Email notification on local admin login

[ServiceNow Use6]

Hi,

As a System Administrator, I need an email notification set up to send an alert when a local admin login occurs in the production environment to ensure that this account is not used unless absolutely necessary for security purposes. How can I achieve this? Kindly help.

Regards

Suman P.

[ServiceNow Use6]

Hi @Michael de Boer ,

Thank you so much. Here, the question is about production environment. How can I use it for production environment.

Regards

Suman P.

[Michael de Boer · Accepted solution]

It's a user option.
Users with the admin role can enable this option in production for their own account to receive the notification.

Regards,

Michael

[now developer]

Hello Mike,

I am unable to see these notifications on Vancouver. Can you please help me navigate these notifications.

Thanks

[ankitbeura1]

Hi ServiceNow Enthusiast,

I’m not sure if this helps directly, but I’ve found a practical solution to monitor break-glass access in your production instance:

Step 1: Observe the sys_user_login_history table in your production instance. This table logs all user login activity.

Step 2: Look for the field called Privileged User. This field is automatically set to true if the user has any of the following roles:

• admin
• security_admin
• itil_admin

These roles are considered privileged and may indicate break-glass access when used outside standard authentication methods.

Step 3: Set up a notification that triggers when a login occurs with Privileged User = true.

This will help your security team investigate and confirm whether the access was authorized and aligned with your break-glass policy.

Regards,

Ankit