Email notification on local administrator login

[ServiceNow Use6]

Hi @Maik Skoddow ,

I have a requirement.

As a System Administrator, I need an email notification set up to send an alert when a local admin login occurs in the production environment to ensure that this account is not used unless absolutely necessary for security purposes. Kindly help.

Regards

Suman P.

[Musab Rasheed]

Confused what you are saying. Can you elaborate.?

[ServiceNow Use6]

Hi @Musab Rasheed ,

The question says 

I need an email notification set up to send an alert when a local admin login occurs in the production environment.

In our email set up which you have advised, we have only 'last login time'. There is no condition for admin.

Can you please help how can I check if it for 'local admin'?

Regards

Suman P.

[Musab Rasheed · Accepted solution]

What is local admin , if that a role like 'local_admin' if yes then below will work, Mark my answer as correct if that helps.

var answer = false;

var gr = new GlideRecord('sys_user_has_role');
gr.addQuery('user', current.sys_id);
gs.log("Current log in "+current.sys_id);
gr.addQuery('role', '9b947bfc1b97811039cdc843604bcb3b');

gr.query();
if(gr.next())
	{
			gs.log("Going inside");
		answer = true;
	}
else
	{
		gs.log("Not going inside");
		answer = false;
	}

[Aman Kumar S]

Hey,

Below article just answers that question.

Check the notifications from the Instance Security Center.
System Security > Instance Security Center
Click on you name, top right corner, and select "Notification Preferences".
There you'll find this option:

Ref link:

https://community.servicenow.com/community?id=community_question&sys_id=11ce7164db9fc510fd8d2b6913961942