What log would I use to discover what user deactivated user accounts in the sys_user table?

Sloan D_
Tera Contributor

‎05-10-2022 02:55 PM

I have been tasked to discover who deactivated a couple of user accounts in the User Table.  I have used several customized searches in the All module under the System Log application to no avail.

0 Helpfuls
  • 1,182 Views
2 REPLIES 2

Pradeep Sharma
ServiceNow Employee
ServiceNow Employee

‎05-10-2022 06:18 PM

Hi Sioan, Ideally when a user is deactivated it is logged under log message with Information as "ExternalAuth: provider_user_map is de-activated for user:62826bf03710200044e0bfc8bcbe5df1" . you can check the value of "created_by" field to track who deactivated the user record.

Please note here 62826bf03710200044e0bfc8bcbe5df1 is the sys_id of the user.

 

- Pradeep Sharma

SELECT Username
ServiceNow Employee
ServiceNow Employee

‎05-12-2022 11:33 AM

The sys_user table isn't audited by default in an OOB instance.  Caution must be exercised in auditing of the table because there are some fields that are update quite frequently (like "last_login_time", "last_login_device", "last_login", "failed_attempts", etc.) on which you'd need to set "no_audit=true" in order to prevent an ugly impact from enabling auditing.

When auditing is turned on, it will capture changes moving forward.

If auditing is not enabled for the table or the field in question has no_audit set to "true", you won't be able to find the record in the audit table.