tuesday. 

This is a Standard change because we do this patching regularly. This has been approved by management and CAB.

The description and details in the CR describes patching for all Windows Servers in our enviroment.

However, in the midst of patching, there were two server names not added / missed out in the Affected CI tab. We have to manual add each server names in the Affected CI tab.

There was no impact to the users or services. I have added the server names into the Impacted services list. 

This has been flagged as Unauthorized Change? Please advise if it is so.

Thanks very much.

[Mark Manders]

Your change was authorized and after the approval, you make changes. That makes it unauthorized. The CAB and management 'officially' did not approve on those two servers being updated.

In 'real world' this isn't an issue, of course, because they were missed and were updated anyway and nobody will bite off your head for doing so, but administratively speaking, you didn't get authorization for these two servers.

also: https://www.servicenow.com/community/sysadmin-forum/unauthorised-change/td-p/2858755

[Dr Atul G- LNG]

Hi @RaymundA 

https://www.servicenow.com/community/developer-forum/unauthorised-change/m-p/2857130/emcs_t/S2h8ZW1h...

[Sohail Khilji]

Hi @RaymundA ,

Those CIs which are added additonally are falling under unauthorized change... (as its a standard change the risk can be mitigated via offline approval from stakeholder before schedule phase.)

if the date has not arrived you can cancel the exisitng standard change and create a new standard change with all CIs included for patching.