Can we disable OOB system administrator account for security reasons

[RakaBhai1]

Hi Team,

Can we disable the OOB system administrator account in ServiceNow for security reasons. Please let us know the possible impacts of this . Also let us know it is recommended or not ?

[Allen Andreas]

Hi,

You "can" do this. There is a requirement though that at least 1 active account must have "admin" role associated, so it another account has it, then you're fine. Additionally, you'd want to ensure that no other business process, scheduled job, etc. is using this admin account as far as the "run as" and all that.

So not deleting the account, but simply deactivating it, should be fine.

Please mark reply as Helpful/Correct, if applicable. Thanks!

[RakaBhai1]

Hi Allen,

Thank you so much for reply. We have created one similar account with admin role. We have modify the run as for Scheduled jobs and scheduled report. Request you to let us know the other possible impacts where we can modify the run as . I have modify the run as in scheduled jobs but there are few jobs where I am not able to modify due to security prevent. I have also try with elevate role but getting the same issue. Please suggest

Thanks

Rakesh Gupta 

[Allen Andreas]

Hi,

I'm glad you found my reply above Helpful 🙂

With that said, if you've reviewed everything else, then you would be good to go to go ahead and set that default admin account to "inactive".

I'm unsure if you're saying the other records which for some reason you're unable to adjust, if that "run as" is admin or not? If so, and you can't change them, then you'd want to submit a case to ServiceNow support and let them know what you're trying to do.

Otherwise, please ensure you've exhausted all means to change that record and that you have appropriate rights to do so, but this would only be needed if the "run as" was that specific "admin" user.

Not "run as system", but "run as" and then the specific "admin" user record.

Please mark reply as Helpful/Correct, if applicable. Thanks!

[Chandra Sekhar6]

Yes we can disable it. But make sure you have atleast one user with admin role. You make the System administrator record inactive