Remediate duplicate tasks - created by

[gwadsworth9]

Hi everyone,

Normally our "remediate duplicate tasks" are created by our MID server users ie mid.user. All previous tasks have been raised by mid.user until today.

We had several windows servers with the same serial number so they were rightly targeted as duplicates and a remediate duplicate task was created.

However, the "created by" attribute for the task itself was one of our infrastructure engineers. After speaking to him, he assures me he did not manually create the de-duplication task (which I know is an option). 

I have looked at scripts such as CMDBDuplicateTaskUtils and can not find what determines which user the de-dup tasks are raised under.

I also checked whether this user has created/updated the servers CIs the task was raised for in order to identify a pattern. Nothing with this particular users name could be seen. 

I appreciate this is not the most detrimental of incidents but it would be nice to understand what determines this. When our configuration management team go in to the dedup task to remediate, the first work note is from that particular user as it is their account that has apparently created the task. 

Any help would be greatly appreciated.

George

[James Hammond]

Hello @gwadsworth9 

Complete moonshot of a question, but what process/job added the duplicate servers to your CMDB that then generated the duplicate records task?  I have seen it in the past that SN can 'chain' the creation of records, so if an Import job was run by a particular user account that then triggered another script include elsewhere that their name was added to the Created by field on the resulting records.

[gwadsworth9]

Cheers for the quick reply James. The servers were created by ServiceNow IP based discovery. They were incorrectly discovered with the same serial number, leading to dedup task to be raised. Our discovery schedules normally run with MID servers running as mid.user, hence why every other dedup task has been created by mid.user. 

[James Hammond]

Definitely a mystery then, unless the person in question ran something like a Quick Discovery or manually ran a Discover Schedule that included the IP Addresses of the Servers in question then I can't see how they name would have been included.

[Rajesh Chopade1]

Hi @gwadsworth9

Check if there have been any recent changes to your configuration management process or system that could influence task creation and user attribution.

Review any scheduled jobs or background scripts that might be executing and creating de-duplication tasks. These scripts could potentially be running under a specific user account or service account, leading to tasks being attributed to that user.

thank you

rajesh